8 ms·

WordPress now runs a quarter of the web

139 points by mustafauysal 11y ago

mamon 11y ago
That sounds scary considering the fact that Wordpress security flaws make it "remote system administration tool" first, and blog platform second.
- vatotemking 11y ago
  citation needed
  - johansch 11y ago
    http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/ http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...
    - Karunamon 11y ago
      200 vulns in 11 years? That doesn't sound awful in perspective. I bet you use software every single day that has significantly more.
  - belorn 11y ago
    The problem with wordpress security is mostly attached the insecure developer practices when dealing with themes. Many developers just take a standard theme, copies it, and then attach their own modifications. This piece of code never gets updated and the owner rarely even know that its there until they get hacked, reinstall with a updated wordpress, and then get rehacked a few days later.
    - pknight 11y ago
      Themes rarely have hackable exploits due to what they (are supposed to) do. If there's insecure code in there it's probably code with functionality that belongs in a plugin to start with. Themes that have had vulnerabilities in them tend to be the kinds of commercial themes that are filled with features and 3rd party scripts to satiate users demands. Not really a WordPress core problem, it is a market problem. Although package management is something WordPress lacks in.
- evook 11y ago
  That made my day. I got Anxiety Attacks reading that article and some of the comments here. A shitty codebase with a kinda useless API on top of the cockroach of databases. Et voilà, the perfect platform to make the web a little bit less stable, less performant and contributing to the increasing trend of low quality code.
mrfijal 11y ago
i kind of wonder how did we get to this point. technologically speaking it's a disaster - terrible slow and insecure language as a platform for bad practices and codr base. i guess the answer is that technical excellence.is absolutely secondary to other concerns, but it's a concerning view.
- Ono-Sendai 11y ago
  sounds like a case of 'worse is better': https://www.jwz.org/doc/worse-is-better.html https://www.jwz.org/doc/worse-is-better.html
- mschuster91 11y ago
  There may be other technical solutions that are better from a technology POV. What WP did right is to choose a platform supported EVERYWHERE (PHP, and not Ruby, Java or other crap only supported by few hosters), with a shitload of developers (again, the massive advantage of PHP), and packed the installation process in a way everyone from an 8-year old school kid to a 70-year old grandpa can handle (and literally, I have seen both!). Also add in that wordpress.com's free hosting platform... well... surpasses any other blog solution by far.
  - mahouse 11y ago
    >Also add in that wordpress.com's free hosting platform... well... surpasses any other blog solution by far. Are you sure? To me, it's by far the slowest one of them all.
  - PopeOfNope 11y ago
    > What WP did right is to choose a platform supported EVERYWHERE When WP was created, their options were PHP or Perl. PHP was by far the hottest thing back then, so what they actually did was use the hot tech of the day and made it work. The reason PHP is supported everywhere is for the same reason; back then it was PHP or Perl via CGI. Python was added later and was also supported EVERYWHERE.
    - 11y ago
pinkunicorn 11y ago
Is this some kind of a pipe dream? WordPress runs a quarter of the web?
- jacquesm 11y ago
  Unfortunately, no. https://managewp.com/14-surprising-statistics-about-wordpress-usage https://managewp.com/14-surprising-statistics-about-wordpres... (2014)
- jqm 11y ago
  No it's not a pipe dream. It's a pipe nightmare.
Mithaldu 11y ago
A quarter of all websites includes a LOT of tiny websites nobody visits. How many users/hits/bandwidth of the web does WP get?
- ryanmac 11y ago
  This. While impressive, the headline is misleading.
- frik 11y ago
  Google and Ask.com used to have a "Blog search" feature. Nowadays minor sites are hard to find, and many seatch results on the first page are ads (that look almost like real search results on a non-IPS screens aka low price TFT/LCD screens on consumer notebooks/PCs).
- CM30 11y ago
  Quite a lot, considering that some of these brands use (or used to use) WordPress: http://www.wpbeginner.com/showcase/40-most-notable-big-name-brands-that-are-using-wordpress/ http://www.wpbeginner.com/showcase/40-most-notable-big-name-... It's fairly common among large media publications.
  - PopeOfNope 11y ago
    That's something that gets overlooked in these discussions of wordpress. Wordpress has the unique ability to use a single install and backend to manage hundreds of sites. If you need content cross posted across multiple sites, wordpress can do that. If you want to pull an entire column of articles from one site to another, wordpress can do that. Wordpress has spent a ton of time on multisite features and (as far as I know) there's no other CMS in existence that handles this stuff out of the box. That's why large media companies love it and, I suspect, why a quarter of the internet runs it still when there are faster and more secure alternatives out there.
    - evunveot 11y ago
      I've never used it professionally, but dotCMS is a Java- and Elasticsearch-based CMS that has very impressive multisite features [1]. From what I can tell, a lot of its capabilities stem from a design that treats absolutely everything (data, content, static assets, "themes") as a node in a virtual filesystem, or rather a filesystem-per-site, so everyday filesystem operations cover a lot of use cases. I believe you can even manipulate your site(s) via WebDAV to some extent, e.g. to develop a theme in your IDE of choice while saving directly to the site or, more realistically, saving to a private staging copy of the site that lives on the same server, which you can then copy into production from within the dotCMS admin. I gave some consideration recently to adopting dotCMS for client work to replace an in-house PHP CMS, but although Java-the-language isn't particularly intimidating and dotCMS itself looks fairly self-contained and straightforward to deploy -- Elasticsearch is embedded rather than requiring separate setup, for example -- it's still tied up in the Java ecosystem (OSGi, maven, XML configuration) so there's a lot to get used to for someone approaching it from outside that realm. [1] http://dotcms.com/#anchor1 http://dotcms.com/#anchor1
Dachande663 11y ago
WordPress is like the Kalashnikov of the web. You can use it for pretty much anything, run it anywhere, do god knows what to it and it'll still happy hum along (albeit behind a very big varnish cache). A few of our clients have millions of pageviews running off of a couple t2.small instances and the single biggest factor for them is the UI and the security of knowing they're not tied into a bespoke platform.
- vonklaus 11y ago
  wordpress, and a t2.micro can handle >1 million pageviews?
  - brianwawok 11y ago
    with a cache sure. static content is easy to serve.
  - pavs 11y ago
