13 ms·

So, a reasonable question to ask is what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like

So, a reasonable question to ask is what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like I'm setting them up to get owned? Also what advice should I give to WordPress users to help them improve security, other than the rather useless and bratty "don't use wordpress lol" answer? I'm a security professional and I follow the constant stream of "lol WordPress exploit" articles, but proactive security measures for WordPress are a bit outside my usual enterprise infrastructure work.

SwellJoe 10y ago
I still, currently, recommend WordPress, despite its flaws. I don't recommend doing ecommerce (directly) with it, or anything that could gather sensitive information, but for "just a website" with a bunch of cool stuff, WordPress is pretty much impossible to beat for the sheer amount of "cool stuff" you can do without ever writing code. The plugin ecosystem is tremendous. The automated updates, so far, mostly stay ahead of the curve on exploits in the wild. We have a large pool of users to draw information from (thousands of servers running all manner of web apps), and we're far more likely to see exploits of systems that are harder to update; Drupal, Joomla, and especially a bunch of little apps that have tiny market share and small maintenance teams and cranky update processes. Having an easy and automated system for updates is just incredibly valuable for security. What really needs to happen is everyone making web applications needs to start shipping a command line client for updates, that is safe/reliable enough to be run from cron. Best of both worlds: you don't need the app files to be write-able from the app itself (which is one of the big security concerns raised by this post) and you're always running the latest version even on systems that aren't being worked on daily. There's still the command line element to the problem, but it could be mostly automated away by control panels and installer tools (of which there are many). There are a lot of forgotten CMS installations out there, and those are the biggest security problem, IMHO.
- busterarm 10y ago
  > I don't recommend doing ecommerce (directly) with it, or anything that could gather sensitive information, but for "just a website" with a bunch of cool stuff, WordPress is pretty much impossible to beat for the sheer amount of "cool stuff" you can do without ever writing code. Yes, basically don't store anything like this in the WordPress database. There are tons of services you can use, like Hubspot for forms, that allow you to abstract all of these things away from your site and still use WordPress.
- throwaway-hn123 10y ago
  WordPress now has a pretty good command line tool: wp-cli [1] You can run `wp-cli core update` to update the core WP files. It can also update plugins. [1] http://wp-cli.org/ http://wp-cli.org/
  - ChristianBundy 10y ago
    Unfortunately this doesn't solve the problem that WordPress needs to be able to write to itself. It's game over once every skid in the world can pop a web shell in /var/www.
- markdown 10y ago
  When did you last use Joomla? 2016 Joomla is as easy as WP to update, and easier than WP to install.
  - SwellJoe 10y ago
    Several years ago. We briefly used it for our company website, in between OpenACS and Drupal 6. But, it was short-lived, maybe a year, as it was just incredibly difficult to maintain and enhance and the various bridged in applications led to a really inconsistent user experience (multiple notifications configurations, etc.). I've heard from customers that it has improved, but I haven't had reason to look at it lately. But, I'm glad to hear they've improved the update experience; though I can't imagine how it could be easier than WordPress, since WP will update automatically with no user intervention, if you let it. Easy and reliable updates are perhaps the single biggest security feature, if the team behind the project is pro-active about security bugs.
- ausjke 10y ago
  I believe you can do pretty much everything from command line for Drupal with drush
- onetwotree 10y ago
  > I don't recommend doing ecommerce...or anything that could gather sensitive information The problem with this kind of thinking is that if I can get remote code execution, or even just content control over your no-ecommerce-or-sensitive-information blog, I can have a great time. Sure, it's not as valuable as CC info, but the potential for malware distribution, credential phishing (password reuse for the win!), various kinds of social engineering, or even just as an anonymizing host to hide illegal activity, is still huge.
