4 ms·

Maybe, but you're still using a platform, they'll pull your SEO towards them every way they can. I kept my wife's wordpress site updated all the time... when th

Maybe, but you're still using a platform, they'll pull your SEO towards them every way they can. I kept my wife's wordpress site updated all the time... when the virus hit it was a PAID FOR Theme that was targeted. Seriously the surface area of Wordpress self-install is crazy bad, not to mention many of the themes you select install scroll-jackers and email-signup cover the page crap that I'm talking about.

marpstar 9y ago
So should we all start from scratch and build our own CMS? WordPress is like Windows. It works great for a large majority of users. Some people catch malware because being the most popular tool will result in it being the most targeted.
- coding123 9y ago
  I definitely agree with your point about everyone creating a CMS. I wish I had an answer for you - and like Windows yes I wish more people would migrate to a different OS too. There is Ghost, but I think more recently they are becoming more corporate too. However Ghost, unlike Wordpress is built on Node, which is more secure by default. It's similar to Java, in that the request handling is done by passing specific things around - in PHP everything has access to the request - every bit of code is able to do whatever it wants. So when you build a plugin system in PHP, you're giving your plugins a HUGE surface area. In non-PHP CMS's you have the ability to build a better system. You can isolate what the code is allowed to do. It's not perfect either, but there is a big different between Facebook writing PHP where the corporate can control the rules and its coding standards and Wordpress where people across a large spectrum of coding experience are providing a plugin that can, basically hose the entire website. (And edit to clarify - yes Ghost would have plugins with a wide range of coding experience, too, but remember there is a very different exploitable surface area here.)
goatherders 9y ago
Ah, should have scrolled down. You bought a vulnerable theme. That isn't the fault of WordPress.
- kemayo 9y ago
  I do think it's fair to criticize WordPress for its design being such that themes are inherent security vulnerabilities. Not that I don't see the trade-offs. They chose flexibility and ease-of-implementation early on, and are somewhat stuck with the security issue because of the huge theme ecosystem.

marpstar 9y ago

So should we all start from scratch and build our own CMS? WordPress is like Windows. It works great for a large majority of users. Some people catch malware because being the most popular tool will result in it being the most targeted.

coding123 9y ago
I definitely agree with your point about everyone creating a CMS. I wish I had an answer for you - and like Windows yes I wish more people would migrate to a different OS too. There is Ghost, but I think more recently they are becoming more corporate too. However Ghost, unlike Wordpress is built on Node, which is more secure by default. It's similar to Java, in that the request handling is done by passing specific things around - in PHP everything has access to the request - every bit of code is able to do whatever it wants. So when you build a plugin system in PHP, you're giving your plugins a HUGE surface area. In non-PHP CMS's you have the ability to build a better system. You can isolate what the code is allowed to do. It's not perfect either, but there is a big different between Facebook writing PHP where the corporate can control the rules and its coding standards and Wordpress where people across a large spectrum of coding experience are providing a plugin that can, basically hose the entire website. (And edit to clarify - yes Ghost would have plugins with a wide range of coding experience, too, but remember there is a very different exploitable surface area here.)

goatherders 9y ago

Ah, should have scrolled down. You bought a vulnerable theme. That isn't the fault of WordPress.

kemayo 9y ago
I do think it's fair to criticize WordPress for its design being such that themes are inherent security vulnerabilities. Not that I don't see the trade-offs. They chose flexibility and ease-of-implementation early on, and are somewhat stuck with the security issue because of the huge theme ecosystem.