    nginx + varnish + cdn + pagespeed + php-apc. Most definately possible and you will still have 400+mb memory to spare on a 1gb server, avg cpu usage is at 30-40%. Done it for few clients myself.
  - thekonqueror 11y ago
    My test server delivered 3.9 Million pageviews per hour with similar setup[1] http://nestify.io/benchmarks/ http://nestify.io/benchmarks/
- jjoe 11y ago
  We have clients running multisite with 150MM+ page views per month but on dedicated hardware and Varnish running in front of it. The latter is a must in a setup like this. You save on MRC for server rentals, which is a huge value proposition.
  - robtaylor 11y ago
    what kind of costs are involved? I run a community site that does 1m pv's a month and growing but we get hammered on 'breaking news' as wp-super-cache does not seem to handle post updates well under high use thus interested in possible solutions or alternatives.
chris_wot 11y ago
I have to say, setting up blogger was just far too hard. Maybe something has changed, but back in the day I was trying to find a math renderer for http://randomtechnicalstuff.blogspot.com.au http://randomtechnicalstuff.blogspot.com.au - but couldn't find anything. I haven't bothered since, and my latest blog at http://sherlockchrisblog.wordpress.com http://sherlockchrisblog.wordpress.com is just working with LaTeX markup. It's honestly a breath of fresh air.
- jgillich 11y ago
  Blogger hasn't seen any development in years. I expect Google to shut it down when enough users have left.
pahael 11y ago
not surprised. I've seen my html illiterate friends make full websites using wordpress. The power of php I guess.
CM30 11y ago
It's not that surprising to be honest. WordPress' success comes down to the following: 1. It was simple to use in an era where CMS meant 'large, complicated system that was tailored towards technies rather than the general population'. It didn't have a ton of features, but it was easy to use for the average blogger wanting to write posts without worrying about all the setup and coding and what not. 2. You could pretty much install it anywhere without minimum technical skill, since PHP and MySQL was (and is) supported by about 99.99% of shared hosts. Its newer competitors tend to be written in languages that are usually only available on a VPS or dedicated server. 3. It has a very large ecosystem for themes, plugins and other such things, so someone with no technical skill could find add ons for anything they wanted without needing to call in a developer or know PHP. It's not the best written software and its not the best optimised for anything in particular, but it is one of the easiest to install and use for someone without a technical background, which is why it's so widespread.
- picozeta 11y ago
  I agree with your points, but always wonder why shared hosting is often PHP/MySQL only. E.g. if you are using Python, say Django or Flask, and want to outsource your devops (i.e. shared hosting) you do not have many options. Of course, there is pythonanywhere or you might want to use PAAS like Heroku, but I find it interesting non the less. Is it so much more work for shared hosting providers to provide Python?
  - coliveira 11y ago
    PHP guys are very smart about not trying to reinvent the wheel. They always supported the most common web setup: Apache running on its standard configuration. That's why every shared host company in the world is confident in deploying PHP and avoids like the plague more complex solutions based on Python, Java, and Rubi.
    - pizzeys 11y ago
      I'd say it's actually the opposite - the users are comfortable with PHP and not the more complex solutions. I'd love for us to support other stuff, but anyone who is using anything else wants more control over their environment than the average shared host can offer. We have as many deployment issues etc. with PHP as we would anything else... possibly more. That said, isn't 'IaaS' like Heroku basically 'shared hosting for other stuff'?
jachob 11y ago
... And still no decoupling and no real API. Wordpress is locked down by its own mass of users and just can't evolve. Too big to fail ?
- graupel 11y ago
  The API is coming - https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/ https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge...
- andrebalza1 11y ago
  V2 Api (http://v2.wp-api.org http://v2.wp-api.org) will be merged into wordpress 4.4 core, planned for december 2015
  - DrewAPicture 11y ago
    It's already been merged into trunk ;)
jachob 11y ago
... And still no decoupling and no real API. Wordpress is locked down by its own mass of users and just can't evolve. Too big to fail ?
mbrock 11y ago
The total economic activity attributable to WordPress must be staggering. How many small businesses use it? How many consultants and design firms? Even the business of creating WordPress themes must be very significant.
- visakanv 11y ago
  > Even the business of creating WordPress themes must be very significant. It is, lots of people make full-time livings doing it, and even have entire companies set up to do it.
  - mbrock 11y ago
    Themes like Divi seem to compete directly with things like Squarespace, including custom WYSIWYG layout tools etc. http://www.elegantthemes.com/gallery/divi/ http://www.elegantthemes.com/gallery/divi/ Here's a testimonial from an independent web site creator that I found interesting. http://www.elegantthemes.com/blog/customer-spotlight/creating-my-own-web-design-business-helped-me-become-a-better-dad http://www.elegantthemes.com/blog/customer-spotlight/creatin... (I have no affiliation at all with this nor any other WordPress business, I just think it's interesting—as a counterpoint to the stereotypical HN focus on fancy new technology—how enormously productive this ecosystem really is.) > One day, as I was in the process of writing a post for inspireddad.org, I had a sudden epiphany. I thought to myself, WordPress is not like any other website builder I have used before. It is powerful, simple, and can be used for almost anything… and I can see myself making a living off of this one day. It was this thought that set me into motion, and I began learning everything I possibly could about WordPress—I became obsessed. [...] > I honestly believe I might have given up on this dream if it hadn’t been for the amazing support that the ET team gave to me early on. This support, coupled with my own growing WordPress knowledge, enabled me the opportunity to launch approximately two dozen websites in my first year—which gave me the confidence I needed to take my business to the next level. [...] > The incredible support and products of [Elegant Themes] have enabled me the chance to do what I love—achieving an entrepreneurial lifestyle that has allowed me to truly help my clients, while also giving my family my time and attention as a husband and father. I'm half tempted to abandon my current plans of startup world domination and just make WordPress websites for local businesses.
netaustin 11y ago