mordocai 10y ago
wordpress.com. They deal with the security updates so you don't have to, and they have support for ssl now.
- onetwotree 10y ago
  How does wordpress.com deal with plugins? Do they have managed/curated distribution systems? The more I learn about this, the more I feel like core wordpress is reasonably sound, and the problems mostly arise from plugins.
  - brianmurphy 10y ago
    Wordpress.com doesn't allow 3rd party plugins. That is one of the primary differences between it and the self-hosted version.
seanwilson 10y ago
> So, a reasonable question to ask is what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like I'm setting them up to get owned? Get them to use a hosted WordPress solution. So many times I see people hire someone to set up a VPS with a customised version of WordPress and then think it'll just run itself and stay secure.
- simbalion 10y ago
  or pay for a managed solution. There are affordable options. Most unmanaged "hosted wordpress" packages are shared hosting, which is junk for a serious business website.
falcolas 10y ago
> what advice should I give to WordPress users to help them improve security It requires a bit of knowledge and a commitment to managing the deploy, but: disable write permissions for the web user to the WordPress directory (excluding the upload folder), whitelist endpoints in nginx/apache, set up IP whitelists for /wp-admin/, minimize plugin usage. This is going to reduce the user-friendliness of the WordPress install, but it's going to immediately increase the security by leaps and bounds. If you can't exploit plugins, can't access the admin pages, can't modify PHP files, and can't hit exotic endpoints, it's much harder to compromise WordPress.
- busterarm 10y ago
  Or just let WordPress users just be users. Abstract the management of WordPress away from the CMS. Have their access be just the content and limited/filtered by role. The built-in roles need virtually no tweaking. We have our WordPress sites as git repositories and build via CircleCI, Ansible and Composer. For Multisite instances we use Composer and Satis and keep the themes in their own repositories and use tagged releases to manage our multisite build using CircleCI and Ansible again. We use two-factor auth for Wordpress login (currently Duo on non-multisite installs). Nobody gets to install plugins. Nobody writes files into folders manually. Minimal plugin usage is a solid recommendation.
  - bn-usd-mistake 10y ago
    How do you handle the database in your git Repositories? I'm asking because I never found a good solution for Version control of Systems like Joomla and WordPress. Optimally I'd like to be able to install and Setup a plugin on my Dev machine, then push that to production, as I would do with, for example a Rails App.
    - busterarm 10y ago
      We only version the wp-content folder. We have automated db backups that we retain in multiple locations on a schedule. Our hosts let us duplicate the db various ways between staging/prod and we just do a copy and search+replace for local development. We used to use WP DB Migrate Pro for that last part but it is buggy to the point of nonfunctional now. So yes, you do have to do plugin setup/site configuration on dev, staging and prod. I don't see a good workaround for that, but the duplication of work leading up to production has allowed us to catch problems before hitting production.
Kluny 10y ago
I've been telling people to host wordpress sites on Dreamhost's Dreampress. They handle core updates for you and they'll help you out if it all goes wrong. I'd also say use Shopify you're doing eCommerce. It's a pretty excellent platform, and you've got this whole army of developers devoted to reducing the security issues of Wordpress while making sure that sales keep going through.
dempseye 10y ago
A cloud platform like Squarespace or a managed service like wpengine.
sciurus 10y ago
> what can I recommend to non-technical people when they need a website quickly and inexpensively A SaaS website builder and host like Squarespace, Wix, or Weebly.
- simbalion 10y ago
  Wix is a terrible answer, their business model is built around ripping off the ignorant, as far as I can tell. For example they'll charge you $150 for a domain name, and their service offers no method of exporting your website when you eventually decide to get a real host. I can't speak to the quality of Weebly or Squarespace but I'd never use them, the cost is a few bucks more per month than a Wordpress site and I don't see how their services add any value for that extra cost.
