Let me start by saying I'm not a big fan of WordPress. That said, after using Drupal for a while, working on Ruby on Rails sites, and even building my own CMS'

Let me start by saying I'm not a big fan of WordPress. That said, after using Drupal for a while, working on Ruby on Rails sites, and even building my own CMS' with a few different programming languages, after all that I ended up back with WordPress as the best solution for quite a number of clients. So here I am defending WordPress... > Sucuri reports that 78% of the sites with security issues they work on are WordPress sites. Or maybe it's because WordPress is by far the most popular CMS. It's a bit like the argument why there are 'no' viruses on macs. Sure, there might be some merit to the argument that it's intrinsic to the OS, but a big part of it is that the market share is much larger for Windows. I'm still willing to bet that WordPress core is probably safer than any of the self-built CMS'es that offer feature parity. > While WordPress’s core software is built and tested by a centralized development team, the same is not true for the thousands of themes and plugins If the alternative is a platform with 'managed plugins' or 'no plugins other than self-written ones', then obviously that's probably safer than random code downloaded from the internet. But there's the option to just not use these plugins, leaving you with a core that is probably safer, or at least as safe, as whatever you're using instead. Not every 'feature' needs to be used. > One of my professional colleagues told me this story and I know it’s not unusual. As he was setting up a new WordPress site for a non-profit, he recalled another site he built with a theme he really liked Same as above: just don't use themes or only use a few carefully-vetted ones. I'm willing to bet any dev shop worth their salt has their own 'starter theme' built from scratch. > But that doesn’t work for us. Our clients want to be able to change their look and feel based on their customer feedback, to integrate new features, or just because they want to. And we want to be able to tell them, “Yes, we can change what your site looks like—with no limits.” For us, a site that doesn’t adhere to standard coding practices is simply not good enough. The poor code quality and design constraints of pre-built themes do not work for a custom website. So build a theme. It's really, really easy to do, and if a client pays me a few thousand for a site I sure as hell won't saddle them with a cheap theme that is difficult to customize. > But for complex site, this constraint really gets in the way. For example, a site that requires a searchable product database, resources like white papers and case studies, and a directory of sales representatives can be built with WordPress, but it’s going to take a developer more time to set up the data structure and make all of these parts usable for a content editor. While I agree that it's probably easier to do this 'from scratch' than mess with WordPress' innards, there's a perfectly fine solution to this that can handle quite a degree of complexity: the Advanced Custom Fields (ACF) plugin. More on that later. > We prefer to build a site from the ground up. With a tool like WordPress, we have to strip out a bunch of the default features just to make it more secure and fit with a website’s specific goals. I tried that a few times only to realize that it's a major amount of work to get the crucial parts working, and the end result is probably rougher than WordPress (which offers most of these core feature out of the box). Sure, use Django, RoR, or something else if your needs are custom enough that you end up fighting WordPress. But judging from their 'our work' section, I can't really see what they need that can't be done with WordPress and ACF, and a handful - at most - of reputable plugins. Finally, I just can't help but notice that their own site is not exactly the prettiest, to put it mildly. Now, if this were some developer site I wouldn't really hold it against them, but from looking at their portfolio (and the fact that they apparently prefer fucking ExpressionEngine to Wordpress) they strike me as a fairly typical CRUD website agency. Design is kind of core to that line of work. So, anyways, what's so great about ACF that it alone was enough to pull me back to WordPress? Well, it piggy-backs on WordPress' slick UI (relative to most popular or self-built CMS' anyways) and allows you to enrich any content type or post or whatnot with extra fields. Pretty much anything you might need, at least for the kind of sites they seem to build. The UI for these fields is slick, and the plugin offers pretty decent functions for getting your data out of the system. I generally just directly query the metadata though. As far as getting data into your database, this pretty much obviates the need for tons of plugins. You'll have to build your own gallery code, or whatnot, but honestly I believe any quality dev should should do that already, or settle for high-quality front-end plugins that do what they need. Of course, if you use a front-end plugin it's gonna need it's data in a particular format. That's trivial to achieve with ACF: get your data out, and shape it in your theming layer. Anyways, maybe I'm being too hard on them, but this article just doesn't make much sense to me. Especially since their alternative is ExpressionEngine which, last I looked, was a very shitty hosted system that locks you and your clients into a commercial third party.