I agree entirely with the premise that WordPress is not the most impressive codebase in the world — but that's not why people select it. The reason that sites opt to use WordPress is that the editorial interface is familiar and the plugin ecosystem is very robust. The reason that sites stay on WordPress is that upgrades arrive for free every couple of months and do not break backwards compatibility. WordPress's performance has improved over the years largely as a result of the rising tide of CPU and RAM upgrades and improvements to PHP and MySQL themselves — and more recently through integrations with Elasticsearch, which WordPress works particularly well with. It's also possible to use WordPress as a framework and to develop elegant code using its APIs, which is largely what my firm does (I run one of the handful of agencies that partner with Automattic to provide WordPress consulting to big companies). But that's the exception, not the rule, and most of the prospective developers we interview who have WordPress experience can't use it the way we want.
- audessuscest 11y ago
  > the plugin ecosystem is very robust It's not true, a lot of WP plugins are buggy and sometimes conflict each other. > upgrades arrive for free every couple of months and do not break backwards compatibility But sometimes plugins break with upgrades
  - stevesearer 11y ago
    Paid plugins (with support) are the way to go for getting the highest quality and I've had great experiences with them. Some of the ones I've had great luck with on my site are Advanced Custom Fields, Gravity Forms, and most recently FacetWP. Edit: that said, there are also high quality free ones as well
kmfrk 11y ago
One wonders what the world would look like if Google hadn't dropped the ball on Blogger.
- josephagoss 11y ago
  Can you self host Blogger and download the code?
- mark_l_watson 11y ago
  Just curious: what do you about dropping the ball? I just showed my 94 year old Dad how to use Blogger and he really likes it.
- petercooper 11y ago
  Possibly more like Medium given how instrumental Ev has been in each.
sopooneo 11y ago
Any consultants on here that have to deliver/maintain WordPress sites? If so, mind sharing what your basic workflow is? There are many articles on the web, but they are mostly for very entry level users. The fundamental problem my company runs into with WP is that only a theme can be meaningfully checked into version control. Everything else, including installation of plugins is coupled with entries in the database. And of course the database also includes changes necessarily made on the production instance, like comments to blog posts. Any thoughts or links to posts on this greatly appreciated.
- jsalinas 11y ago
  There is http://versionpress.net/ http://versionpress.net/ but it's still on early access.
- raverbashing 11y ago
  You can probably split (by table) bootstrap information (config) from CMS information (posts/comments) A plugin will usually set some entries on installation (then add its work data as well) But yeah, I believe there's an interesting void of supporting tools for WP (it needs to be DevOps'd)
- rdrake 11y ago
  I've been meaning to try out Revisr [0]. [0] https://github.com/ExpandedFronts/revisr https://github.com/ExpandedFronts/revisr
- neurostimulant 11y ago
  If you prefer git-based deployment for your wordpress project, bedrock is probably for you: https://roots.io/bedrock/ https://roots.io/bedrock/ Also, wp-cli helps a lot in streamlining the project (enabling/disabling plugins, updating site settings, etc, all from command line or deployment script scripts)
- PopeOfNope 11y ago
  I worked briefly for a wordpress consultancy last year. Our main workflow involved using Yeoman, Grunt, NPM, wp (the wordpress command line tool) and vagrant. Locally, we'd run vagrant just so we don't have to monkey around with environment issues (too much). Yeoman, grunt, npm and wp were used in tandem to script the creation of a new wordpress install, install any dependencies needed, run any tools needed through grunt (like sass and JS minifiers), and pull plugins and themes from their separate git repositories. We still had to import the database by hand, though, when setting up our environment as well as add lines to wp-config for however we wanted to handle debugging. Then we'd write code and check it in via git as with any other project. If you were working on frontend anything (html,css,js) you either ran grunt all the damned time or ran grunt watch. Those of us who had a hard time with the unique programming requirements of wordpress (escaping, sanitizing, formatting) used phpcs to automate that. As for deployment, we'd just go through the same setup on the server that we do locally. Updates were pushed via git. The fundamental problem my company runs into with WP is that only a theme can be meaningfully checked into version control. Everything else, including installation of plugins is coupled with entries in the database. That wasn't my experience. We separated functional features into separate plugins (so they could be disabled or enabled on a site by site basis) and had no problem using version control with them. In fact, one project had some government security problems and required each plugin to be in its own repo. I wouldn't suggest that, but it works. the database also includes changes necessarily made on the production instance, like comments to blog posts That was something I found aggravating that was never really addressed at the company I worked at. When new people were brought on to a project, they'd get a mysql dump of the staging environment. After that, as new features were added, you were responsible for adding your own test data to see if those features worked. As for production, the changes made that were specific to the production database were made manually in production. When a new plugin was pushed, you had to log into the production instances manually and turn the new plugin on. Luckily, there are hooks you can use to automate any setup or teardown of plugins when they get turned on and off respectively.
mtgx 11y ago
Can we get a Wordpress alternative written in Go, though?
- MaxKK 11y ago
  Why? (Serious)
- relaxitup 11y ago
  Journey? Might be more like a Ghost alternative, but in the ballpark. https://kabukky.github.io/journey/ https://kabukky.github.io/journey/
- deleted 11y ago
  [deleted]
nogridbag 11y ago
I recently looked at Hugo[1] as a WP alternative and have been very impressed. It's a static website generator written in Go and features its own server with live-reload so you can see changes to your content instantly in the browser. I was looking for something that a non-techie might be able to maintain and since Hugo offers prebuilt binaries the only requirements for the maintainer is to drop hugo.exe into the working directory and type a few commands. In the end though, it's still a bit more complicated for non-techies than maintaining a website created via WordPress. [1] https://gohugo.io https://gohugo.io
- PopeOfNope 11y ago
  Considering some of the people I've made wordpress sites for couldn't even figure out the wordpress interface, command line anything is a no go for a large percentage of wordpress's intended audience.
  - soared 11y ago
    Hell, FTP is a no go for most of wordpress's audience.
  - e12e 11y ago