DanieleProcida 10y ago
I'd be extremely interested from a wholly self-interested point of view to know what you think of http://demo.django-cms.org/ http://demo.django-cms.org/ (for an out-of-the-box demo of django CMS), and whether you'd find that as quick to get to grips with as WordPress). Or if you would like to compare it with actually working on the site as a developer rather than just as a content editor, then it would be https://www.django-cms.org/en/blog/2016/02/16/build-a-website-without-knowing-python-django-part-one/ https://www.django-cms.org/en/blog/2016/02/16/build-a-websit.... What further improvements would take it right up to, or even past, WordPress levels of ease-of-use, in your opinion?
- callahad 10y ago
  I just spent 8 minutes, and I still haven't figured out how to edit the text of a blog article on the demo site, or create a new post with any body content. All I see is a form for editing article metadata and lead, no matter how I try to get at it. 1. Blog -> Article List -> (Title) doesn't do it. 2. Blog -> Edit this article doesn't do it. 3. Double clicking on article text only lets me edit single paragraphs at a time. It doesn't seem to let me add or re-order paragraphs either. 4. Blog -> Article List -> Add Article doesn't let me create a post with body content. 5. Same with Blog -> Add New Article.
  - DanieleProcida 10y ago
    The Help section in the sidebar with mini video introductions explains that. See step 6 (using the Content Wizard to create a new weblog article for example, including body content) or step 7 (which explains how to switch to structure mode, another way to add and/or rearrange body content). Existing body content can be edited simply by double-clicking on it while in edit mode. The question is whether this is just a case of understanding the basics of a different paradigm, or something that could be made more intuitive. Thanks for the feedback, and thanks for taking the trouble to look at it.
    - voltagex_ 10y ago
      >The Help section in the sidebar with mini video introductions explains that. Are there text-based alternatives to your video?
dorian-graph 10y ago
My goto is https://www.squarespace.com/ https://www.squarespace.com/.
simbalion 10y ago
Wordpress. It's the cheapest, most capable, most user-friendly CMS available. It has the largest community, which means it has the best support and greatest plugin availability. There's nothing wrong with running E-Commerce on Wordpress also, as long as your payment solution does not include storing sensitive data such as credit card numbers in the database. "How do I improve security" is a question too in-depth for a forum comment. You need to spend some time researching that using your favorite web search, in my humble opinion. Just keep in mind there is not one cure-all solution.
- ausjke 10y ago
  In fact I think 30% of the eCommerce sites are run on wordpress nowadays.
- onetwotree 10y ago
  > There's nothing wrong with running E-Commerce on Wordpress also, as long as your payment solution does not include storing sensitive data such as credit card numbers in the database. This is just not true. Suppose I get write access to the content your Wordpress site is serving. Now I can replace, say, the Stripe (or any other managed payment solution) JS and HTML with my own, to save the CC info and forward the unmodified request to Stripe. Game over.
manyxcxi 10y ago
I recommend to people that Wordpress would be a good fit for to have it hosted on Wordpress.com. You get the ease and familiarity of Wordpress with less pwnage. It's free, but $6/mo gets you the use of your own domain and no ads. I find it's a pretty good trade off if you don't need a heavily customized site.
deleted 10y ago
[deleted]
Tehnix 10y ago
I'd recommend SquareSpace for simple sites and Shopify for eCommerce sites. I think my own recommendation progression has been something like (starting from my early programming days till now): - My own homebuilt CMS - A standard CMS like WordPress etc - A SaaS solution like SquareSpace or Shopify I really feel like the managed solutions are just that more convenient in the long term, also for the clients own sake.
- ben_jones 10y ago
  And they're only going to get better. Ten years ago a funded company might have done much better rolling their own CMS, but nowadays I agree whole-heartedly that managed solutions are the way to go and I believe ten years from now this conversation will be even shorter.
- blahi 10y ago
  Your requirements must be very trivial if Squarespace or Shopify fulfills them.
