8 ms·

I've worked with WordPress for over 9 years and set up probably over 100 sites, but can't wait for it to die. It's easy to setup and the ecosystem is great, bu

I've worked with WordPress for over 9 years and set up probably over 100 sites, but can't wait for it to die. It's easy to setup and the ecosystem is great, but the security issues are massive and there's really no reason for content to be stored in a database for the majority of sites. I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content.

aphextron 9y ago
>I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content. Those people are already served well by things like Wix and Squarespace. WordPress is essentially a point and click application development tool at this point, with integrations for anything imaginable. Yes it is insanely insecure, slow, poorly designed, and bloated. But the depth of offerings from the plugin marketplace will keep WP relevant for a long time to come with people who can't afford custom development.
- oldcynic 9y ago
  Wix seems to generate the slowest loading sites on the internet. Especially loading images long after page load is done. WordPress is positively supersonic by comparison.
  - Whitestrake 9y ago
    Does Wix optimize its images between upload and delivery? I'd be inclined to believe that this is a side effect of Wix's target market not being aware of how to optimally compress their images for web delivery.
    - david-cako 9y ago
      I don’t think that’s the user’s responsibility if its designed for non technical people.
- Donzo 9y ago
  What is insecure about WordPress? If you minimize your reliance on plugins, enable automatic updates, and harden your installation, it's pretty secure. At least I haven't had issues. Anything can be insecure if it's misconfigured, not just WordPress.
  - ayrx 9y ago
    WordPress has a history of almost embarrassing security vulnerabilities. To be fair, most PHP applications of that era have similar track records. The newer versions have been _much_ better.
  - Slansitartop 9y ago
    > What is insecure about WordPress? > If you minimize your reliance on plugins, enable automatic updates, and harden your installation, it's pretty secure. At least I haven't had issues. My guess is that it was long too easy to not do any of those things, so it gained a reputation for being insecure. They might have mitigated a lot of the problems, but bad reputations die hard.
  - baby 9y ago
    You don’t even need all that if you just use a wordpress over at wordpress.com That’s what I suggest all my friends who want to create a blog to do.
jchung 9y ago
> I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content. Does this not exist? Would love to offer that to some of my non-technical team members.
- nas 9y ago
  There are a number of them. Jekyll and Hyde are two of them. Wordpress is a security disaster, IMHO.
  - konschubert 9y ago
    I can't speak for Hyde, but Jekyll requires you to edit text files which makes it unaccessible for non-technical people.
    - rozenmd 9y ago
      There's Netlify + GatsbyJS - takes git know-how to setup, but once you're there it's a Rich Text Editor on a webpage controlling your content
      - tdhz77 9y ago
        Add contentful and you have a admin dashboard and hundreds of integrations. I set this up last week and it’s amazing. It costs $0 for my small project. I’ve aleo rolled out it out to event websites. And they love it too. No database is a big win for bloggers, who should focus on content and not security.
        chimen 9y ago
        $249 lowest pricing package after you stretch out pass the free limitations.
        tdhz77 9y ago
        I won’t be hitting a million hits on the api for 99.9% of my projects.
michellegreer1 9y ago
Contentful, Hugo, or Prismic could fit this bill. There are a lot of options in the Headless CMS space.
- rocky1138 9y ago
  Hugo is great but it's definitely not for the non-technical.
burnte 9y ago
There are dozens of static generators, and frankly I don't think they're a great alternative. Put a cache in front of WP And you're done. Then when you want to do a redesign, you don't have to futz with dozens of static pages. What's that? You've stored your content separately so that you can just regenerate the pages when changing site designs? It's a system for letting you manage your content separately from the rest of the mechanics or the site? The content files are stored on a journaled file system like EXT4 or NTFS? That's fantastic. It's just like a DB backed CMS that stores flat files for cache. I'm not saying static page generators aren't useful, but I am saying that the difference between that and a cached wordpress install is virtually nil.
- chrsstrm 9y ago
  Caching your WordPress instance does absolutely nothing in helping with security. I refuse to set up a new WordPress instance for any client unless they are also paying me a monthly retainer to keep it updated and secure.
  - seanwilson 9y ago
    > I refuse to set up a new WordPress instance for any client unless they are also paying me a monthly retainer to keep it updated and secure. Similar, or insist a hosted solution is used.
  - grrowl 9y ago
    If you're lucky enough to install well-written (or self-written) plugins which withstand major version updates, you can set `WP_AUTO_UPDATE_CORE` to `true` in your wp-config and it will auto-update to any latest version. There's an added risk of plugins not working, but you'll stay up to date.
    - toast0 9y ago
      WP auto update is sort of nice in that you stay updated (but who the heck knows what will happen if you have one MySQL server and multiple www servers), except it means that your webroot is writable by PHP, which is not a great thing, because someone who finds an arbitrary file write issue before it's patched (or before auto update triggers) will be able to add their own files to your webroot -- weather that's defacement, malware installers, warez drops, bitcoin mining, shells for later; it's all pretty nasty.
kinkrtyavimoodh 9y ago
Static site generators, at least how they exist today, are unfortunately massively impractical for the vast majority of Wordpress users. Heck, I am a pretty technical user and even I regret moving my blog to a static generator.
- baby 9y ago
  Yep. I don’t understand this trend. I would never use a static blog myself unless they would offer an online administration. And it would be weird to have such a thing for something that claims to be static.
  - daxelrod 9y ago
    I haven't looked into this for over a decade, but that's exactly how Movable Type used to work. The blog is generated as static files by the admin interface, which is web based but can be completely isolated from the publicly facing site.
    - baby 9y ago
      isn't that re-inventing the wheel though?
      - daxelrod 9y ago
        What wheel? Movable Type existed before WordPress.
  - thirdsun 9y ago
    There are countless CMS for static sites / blogs these days: - https://www.datocms.com/ https://www.datocms.com/ - https://www.netlifycms.org/ https://www.netlifycms.org/ - https://www.siteleaf.com/ https://www.siteleaf.com/
    - baby 9y ago
      imo this is re-inventing the wheel, the same with a caching system in front of a database is way easier and cleaner to implement
tokyokawasemi 9y ago
> I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content. This. (Although it seems a lot of people aren't in agreement) I think there used to be an app called Cactus for Mac that had a GUI and let you generate your own site. This sort of solution could work for people 1) not technical enough to run command line site generators, but 2) technical enough to buy some hosting space to drag their static site onto. If I were a hosting company, maybe I'd explore making an intuitive site generator available for free, in the hopes it could sell some light hosting plans. For what it's worth, my preferred site generator is Poole (https://github.com/obensonne/poole https://github.com/obensonne/poole). I'm not sure why it's not better known.
prepend 9y ago
What’s funny is that Blogger used to have a static site generator and a decent authoring front-end. I don’t remember when they killed this feature, but it was around 2009. They also supported some dynamic elements like comments and admin.
mgrouchy 9y ago
Not great if you are looking for a DIY solution, however in the SAAS space I run the Engineering team at a company that is doing essentially this, https://www.pagecloud.com https://www.pagecloud.com . Blog (If thats what you are looking for) and some other goodies on the rapid site construction side, coming very soon.