    Yeah, I'm sure it'd be possible to build on top of Hugo (or many other static site generators) to build something that might be usable for the typical wp customer - but afaik none of them are that out of the box. The most likely alternative I can think of is Ghost: https://ghost.org/ https://ghost.org/ But, I'm not sure how easy it is to customize along the lines that people expect from wp (Now, that could be considered a feature - but it also means it could be a hard sell to someone that just wants a wp site). If what is needed really is a static site (a "web site"/"homepage") -- I think netlifly looks quite promising: https://www.netlify.com/ https://www.netlify.com/
  - nogridbag 11y ago
    Actually the command line interface wasn't the deal breaker for me. I was asked to help out creating a website for a tiny organization (< 10 people). Once I found out multiple people would need to collaborate and edit the website it basically eliminated Hugo as a possibility. I suppose they could sync files via Dropbox but as I'm not a dropbox user myself I have no idea how it handles merges. Git is not really a possibility for obvious reasons. Finally, deployment is the final hurdle. If they wanted to edit a sentence on a WordPress site it's very easy. But with something like Hugo it would be a 3 step process: Edit the file. Build the website. Deploy to your web host.
jjuhl 11y ago
Putting all eggs in one basket is scary. Putting all eggs in a PHP powered basket is terrifying beyond words. We're doomed :-(
rmdoss 11y ago
And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought a lot of non-technical people to use it and develop for it. So you get a lot of bad written themes and plugins that lead to all sort of security issues. On the other hand, Drupal and Joomla, all had SQL injections on their core discovered lately: https://www.drupal.org/SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 https://blog.sucuri.net/2015/10/joomla-3-4-5-released-fixing-a-serious-sql-injection-vulnerability.html https://blog.sucuri.net/2015/10/joomla-3-4-5-released-fixing...
- jqm 11y ago
  But it does get an inordinate amount of attention from people looking to crack it. At least according to my server logs. So sure... if everything is locked down and up to date and no shaky plugins installed no problem. On the other hand, one careless slip up...
  - pavs 11y ago
    > On the other hand, one careless slip up... And how is it not the same for any other server side software? Most of the WP security issue is related to user not knowing what they are doing or third party plugin/theme. Wordpress vanialla itself is not anymore insecure than other popular CMS or simialar software out there. From my own personal experince from doing at least 70-80 WP installs in different configurations and have never experienced any security issues in over 10 years. Thats doesnt mean its the norm. Its just that if you are going to play with a highly customizable and powerful piece of server side software and if you dont know what you are doing then you are going to screw shit up.
    - jqm 11y ago
      Other server side software doesn't get nearly the same number of attacks. At least according to my server logs. Plus, other server side software doesn't let button clickers get into trouble as easily.
- jonesb6 11y ago
teleclimber 11y ago
Matt Mullenweg's post on this is interesting [1]. "The big opportunity is still the 57% of websites that don’t use any identifiable CMS yet, and that’s where I think there is still a ton of growth for us (and I’m also rooting for all the other open source CMSes)." I wonder what currently runs the remaining 57%. [1] http://ma.tt/2015/11/seventy-five-to-go/ http://ma.tt/2015/11/seventy-five-to-go/
- caseysoftware 11y ago
  Raw [programming language of choice] or custom CMS that someone's nephew hacked together and they don't care enough or have the time/money to replace. In 2005-2008, I made good money switching people from those systems to Drupal with the simple pitch of plugging into a larger community and being able to shop around for modules and developers who wouldn't have to learn a new codebase.
rebootthesystem 11y ago
I must admit ignorance here. I've installed WP a couple of times but never went live with it or did anything past poking around. Here's my hangup: I can't understand why one would start with a blogging platform, pound at it with various plugins and transform it into, say, a product/ecommerce website. It feels like starting with a shovel when you need a pick (or some other more applicable analogy). That's the part I don't quite understand. Carrying all of that baggage to build something diametrically opposite what the original stated function of the software may have been. On the funny end of the scale, I've seen five page static websites with a landing page, a few info pages and a form done with WP. Unbelievable. Are developers that lazy today that they throw WP at everything? Or is it easier at that level to charge X to do a WP site rather than charging the same for straight-up PHP/HTML/JS?
- SHIT_TALKER 11y ago
  On the funny end of the scale, I've seen five page static websites with a landing page, a few info pages and a form done with WP. Unbelievable. Are developers that lazy today that they throw WP at everything? Or is it easier at that level to charge X to do a WP site rather than charging the same for straight-up PHP/HTML/JS? When the client says they want to be able to update site content themselves.... okay, here's your five page WordPress site with a single form.
  - rebootthesystem 11y ago
    Yeah, that's probably the scenario with the least friction.
- ufmace 11y ago
  I haven't used Wordpress much, but I am working on an Orchard site at my current job. It's a CMS kinda like Wordpress, but built on C#/ASP.NET. Our dev team is mostly working on a dozen or so custom-coded account management pages in a separate module, but most of the content is marketing material as pages built in the Orchard management screens, kind of like blog posts, but arranged like a conventional website. The developers aren't terribly enthusiastic about working with those Orchard pages, since they're tough to collaborate on and version control. But the Marketing people seem to like it just fine, probably because conventional web site building tools, like writing HTML and CSS and managing folders of content with source control tools, is too complex and error-prone for them, and the site UI is worlds better than any other technique they might be willing to use. I'm guessing Wordpress works in a similar way. Now that I think about it, I had always idly wondered whatever happened to those desktop GUI web page building tools, like Frontpage and Dreamweaver and such. They may still be around, but don't seem to have any mindshare. Maybe it's because the people who were using them put up Wordpress sites instead and are building their pages in the Wordpress UI.
late2part 11y ago
and at least 1/10th of the exploits?
lohengramm 11y ago
Recently built a blog on Bolt (http://bolt.cm http://bolt.cm), just because WP seemed too ugly. I do not regret.
- velmu 11y ago
  I share your feeling. Bolt is excellent: https://www.symfony.fi/entry/bolt-is-wordpress-done-right-er https://www.symfony.fi/entry/bolt-is-wordpress-done-right-er