  - manigandham 10y ago
    The OP started asking about simple sites for non-technical people. Squarespace and Shopify are perfect for this, especially judging by their success.
    - blahi 10y ago
      Yeah, you are right. I forgot what the original question was. My bad.
  - brianwawok 10y ago
    Shopify has an apps hook to call out json web hooks to your own servers. It can do a lot but maybe at that point why use shopify :)
- busterarm 10y ago
  Have you actually ever thrown up a SquareSpace site? I think even GeoCities WYSIWYG editor was more friendly (and capable). SquareSpace maybe fine if you're limiting what you're trying to do to _exactly_ what's in the template, but figuring out how to work their system otherwise is hours of maddening, (poorly or) undocumented hell. I threw up http://www.pateshop.nyc/ http://www.pateshop.nyc/ for some friends and it took a full day. It would have been faster if I'd just wrote the site myself. It's not even that great -- to get the nav/ux requested I had to compromise a lot to what SquareSpace could deliver. I don't think someone unfamiliar with HTML and CSS would have been successful.
e12e 10y ago
Good question. I recently had a brief look at a site a friend hosts with wordpress.com - and after that my "old" recommendation of going with a standard wordpress.com-hosted wordpress without extra plugins is pretty much out: it looks like with their move to a javscript/api/spa-based admin they've managed to alienate quite a bit of the theme-developers and/or left them behind -- so now there are two admin-pages (the javascript spa and wp-admin.php) -- and neither work perfectly for legacy installations... I was already a bit sceptical of wordpress.com hosting due to the limitation on custom themes, and the hurdles needed to hop through to make a new theme that can be used with a wordpress.com hosted site... All that said, plain wordpress along with a modern php-version and the wordpress-cli still looks like it's an option. The major caveat is that as soon as you get a "wordpress hacker" to "enhance" the site - security appears to go out the window (feels like a third of the traffic on the full-disclosure list is still wordpress plugins. Rarely wordpress core, though). With that dismal news out of the way, ghost.org + ghost.io hosting does look quite reasonable for a blog (basically what you get with "plain wordpress" anyway). It looks rather unsuited for anything that's not just a blog, including a full image gallery (there are plugin/themes, but ghost is explicitly not a content management system, and doesn't really have any real media management to manage uploaded images in galleries etc. Perhaps ghost.io + something like 500px.com is a possible fix). Other than that, I have a good impression of netlifly -- but being focused on static sites, it might be a though sell for someone that would really just want "a simple wordpress that works and looks beautiful". I'm not sure, I've only toyed a bit with it, and enjoyed their various excellent "using netlifly with X" blogpost (a really shining example of corporate marketing if you ask me - I don't think any other startup/kickstarter/company mailings manage to reach near the nice quality that netlifly seem to reach effortlessly (a typical indication that a lot of effort is put in, btw :-). https://www.netlify.com/ https://www.netlify.com/ See eg: https://www.netlify.com/blog/2016/02/24/a-step-by-step-guide-gatsby-on-netlify https://www.netlify.com/blog/2016/02/24/a-step-by-step-guide... https://www.netlify.com/blog/2015/11/02/a-step-by-step-guide-hosting-expose-on-netlify https://www.netlify.com/blog/2015/11/02/a-step-by-step-guide... https://www.netlify.com/blog/2015/10/06/a-step-by-step-guide-hugo-on-netlify https://www.netlify.com/blog/2015/10/06/a-step-by-step-guide... https://www.netlify.com/blog/2015/10/15/a-step-by-step-guide-pelican-on-netlify https://www.netlify.com/blog/2015/10/15/a-step-by-step-guide... (They're all mostly the same, and don't go into much depth, but probably gives a fair idea of what Netlifly is and is not). [ed: Another option might be to get an account with Sandstorm, and host either Ghost or Wordpress along with (maybe) some kind of gallery - or just some form of wiki: https://oasis.sandstorm.io/ https://oasis.sandstorm.io/ ]
vellum 10y ago
If they just need a blog, I'd recommend using tumblr and a custom domain name.
rahimnathwani 10y ago
"what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like I'm setting them up to get owned" https://www.strikingly.com/ https://www.strikingly.com/