aphextron 9y ago

>I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content. Those people are already served well by things like Wix and Squarespace. WordPress is essentially a point and click application development tool at this point, with integrations for anything imaginable. Yes it is insanely insecure, slow, poorly designed, and bloated. But the depth of offerings from the plugin marketplace will keep WP relevant for a long time to come with people who can't afford custom development.

oldcynic 9y ago
Wix seems to generate the slowest loading sites on the internet. Especially loading images long after page load is done. WordPress is positively supersonic by comparison.
- Whitestrake 9y ago
  Does Wix optimize its images between upload and delivery? I'd be inclined to believe that this is a side effect of Wix's target market not being aware of how to optimally compress their images for web delivery.
  - david-cako 9y ago
    I don’t think that’s the user’s responsibility if its designed for non technical people.
Donzo 9y ago
What is insecure about WordPress? If you minimize your reliance on plugins, enable automatic updates, and harden your installation, it's pretty secure. At least I haven't had issues. Anything can be insecure if it's misconfigured, not just WordPress.
- ayrx 9y ago
  WordPress has a history of almost embarrassing security vulnerabilities. To be fair, most PHP applications of that era have similar track records. The newer versions have been _much_ better.
- Slansitartop 9y ago
  > What is insecure about WordPress? > If you minimize your reliance on plugins, enable automatic updates, and harden your installation, it's pretty secure. At least I haven't had issues. My guess is that it was long too easy to not do any of those things, so it gained a reputation for being insecure. They might have mitigated a lot of the problems, but bad reputations die hard.
- baby 9y ago
  You don’t even need all that if you just use a wordpress over at wordpress.com That’s what I suggest all my friends who want to create a blog to do.

jchung 9y ago

> I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content. Does this not exist? Would love to offer that to some of my non-technical team members.

