On the near future I will have a WordPress blog, public and visible to anyone, that has a members area. This members area accesses some private data on a special database with financial data, so this kind of info should only be viewable to customers of the site. 

The private site will be running inside a VPN on a business LAN and a little server, and I wonder if hosting that private part together with the public site would be a good idea. 

In fact, due to WordPress vulnerabilities (it is a desired target right now) I think that if an attacker gains access to the WP site and that's inside the VPN, then he would be able to attack "from inside" and eventually he could even access to the private site and its data.

Wouldn't it be more appropiate to have the public site outside, on a VPS for example? The members area would be accessed through a secure protocol (HTPPS), and I wonder if there are some recommendations on this subject. 


Question: Adjoint Functors as Initial Objects of Some Category
Answer: Well, yes: the left adjoint of a functor $G: C \to D$ is the initial object in the category whose objects are pairs $(H: D \to C, \eta: 1_D \to G H)$ where $\eta$ is a natural transformation, and whose morphisms $(H, \eta) \to (H', \eta')$ are natural transformations $\theta: H \to H'$ such that 

$$\begin{array}{ccc}  &amp; 1_D &amp;  \\\\ {}^{ \eta} \swarrow &amp; &amp; \searrow {}^{\eta'} \\\\  GH &amp; \xrightarrow{G\theta} &amp; GH'\end{array}$$

commutes. Similarly, a right adjoint can be expressed as a terminal object in a suitable category (exercise in applying the concept of duality). 

See the discussion on comma categories in Categories for the Working Mathematician,