SwellJoe 10y ago

I still, currently, recommend WordPress, despite its flaws. I don't recommend doing ecommerce (directly) with it, or anything that could gather sensitive information, but for "just a website" with a bunch of cool stuff, WordPress is pretty much impossible to beat for the sheer amount of "cool stuff" you can do without ever writing code. The plugin ecosystem is tremendous. The automated updates, so far, mostly stay ahead of the curve on exploits in the wild. We have a large pool of users to draw information from (thousands of servers running all manner of web apps), and we're far more likely to see exploits of systems that are harder to update; Drupal, Joomla, and especially a bunch of little apps that have tiny market share and small maintenance teams and cranky update processes. Having an easy and automated system for updates is just incredibly valuable for security. What really needs to happen is everyone making web applications needs to start shipping a command line client for updates, that is safe/reliable enough to be run from cron. Best of both worlds: you don't need the app files to be write-able from the app itself (which is one of the big security concerns raised by this post) and you're always running the latest version even on systems that aren't being worked on daily. There's still the command line element to the problem, but it could be mostly automated away by control panels and installer tools (of which there are many). There are a lot of forgotten CMS installations out there, and those are the biggest security problem, IMHO.

busterarm 10y ago
> I don't recommend doing ecommerce (directly) with it, or anything that could gather sensitive information, but for "just a website" with a bunch of cool stuff, WordPress is pretty much impossible to beat for the sheer amount of "cool stuff" you can do without ever writing code. Yes, basically don't store anything like this in the WordPress database. There are tons of services you can use, like Hubspot for forms, that allow you to abstract all of these things away from your site and still use WordPress.
throwaway-hn123 10y ago
WordPress now has a pretty good command line tool: wp-cli [1] You can run `wp-cli core update` to update the core WP files. It can also update plugins. [1] http://wp-cli.org/ http://wp-cli.org/
- ChristianBundy 10y ago
  Unfortunately this doesn't solve the problem that WordPress needs to be able to write to itself. It's game over once every skid in the world can pop a web shell in /var/www.
markdown 10y ago
When did you last use Joomla? 2016 Joomla is as easy as WP to update, and easier than WP to install.
- SwellJoe 10y ago
  Several years ago. We briefly used it for our company website, in between OpenACS and Drupal 6. But, it was short-lived, maybe a year, as it was just incredibly difficult to maintain and enhance and the various bridged in applications led to a really inconsistent user experience (multiple notifications configurations, etc.). I've heard from customers that it has improved, but I haven't had reason to look at it lately. But, I'm glad to hear they've improved the update experience; though I can't imagine how it could be easier than WordPress, since WP will update automatically with no user intervention, if you let it. Easy and reliable updates are perhaps the single biggest security feature, if the team behind the project is pro-active about security bugs.
ausjke 10y ago
I believe you can do pretty much everything from command line for Drupal with drush
onetwotree 10y ago
> I don't recommend doing ecommerce...or anything that could gather sensitive information The problem with this kind of thinking is that if I can get remote code execution, or even just content control over your no-ecommerce-or-sensitive-information blog, I can have a great time. Sure, it's not as valuable as CC info, but the potential for malware distribution, credential phishing (password reuse for the win!), various kinds of social engineering, or even just as an anonymizing host to hide illegal activity, is still huge.

mordocai 10y ago

wordpress.com. They deal with the security updates so you don't have to, and they have support for ssl now.

onetwotree 10y ago
How does wordpress.com deal with plugins? Do they have managed/curated distribution systems? The more I learn about this, the more I feel like core wordpress is reasonably sound, and the problems mostly arise from plugins.
- brianmurphy 10y ago
  Wordpress.com doesn't allow 3rd party plugins. That is one of the primary differences between it and the self-hosted version.

seanwilson 10y ago

> So, a reasonable question to ask is what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like I'm setting them up to get owned? Get them to use a hosted WordPress solution. So many times I see people hire someone to set up a VPS with a customised version of WordPress and then think it'll just run itself and stay secure.

simbalion 10y ago
or pay for a managed solution. There are affordable options. Most unmanaged "hosted wordpress" packages are shared hosting, which is junk for a serious business website.

falcolas 10y ago

> what advice should I give to WordPress users to help them improve security It requires a bit of knowledge and a commitment to managing the deploy, but: disable write permissions for the web user to the WordPress directory (excluding the upload folder), whitelist endpoints in nginx/apache, set up IP whitelists for /wp-admin/, minimize plugin usage. This is going to reduce the user-friendliness of the WordPress install, but it's going to immediately increase the security by leaps and bounds. If you can't exploit plugins, can't access the admin pages, can't modify PHP files, and can't hit exotic endpoints, it's much harder to compromise WordPress.

busterarm 10y ago
Or just let WordPress users just be users. Abstract the management of WordPress away from the CMS. Have their access be just the content and limited/filtered by role. The built-in roles need virtually no tweaking. We have our WordPress sites as git repositories and build via CircleCI, Ansible and Composer. For Multisite instances we use Composer and Satis and keep the themes in their own repositories and use tagged releases to manage our multisite build using CircleCI and Ansible again. We use two-factor auth for Wordpress login (currently Duo on non-multisite installs). Nobody gets to install plugins. Nobody writes files into folders manually. Minimal plugin usage is a solid recommendation.
- bn-usd-mistake 10y ago
  How do you handle the database in your git Repositories? I'm asking because I never found a good solution for Version control of Systems like Joomla and WordPress. Optimally I'd like to be able to install and Setup a plugin on my Dev machine, then push that to production, as I would do with, for example a Rails App.
  - busterarm 10y ago
    We only version the wp-content folder. We have automated db backups that we retain in multiple locations on a schedule. Our hosts let us duplicate the db various ways between staging/prod and we just do a copy and search+replace for local development. We used to use WP DB Migrate Pro for that last part but it is buggy to the point of nonfunctional now. So yes, you do have to do plugin setup/site configuration on dev, staging and prod. I don't see a good workaround for that, but the duplication of work leading up to production has allowed us to catch problems before hitting production.