139 points by mustafauysal 11y ago

mamon 11y ago

That sounds scary considering the fact that Wordpress security flaws make it "remote system administration tool" first, and blog platform second.

vatotemking 11y ago
citation needed
- johansch 11y ago
  http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/ http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...
  - Karunamon 11y ago
    200 vulns in 11 years? That doesn't sound awful in perspective. I bet you use software every single day that has significantly more.
- belorn 11y ago
  The problem with wordpress security is mostly attached the insecure developer practices when dealing with themes. Many developers just take a standard theme, copies it, and then attach their own modifications. This piece of code never gets updated and the owner rarely even know that its there until they get hacked, reinstall with a updated wordpress, and then get rehacked a few days later.
  - pknight 11y ago
    Themes rarely have hackable exploits due to what they (are supposed to) do. If there's insecure code in there it's probably code with functionality that belongs in a plugin to start with. Themes that have had vulnerabilities in them tend to be the kinds of commercial themes that are filled with features and 3rd party scripts to satiate users demands. Not really a WordPress core problem, it is a market problem. Although package management is something WordPress lacks in.
evook 11y ago
That made my day. I got Anxiety Attacks reading that article and some of the comments here. A shitty codebase with a kinda useless API on top of the cockroach of databases. Et voilà, the perfect platform to make the web a little bit less stable, less performant and contributing to the increasing trend of low quality code.

mrfijal 11y ago

i kind of wonder how did we get to this point. technologically speaking it's a disaster - terrible slow and insecure language as a platform for bad practices and codr base. i guess the answer is that technical excellence.is absolutely secondary to other concerns, but it's a concerning view.

Ono-Sendai 11y ago
sounds like a case of 'worse is better': https://www.jwz.org/doc/worse-is-better.html https://www.jwz.org/doc/worse-is-better.html
mschuster91 11y ago
There may be other technical solutions that are better from a technology POV. What WP did right is to choose a platform supported EVERYWHERE (PHP, and not Ruby, Java or other crap only supported by few hosters), with a shitload of developers (again, the massive advantage of PHP), and packed the installation process in a way everyone from an 8-year old school kid to a 70-year old grandpa can handle (and literally, I have seen both!). Also add in that wordpress.com's free hosting platform... well... surpasses any other blog solution by far.
- mahouse 11y ago
  >Also add in that wordpress.com's free hosting platform... well... surpasses any other blog solution by far. Are you sure? To me, it's by far the slowest one of them all.
- PopeOfNope 11y ago
  > What WP did right is to choose a platform supported EVERYWHERE When WP was created, their options were PHP or Perl. PHP was by far the hottest thing back then, so what they actually did was use the hot tech of the day and made it work. The reason PHP is supported everywhere is for the same reason; back then it was PHP or Perl via CGI. Python was added later and was also supported EVERYWHERE.
  - 11y ago

pinkunicorn 11y ago

Is this some kind of a pipe dream? WordPress runs a quarter of the web?

jacquesm 11y ago
Unfortunately, no. https://managewp.com/14-surprising-statistics-about-wordpress-usage https://managewp.com/14-surprising-statistics-about-wordpres... (2014)
jqm 11y ago
No it's not a pipe dream. It's a pipe nightmare.

Mithaldu 11y ago

A quarter of all websites includes a LOT of tiny websites nobody visits. How many users/hits/bandwidth of the web does WP get?

ryanmac 11y ago
This. While impressive, the headline is misleading.
frik 11y ago
Google and Ask.com used to have a "Blog search" feature. Nowadays minor sites are hard to find, and many seatch results on the first page are ads (that look almost like real search results on a non-IPS screens aka low price TFT/LCD screens on consumer notebooks/PCs).
CM30 11y ago
Quite a lot, considering that some of these brands use (or used to use) WordPress: http://www.wpbeginner.com/showcase/40-most-notable-big-name-brands-that-are-using-wordpress/ http://www.wpbeginner.com/showcase/40-most-notable-big-name-... It's fairly common among large media publications.
- PopeOfNope 11y ago
  That's something that gets overlooked in these discussions of wordpress. Wordpress has the unique ability to use a single install and backend to manage hundreds of sites. If you need content cross posted across multiple sites, wordpress can do that. If you want to pull an entire column of articles from one site to another, wordpress can do that. Wordpress has spent a ton of time on multisite features and (as far as I know) there's no other CMS in existence that handles this stuff out of the box. That's why large media companies love it and, I suspect, why a quarter of the internet runs it still when there are faster and more secure alternatives out there.
  - evunveot 11y ago
    I've never used it professionally, but dotCMS is a Java- and Elasticsearch-based CMS that has very impressive multisite features [1]. From what I can tell, a lot of its capabilities stem from a design that treats absolutely everything (data, content, static assets, "themes") as a node in a virtual filesystem, or rather a filesystem-per-site, so everyday filesystem operations cover a lot of use cases. I believe you can even manipulate your site(s) via WebDAV to some extent, e.g. to develop a theme in your IDE of choice while saving directly to the site or, more realistically, saving to a private staging copy of the site that lives on the same server, which you can then copy into production from within the dotCMS admin. I gave some consideration recently to adopting dotCMS for client work to replace an in-house PHP CMS, but although Java-the-language isn't particularly intimidating and dotCMS itself looks fairly self-contained and straightforward to deploy -- Elasticsearch is embedded rather than requiring separate setup, for example -- it's still tied up in the Java ecosystem (OSGi, maven, XML configuration) so there's a lot to get used to for someone approaching it from outside that realm. [1] http://dotcms.com/#anchor1 http://dotcms.com/#anchor1

Dachande663 11y ago

WordPress is like the Kalashnikov of the web. You can use it for pretty much anything, run it anywhere, do god knows what to it and it'll still happy hum along (albeit behind a very big varnish cache). A few of our clients have millions of pageviews running off of a couple t2.small instances and the single biggest factor for them is the UI and the security of knowing they're not tied into a bespoke platform.