nas 9y ago
There are a number of them. Jekyll and Hyde are two of them. Wordpress is a security disaster, IMHO.
- konschubert 9y ago
  I can't speak for Hyde, but Jekyll requires you to edit text files which makes it unaccessible for non-technical people.
  - rozenmd 9y ago
    There's Netlify + GatsbyJS - takes git know-how to setup, but once you're there it's a Rich Text Editor on a webpage controlling your content
    - tdhz77 9y ago
      Add contentful and you have a admin dashboard and hundreds of integrations. I set this up last week and it’s amazing. It costs $0 for my small project. I’ve aleo rolled out it out to event websites. And they love it too. No database is a big win for bloggers, who should focus on content and not security.
      - chimen 9y ago
        $249 lowest pricing package after you stretch out pass the free limitations.
        tdhz77 9y ago
        I won’t be hitting a million hits on the api for 99.9% of my projects.

michellegreer1 9y ago

Contentful, Hugo, or Prismic could fit this bill. There are a lot of options in the Headless CMS space.

rocky1138 9y ago
Hugo is great but it's definitely not for the non-technical.

burnte 9y ago

There are dozens of static generators, and frankly I don't think they're a great alternative. Put a cache in front of WP And you're done. Then when you want to do a redesign, you don't have to futz with dozens of static pages. What's that? You've stored your content separately so that you can just regenerate the pages when changing site designs? It's a system for letting you manage your content separately from the rest of the mechanics or the site? The content files are stored on a journaled file system like EXT4 or NTFS? That's fantastic. It's just like a DB backed CMS that stores flat files for cache. I'm not saying static page generators aren't useful, but I am saying that the difference between that and a cached wordpress install is virtually nil.

chrsstrm 9y ago
Caching your WordPress instance does absolutely nothing in helping with security. I refuse to set up a new WordPress instance for any client unless they are also paying me a monthly retainer to keep it updated and secure.
- seanwilson 9y ago
  > I refuse to set up a new WordPress instance for any client unless they are also paying me a monthly retainer to keep it updated and secure. Similar, or insist a hosted solution is used.
- grrowl 9y ago
  If you're lucky enough to install well-written (or self-written) plugins which withstand major version updates, you can set `WP_AUTO_UPDATE_CORE` to `true` in your wp-config and it will auto-update to any latest version. There's an added risk of plugins not working, but you'll stay up to date.
  - toast0 9y ago
    WP auto update is sort of nice in that you stay updated (but who the heck knows what will happen if you have one MySQL server and multiple www servers), except it means that your webroot is writable by PHP, which is not a great thing, because someone who finds an arbitrary file write issue before it's patched (or before auto update triggers) will be able to add their own files to your webroot -- weather that's defacement, malware installers, warez drops, bitcoin mining, shells for later; it's all pretty nasty.

kinkrtyavimoodh 9y ago

Static site generators, at least how they exist today, are unfortunately massively impractical for the vast majority of Wordpress users. Heck, I am a pretty technical user and even I regret moving my blog to a static generator.

baby 9y ago
Yep. I don’t understand this trend. I would never use a static blog myself unless they would offer an online administration. And it would be weird to have such a thing for something that claims to be static.
- daxelrod 9y ago
  I haven't looked into this for over a decade, but that's exactly how Movable Type used to work. The blog is generated as static files by the admin interface, which is web based but can be completely isolated from the publicly facing site.
  - baby 9y ago
    isn't that re-inventing the wheel though?
    - daxelrod 9y ago
      What wheel? Movable Type existed before WordPress.
- thirdsun 9y ago
  There are countless CMS for static sites / blogs these days: - https://www.datocms.com/ https://www.datocms.com/ - https://www.netlifycms.org/ https://www.netlifycms.org/ - https://www.siteleaf.com/ https://www.siteleaf.com/
  - baby 9y ago
    imo this is re-inventing the wheel, the same with a caching system in front of a database is way easier and cleaner to implement

tokyokawasemi 9y ago

> I hope a static site generator comes along with an intuitive UI for non-technical people to easily update their own content. This. (Although it seems a lot of people aren't in agreement) I think there used to be an app called Cactus for Mac that had a GUI and let you generate your own site. This sort of solution could work for people 1) not technical enough to run command line site generators, but 2) technical enough to buy some hosting space to drag their static site onto. If I were a hosting company, maybe I'd explore making an intuitive site generator available for free, in the hopes it could sell some light hosting plans. For what it's worth, my preferred site generator is Poole (https://github.com/obensonne/poole https://github.com/obensonne/poole). I'm not sure why it's not better known.

prepend 9y ago

What’s funny is that Blogger used to have a static site generator and a decent authoring front-end. I don’t remember when they killed this feature, but it was around 2009. They also supported some dynamic elements like comments and admin.

mgrouchy 9y ago

Not great if you are looking for a DIY solution, however in the SAAS space I run the Engineering team at a company that is doing essentially this, https://www.pagecloud.com https://www.pagecloud.com . Blog (If thats what you are looking for) and some other goodies on the rapid site construction side, coming very soon.