Kluny 10y ago

I've been telling people to host wordpress sites on Dreamhost's Dreampress. They handle core updates for you and they'll help you out if it all goes wrong. I'd also say use Shopify you're doing eCommerce. It's a pretty excellent platform, and you've got this whole army of developers devoted to reducing the security issues of Wordpress while making sure that sales keep going through.

dempseye 10y ago

A cloud platform like Squarespace or a managed service like wpengine.

sciurus 10y ago

> what can I recommend to non-technical people when they need a website quickly and inexpensively A SaaS website builder and host like Squarespace, Wix, or Weebly.

simbalion 10y ago
Wix is a terrible answer, their business model is built around ripping off the ignorant, as far as I can tell. For example they'll charge you $150 for a domain name, and their service offers no method of exporting your website when you eventually decide to get a real host. I can't speak to the quality of Weebly or Squarespace but I'd never use them, the cost is a few bucks more per month than a Wordpress site and I don't see how their services add any value for that extra cost.

DanieleProcida 10y ago

I'd be extremely interested from a wholly self-interested point of view to know what you think of http://demo.django-cms.org/ http://demo.django-cms.org/ (for an out-of-the-box demo of django CMS), and whether you'd find that as quick to get to grips with as WordPress). Or if you would like to compare it with actually working on the site as a developer rather than just as a content editor, then it would be https://www.django-cms.org/en/blog/2016/02/16/build-a-website-without-knowing-python-django-part-one/ https://www.django-cms.org/en/blog/2016/02/16/build-a-websit.... What further improvements would take it right up to, or even past, WordPress levels of ease-of-use, in your opinion?

callahad 10y ago
I just spent 8 minutes, and I still haven't figured out how to edit the text of a blog article on the demo site, or create a new post with any body content. All I see is a form for editing article metadata and lead, no matter how I try to get at it. 1. Blog -> Article List -> (Title) doesn't do it. 2. Blog -> Edit this article doesn't do it. 3. Double clicking on article text only lets me edit single paragraphs at a time. It doesn't seem to let me add or re-order paragraphs either. 4. Blog -> Article List -> Add Article doesn't let me create a post with body content. 5. Same with Blog -> Add New Article.
- DanieleProcida 10y ago
  The Help section in the sidebar with mini video introductions explains that. See step 6 (using the Content Wizard to create a new weblog article for example, including body content) or step 7 (which explains how to switch to structure mode, another way to add and/or rearrange body content). Existing body content can be edited simply by double-clicking on it while in edit mode. The question is whether this is just a case of understanding the basics of a different paradigm, or something that could be made more intuitive. Thanks for the feedback, and thanks for taking the trouble to look at it.
  - voltagex_ 10y ago
    >The Help section in the sidebar with mini video introductions explains that. Are there text-based alternatives to your video?

dorian-graph 10y ago

My goto is https://www.squarespace.com/ https://www.squarespace.com/.

simbalion 10y ago

Wordpress. It's the cheapest, most capable, most user-friendly CMS available. It has the largest community, which means it has the best support and greatest plugin availability. There's nothing wrong with running E-Commerce on Wordpress also, as long as your payment solution does not include storing sensitive data such as credit card numbers in the database. "How do I improve security" is a question too in-depth for a forum comment. You need to spend some time researching that using your favorite web search, in my humble opinion. Just keep in mind there is not one cure-all solution.

ausjke 10y ago
In fact I think 30% of the eCommerce sites are run on wordpress nowadays.
onetwotree 10y ago
> There's nothing wrong with running E-Commerce on Wordpress also, as long as your payment solution does not include storing sensitive data such as credit card numbers in the database. This is just not true. Suppose I get write access to the content your Wordpress site is serving. Now I can replace, say, the Stripe (or any other managed payment solution) JS and HTML with my own, to save the CC info and forward the unmodified request to Stripe. Game over.

manyxcxi 10y ago

I recommend to people that Wordpress would be a good fit for to have it hosted on Wordpress.com. You get the ease and familiarity of Wordpress with less pwnage. It's free, but $6/mo gets you the use of your own domain and no ads. I find it's a pretty good trade off if you don't need a heavily customized site.

deleted 10y ago

[deleted]

Tehnix 10y ago

I'd recommend SquareSpace for simple sites and Shopify for eCommerce sites. I think my own recommendation progression has been something like (starting from my early programming days till now): - My own homebuilt CMS - A standard CMS like WordPress etc - A SaaS solution like SquareSpace or Shopify I really feel like the managed solutions are just that more convenient in the long term, also for the clients own sake.