vonklaus 11y ago
wordpress, and a t2.micro can handle >1 million pageviews?
- brianwawok 11y ago
  with a cache sure. static content is easy to serve.
- pavs 11y ago
  nginx + varnish + cdn + pagespeed + php-apc. Most definately possible and you will still have 400+mb memory to spare on a 1gb server, avg cpu usage is at 30-40%. Done it for few clients myself.
- thekonqueror 11y ago
  My test server delivered 3.9 Million pageviews per hour with similar setup[1] http://nestify.io/benchmarks/ http://nestify.io/benchmarks/
jjoe 11y ago
We have clients running multisite with 150MM+ page views per month but on dedicated hardware and Varnish running in front of it. The latter is a must in a setup like this. You save on MRC for server rentals, which is a huge value proposition.
- robtaylor 11y ago
  what kind of costs are involved? I run a community site that does 1m pv's a month and growing but we get hammered on 'breaking news' as wp-super-cache does not seem to handle post updates well under high use thus interested in possible solutions or alternatives.

chris_wot 11y ago

I have to say, setting up blogger was just far too hard. Maybe something has changed, but back in the day I was trying to find a math renderer for http://randomtechnicalstuff.blogspot.com.au http://randomtechnicalstuff.blogspot.com.au - but couldn't find anything. I haven't bothered since, and my latest blog at http://sherlockchrisblog.wordpress.com http://sherlockchrisblog.wordpress.com is just working with LaTeX markup. It's honestly a breath of fresh air.

jgillich 11y ago
Blogger hasn't seen any development in years. I expect Google to shut it down when enough users have left.

pahael 11y ago

not surprised. I've seen my html illiterate friends make full websites using wordpress. The power of php I guess.

CM30 11y ago

It's not that surprising to be honest. WordPress' success comes down to the following: 1. It was simple to use in an era where CMS meant 'large, complicated system that was tailored towards technies rather than the general population'. It didn't have a ton of features, but it was easy to use for the average blogger wanting to write posts without worrying about all the setup and coding and what not. 2. You could pretty much install it anywhere without minimum technical skill, since PHP and MySQL was (and is) supported by about 99.99% of shared hosts. Its newer competitors tend to be written in languages that are usually only available on a VPS or dedicated server. 3. It has a very large ecosystem for themes, plugins and other such things, so someone with no technical skill could find add ons for anything they wanted without needing to call in a developer or know PHP. It's not the best written software and its not the best optimised for anything in particular, but it is one of the easiest to install and use for someone without a technical background, which is why it's so widespread.

picozeta 11y ago
I agree with your points, but always wonder why shared hosting is often PHP/MySQL only. E.g. if you are using Python, say Django or Flask, and want to outsource your devops (i.e. shared hosting) you do not have many options. Of course, there is pythonanywhere or you might want to use PAAS like Heroku, but I find it interesting non the less. Is it so much more work for shared hosting providers to provide Python?
- coliveira 11y ago
  PHP guys are very smart about not trying to reinvent the wheel. They always supported the most common web setup: Apache running on its standard configuration. That's why every shared host company in the world is confident in deploying PHP and avoids like the plague more complex solutions based on Python, Java, and Rubi.
  - pizzeys 11y ago
    I'd say it's actually the opposite - the users are comfortable with PHP and not the more complex solutions. I'd love for us to support other stuff, but anyone who is using anything else wants more control over their environment than the average shared host can offer. We have as many deployment issues etc. with PHP as we would anything else... possibly more. That said, isn't 'IaaS' like Heroku basically 'shared hosting for other stuff'?

jachob 11y ago

... And still no decoupling and no real API. Wordpress is locked down by its own mass of users and just can't evolve. Too big to fail ?

graupel 11y ago
The API is coming - https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/ https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge...
andrebalza1 11y ago
V2 Api (http://v2.wp-api.org http://v2.wp-api.org) will be merged into wordpress 4.4 core, planned for december 2015
- DrewAPicture 11y ago
  It's already been merged into trunk ;)

jachob 11y ago

... And still no decoupling and no real API. Wordpress is locked down by its own mass of users and just can't evolve. Too big to fail ?

mbrock 11y ago

The total economic activity attributable to WordPress must be staggering. How many small businesses use it? How many consultants and design firms? Even the business of creating WordPress themes must be very significant.

visakanv 11y ago
> Even the business of creating WordPress themes must be very significant. It is, lots of people make full-time livings doing it, and even have entire companies set up to do it.
- mbrock 11y ago
  Themes like Divi seem to compete directly with things like Squarespace, including custom WYSIWYG layout tools etc. http://www.elegantthemes.com/gallery/divi/ http://www.elegantthemes.com/gallery/divi/ Here's a testimonial from an independent web site creator that I found interesting. http://www.elegantthemes.com/blog/customer-spotlight/creating-my-own-web-design-business-helped-me-become-a-better-dad http://www.elegantthemes.com/blog/customer-spotlight/creatin... (I have no affiliation at all with this nor any other WordPress business, I just think it's interesting—as a counterpoint to the stereotypical HN focus on fancy new technology—how enormously productive this ecosystem really is.) > One day, as I was in the process of writing a post for inspireddad.org, I had a sudden epiphany. I thought to myself, WordPress is not like any other website builder I have used before. It is powerful, simple, and can be used for almost anything… and I can see myself making a living off of this one day. It was this thought that set me into motion, and I began learning everything I possibly could about WordPress—I became obsessed. [...] > I honestly believe I might have given up on this dream if it hadn’t been for the amazing support that the ET team gave to me early on. This support, coupled with my own growing WordPress knowledge, enabled me the opportunity to launch approximately two dozen websites in my first year—which gave me the confidence I needed to take my business to the next level. [...] > The incredible support and products of [Elegant Themes] have enabled me the chance to do what I love—achieving an entrepreneurial lifestyle that has allowed me to truly help my clients, while also giving my family my time and attention as a husband and father. I'm half tempted to abandon my current plans of startup world domination and just make WordPress websites for local businesses.