ben_jones 10y ago
And they're only going to get better. Ten years ago a funded company might have done much better rolling their own CMS, but nowadays I agree whole-heartedly that managed solutions are the way to go and I believe ten years from now this conversation will be even shorter.
blahi 10y ago
Your requirements must be very trivial if Squarespace or Shopify fulfills them.
- manigandham 10y ago
  The OP started asking about simple sites for non-technical people. Squarespace and Shopify are perfect for this, especially judging by their success.
  - blahi 10y ago
    Yeah, you are right. I forgot what the original question was. My bad.
- brianwawok 10y ago
  Shopify has an apps hook to call out json web hooks to your own servers. It can do a lot but maybe at that point why use shopify :)
busterarm 10y ago
Have you actually ever thrown up a SquareSpace site? I think even GeoCities WYSIWYG editor was more friendly (and capable). SquareSpace maybe fine if you're limiting what you're trying to do to _exactly_ what's in the template, but figuring out how to work their system otherwise is hours of maddening, (poorly or) undocumented hell. I threw up http://www.pateshop.nyc/ http://www.pateshop.nyc/ for some friends and it took a full day. It would have been faster if I'd just wrote the site myself. It's not even that great -- to get the nav/ux requested I had to compromise a lot to what SquareSpace could deliver. I don't think someone unfamiliar with HTML and CSS would have been successful.

e12e 10y ago

Good question. I recently had a brief look at a site a friend hosts with wordpress.com - and after that my "old" recommendation of going with a standard wordpress.com-hosted wordpress without extra plugins is pretty much out: it looks like with their move to a javscript/api/spa-based admin they've managed to alienate quite a bit of the theme-developers and/or left them behind -- so now there are two admin-pages (the javascript spa and wp-admin.php) -- and neither work perfectly for legacy installations... I was already a bit sceptical of wordpress.com hosting due to the limitation on custom themes, and the hurdles needed to hop through to make a new theme that can be used with a wordpress.com hosted site... All that said, plain wordpress along with a modern php-version and the wordpress-cli still looks like it's an option. The major caveat is that as soon as you get a "wordpress hacker" to "enhance" the site - security appears to go out the window (feels like a third of the traffic on the full-disclosure list is still wordpress plugins. Rarely wordpress core, though). With that dismal news out of the way, ghost.org + ghost.io hosting does look quite reasonable for a blog (basically what you get with "plain wordpress" anyway). It looks rather unsuited for anything that's not just a blog, including a full image gallery (there are plugin/themes, but ghost is explicitly not a content management system, and doesn't really have any real media management to manage uploaded images in galleries etc. Perhaps ghost.io + something like 500px.com is a possible fix). Other than that, I have a good impression of netlifly -- but being focused on static sites, it might be a though sell for someone that would really just want "a simple wordpress that works and looks beautiful". I'm not sure, I've only toyed a bit with it, and enjoyed their various excellent "using netlifly with X" blogpost (a really shining example of corporate marketing if you ask me - I don't think any other startup/kickstarter/company mailings manage to reach near the nice quality that netlifly seem to reach effortlessly (a typical indication that a lot of effort is put in, btw :-). https://www.netlify.com/ https://www.netlify.com/ See eg: https://www.netlify.com/blog/2016/02/24/a-step-by-step-guide-gatsby-on-netlify https://www.netlify.com/blog/2016/02/24/a-step-by-step-guide... https://www.netlify.com/blog/2015/11/02/a-step-by-step-guide-hosting-expose-on-netlify https://www.netlify.com/blog/2015/11/02/a-step-by-step-guide... https://www.netlify.com/blog/2015/10/06/a-step-by-step-guide-hugo-on-netlify https://www.netlify.com/blog/2015/10/06/a-step-by-step-guide... https://www.netlify.com/blog/2015/10/15/a-step-by-step-guide-pelican-on-netlify https://www.netlify.com/blog/2015/10/15/a-step-by-step-guide... (They're all mostly the same, and don't go into much depth, but probably gives a fair idea of what Netlifly is and is not). [ed: Another option might be to get an account with Sandstorm, and host either Ghost or Wordpress along with (maybe) some kind of gallery - or just some form of wiki: https://oasis.sandstorm.io/ https://oasis.sandstorm.io/ ]

vellum 10y ago

If they just need a blog, I'd recommend using tumblr and a custom domain name.

rahimnathwani 10y ago

"what can I recommend to non-technical people when they need a website quickly and inexpensively that won't make me feel like I'm setting them up to get owned" https://www.strikingly.com/ https://www.strikingly.com/