netaustin 11y ago

I agree entirely with the premise that WordPress is not the most impressive codebase in the world — but that's not why people select it. The reason that sites opt to use WordPress is that the editorial interface is familiar and the plugin ecosystem is very robust. The reason that sites stay on WordPress is that upgrades arrive for free every couple of months and do not break backwards compatibility. WordPress's performance has improved over the years largely as a result of the rising tide of CPU and RAM upgrades and improvements to PHP and MySQL themselves — and more recently through integrations with Elasticsearch, which WordPress works particularly well with. It's also possible to use WordPress as a framework and to develop elegant code using its APIs, which is largely what my firm does (I run one of the handful of agencies that partner with Automattic to provide WordPress consulting to big companies). But that's the exception, not the rule, and most of the prospective developers we interview who have WordPress experience can't use it the way we want.

audessuscest 11y ago
> the plugin ecosystem is very robust It's not true, a lot of WP plugins are buggy and sometimes conflict each other. > upgrades arrive for free every couple of months and do not break backwards compatibility But sometimes plugins break with upgrades
- stevesearer 11y ago
  Paid plugins (with support) are the way to go for getting the highest quality and I've had great experiences with them. Some of the ones I've had great luck with on my site are Advanced Custom Fields, Gravity Forms, and most recently FacetWP. Edit: that said, there are also high quality free ones as well

kmfrk 11y ago

One wonders what the world would look like if Google hadn't dropped the ball on Blogger.

josephagoss 11y ago
Can you self host Blogger and download the code?
mark_l_watson 11y ago
Just curious: what do you about dropping the ball? I just showed my 94 year old Dad how to use Blogger and he really likes it.
petercooper 11y ago
Possibly more like Medium given how instrumental Ev has been in each.

sopooneo 11y ago

Any consultants on here that have to deliver/maintain WordPress sites? If so, mind sharing what your basic workflow is? There are many articles on the web, but they are mostly for very entry level users. The fundamental problem my company runs into with WP is that only a theme can be meaningfully checked into version control. Everything else, including installation of plugins is coupled with entries in the database. And of course the database also includes changes necessarily made on the production instance, like comments to blog posts. Any thoughts or links to posts on this greatly appreciated.

jsalinas 11y ago
There is http://versionpress.net/ http://versionpress.net/ but it's still on early access.
raverbashing 11y ago
You can probably split (by table) bootstrap information (config) from CMS information (posts/comments) A plugin will usually set some entries on installation (then add its work data as well) But yeah, I believe there's an interesting void of supporting tools for WP (it needs to be DevOps'd)
rdrake 11y ago
I've been meaning to try out Revisr [0]. [0] https://github.com/ExpandedFronts/revisr https://github.com/ExpandedFronts/revisr
neurostimulant 11y ago
If you prefer git-based deployment for your wordpress project, bedrock is probably for you: https://roots.io/bedrock/ https://roots.io/bedrock/ Also, wp-cli helps a lot in streamlining the project (enabling/disabling plugins, updating site settings, etc, all from command line or deployment script scripts)
PopeOfNope 11y ago
I worked briefly for a wordpress consultancy last year. Our main workflow involved using Yeoman, Grunt, NPM, wp (the wordpress command line tool) and vagrant. Locally, we'd run vagrant just so we don't have to monkey around with environment issues (too much). Yeoman, grunt, npm and wp were used in tandem to script the creation of a new wordpress install, install any dependencies needed, run any tools needed through grunt (like sass and JS minifiers), and pull plugins and themes from their separate git repositories. We still had to import the database by hand, though, when setting up our environment as well as add lines to wp-config for however we wanted to handle debugging. Then we'd write code and check it in via git as with any other project. If you were working on frontend anything (html,css,js) you either ran grunt all the damned time or ran grunt watch. Those of us who had a hard time with the unique programming requirements of wordpress (escaping, sanitizing, formatting) used phpcs to automate that. As for deployment, we'd just go through the same setup on the server that we do locally. Updates were pushed via git. The fundamental problem my company runs into with WP is that only a theme can be meaningfully checked into version control. Everything else, including installation of plugins is coupled with entries in the database. That wasn't my experience. We separated functional features into separate plugins (so they could be disabled or enabled on a site by site basis) and had no problem using version control with them. In fact, one project had some government security problems and required each plugin to be in its own repo. I wouldn't suggest that, but it works. the database also includes changes necessarily made on the production instance, like comments to blog posts That was something I found aggravating that was never really addressed at the company I worked at. When new people were brought on to a project, they'd get a mysql dump of the staging environment. After that, as new features were added, you were responsible for adding your own test data to see if those features worked. As for production, the changes made that were specific to the production database were made manually in production. When a new plugin was pushed, you had to log into the production instances manually and turn the new plugin on. Luckily, there are hooks you can use to automate any setup or teardown of plugins when they get turned on and off respectively.

mtgx 11y ago

Can we get a Wordpress alternative written in Go, though?

MaxKK 11y ago
Why? (Serious)
relaxitup 11y ago
Journey? Might be more like a Ghost alternative, but in the ballpark. https://kabukky.github.io/journey/ https://kabukky.github.io/journey/
deleted 11y ago
[deleted]

nogridbag 11y ago

I recently looked at Hugo[1] as a WP alternative and have been very impressed. It's a static website generator written in Go and features its own server with live-reload so you can see changes to your content instantly in the browser. I was looking for something that a non-techie might be able to maintain and since Hugo offers prebuilt binaries the only requirements for the maintainer is to drop hugo.exe into the working directory and type a few commands. In the end though, it's still a bit more complicated for non-techies than maintaining a website created via WordPress. [1] https://gohugo.io https://gohugo.io

PopeOfNope 11y ago
Considering some of the people I've made wordpress sites for couldn't even figure out the wordpress interface, command line anything is a no go for a large percentage of wordpress's intended audience.
- soared 11y ago
  Hell, FTP is a no go for most of wordpress's audience.
- e12e 11y ago
  Yeah, I'm sure it'd be possible to build on top of Hugo (or many other static site generators) to build something that might be usable for the typical wp customer - but afaik none of them are that out of the box. The most likely alternative I can think of is Ghost: https://ghost.org/ https://ghost.org/ But, I'm not sure how easy it is to customize along the lines that people expect from wp (Now, that could be considered a feature - but it also means it could be a hard sell to someone that just wants a wp site). If what is needed really is a static site (a "web site"/"homepage") -- I think netlifly looks quite promising: https://www.netlify.com/ https://www.netlify.com/
- nogridbag 11y ago
  Actually the command line interface wasn't the deal breaker for me. I was asked to help out creating a website for a tiny organization (< 10 people). Once I found out multiple people would need to collaborate and edit the website it basically eliminated Hugo as a possibility. I suppose they could sync files via Dropbox but as I'm not a dropbox user myself I have no idea how it handles merges. Git is not really a possibility for obvious reasons. Finally, deployment is the final hurdle. If they wanted to edit a sentence on a WordPress site it's very easy. But with something like Hugo it would be a 3 step process: Edit the file. Build the website. Deploy to your web host.

jjuhl 11y ago

Putting all eggs in one basket is scary. Putting all eggs in a PHP powered basket is terrifying beyond words. We're doomed :-(

rmdoss 11y ago

And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought a lot of non-technical people to use it and develop for it. So you get a lot of bad written themes and plugins that lead to all sort of security issues. On the other hand, Drupal and Joomla, all had SQL injections on their core discovered lately: https://www.drupal.org/SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 https://blog.sucuri.net/2015/10/joomla-3-4-5-released-fixing-a-serious-sql-injection-vulnerability.html https://blog.sucuri.net/2015/10/joomla-3-4-5-released-fixing...

jqm 11y ago
But it does get an inordinate amount of attention from people looking to crack it. At least according to my server logs. So sure... if everything is locked down and up to date and no shaky plugins installed no problem. On the other hand, one careless slip up...
- pavs 11y ago
  > On the other hand, one careless slip up... And how is it not the same for any other server side software? Most of the WP security issue is related to user not knowing what they are doing or third party plugin/theme. Wordpress vanialla itself is not anymore insecure than other popular CMS or simialar software out there. From my own personal experince from doing at least 70-80 WP installs in different configurations and have never experienced any security issues in over 10 years. Thats doesnt mean its the norm. Its just that if you are going to play with a highly customizable and powerful piece of server side software and if you dont know what you are doing then you are going to screw shit up.
  - jqm 11y ago
    Other server side software doesn't get nearly the same number of attacks. At least according to my server logs. Plus, other server side software doesn't let button clickers get into trouble as easily.
jonesb6 11y ago

teleclimber 11y ago

Matt Mullenweg's post on this is interesting [1]. "The big opportunity is still the 57% of websites that don’t use any identifiable CMS yet, and that’s where I think there is still a ton of growth for us (and I’m also rooting for all the other open source CMSes)." I wonder what currently runs the remaining 57%. [1] http://ma.tt/2015/11/seventy-five-to-go/ http://ma.tt/2015/11/seventy-five-to-go/

caseysoftware 11y ago
Raw [programming language of choice] or custom CMS that someone's nephew hacked together and they don't care enough or have the time/money to replace. In 2005-2008, I made good money switching people from those systems to Drupal with the simple pitch of plugging into a larger community and being able to shop around for modules and developers who wouldn't have to learn a new codebase.

rebootthesystem 11y ago

I must admit ignorance here. I've installed WP a couple of times but never went live with it or did anything past poking around. Here's my hangup: I can't understand why one would start with a blogging platform, pound at it with various plugins and transform it into, say, a product/ecommerce website. It feels like starting with a shovel when you need a pick (or some other more applicable analogy). That's the part I don't quite understand. Carrying all of that baggage to build something diametrically opposite what the original stated function of the software may have been. On the funny end of the scale, I've seen five page static websites with a landing page, a few info pages and a form done with WP. Unbelievable. Are developers that lazy today that they throw WP at everything? Or is it easier at that level to charge X to do a WP site rather than charging the same for straight-up PHP/HTML/JS?

SHIT_TALKER 11y ago
On the funny end of the scale, I've seen five page static websites with a landing page, a few info pages and a form done with WP. Unbelievable. Are developers that lazy today that they throw WP at everything? Or is it easier at that level to charge X to do a WP site rather than charging the same for straight-up PHP/HTML/JS? When the client says they want to be able to update site content themselves.... okay, here's your five page WordPress site with a single form.
- rebootthesystem 11y ago
  Yeah, that's probably the scenario with the least friction.
ufmace 11y ago
I haven't used Wordpress much, but I am working on an Orchard site at my current job. It's a CMS kinda like Wordpress, but built on C#/ASP.NET. Our dev team is mostly working on a dozen or so custom-coded account management pages in a separate module, but most of the content is marketing material as pages built in the Orchard management screens, kind of like blog posts, but arranged like a conventional website. The developers aren't terribly enthusiastic about working with those Orchard pages, since they're tough to collaborate on and version control. But the Marketing people seem to like it just fine, probably because conventional web site building tools, like writing HTML and CSS and managing folders of content with source control tools, is too complex and error-prone for them, and the site UI is worlds better than any other technique they might be willing to use. I'm guessing Wordpress works in a similar way. Now that I think about it, I had always idly wondered whatever happened to those desktop GUI web page building tools, like Frontpage and Dreamweaver and such. They may still be around, but don't seem to have any mindshare. Maybe it's because the people who were using them put up Wordpress sites instead and are building their pages in the Wordpress UI.

late2part 11y ago

and at least 1/10th of the exploits?

lohengramm 11y ago

Recently built a blog on Bolt (http://bolt.cm http://bolt.cm), just because WP seemed too ugly. I do not regret.

velmu 11y ago
I share your feeling. Bolt is excellent: https://www.symfony.fi/entry/bolt-is-wordpress-done-right-er https://www.symfony.fi/entry/bolt-is-wordpress-done-right-er