5 ms·

Hugo is impressive, but: > Wordpress is a mess that keeps on chugging through inertia This is a weirdly reductionist position. WordPress is an auto-updating,

Hugo is impressive, but: > Wordpress is a mess that keeps on chugging through inertia This is a weirdly reductionist position. WordPress is an auto-updating, security-patched, open source CMS with a stable API, an advanced WYSIWYG editor and now layout tool, a reliable REST interface, good hosting support from stable vendors, a highly functional foundation and a profitable owner, etc. It's really no messier than any other open source CMS (less messy than several), and it has better community and foundation support than almost any open source product I can think of. It's fine not to like it, but let's not just casually write it off in a blog post about a static site generator that is limited in scope and a single third party behemoth hosting operation; that's disingenuous.

nunez 5y ago
This right here. For us technical folk, Wordpress is a beast that needs to be slayed. For John, the non-technical, world-travelling coffee shop owner, that wants to maintain a simple blog describing his adventures, it's perfect. (I say this as someone who used Wordpress and now uses Hugo)
Saris 5y ago
I feel like a lot of people dismiss WordPress purely on it being complex or heavy to run while completely dismissing the huge benefits it offers.
cleancoder0 5y ago
I do not like Hugo at all. Quite hard to map data inside templates.
Nextgrid 5y ago
> security-patched Unless bad guys "patch" it first before the official patches are out.
- unfocussed_mike 5y ago
  (You did not deserve downvoting on this; it's a reasonable point. Not sure when the last zero-day was exploited in WP itself, but it definitely happens in plugins and themes.) I usually find out there is an official patch when I get an email from a WP installation telling me it has already been installed. Core WP copes with zero-day attacks better than most platforms. To the extent that they will even mitigate problems in widely-installed third party plugins and themes if they think it necessary. Sure, there is a paradox with anything popular like this, that the people who are installing it are the people least likely to be able to deal with security patches. And that is an endless source of tension. But it is also why WP auto-patches, why plugin and theme auto-updates are now possible etc.
  - Nextgrid 5y ago
    My problem is less about zero-days - people aren't perfect and make mistakes, but Wordpress is asking for it: https://github.com/WordPress/WordPress/blob/master/wp-login.php https://github.com/WordPress/WordPress/blob/master/wp-login.... This garbage was normal in early-2000s web development but nowadays this problem has been solved - just look at any modern server-side MVC framework (whether PHP or others - PHP isn't to blame in here). Maybe it's indeed "good" at handling zero-days in terms of raw numbers, but maybe it would be better to just not have as many zero-days in the first place?
    - unfocussed_mike 5y ago
      wp-login.php is in need of attention, I think, and will get it through REST eventually. But it's also entangled with the last bastion of one of WP's most underrated/underdiscussed features: pluggable authentication. If you mean the appearance of the code: it's not to my taste! But it's actually really heavily governed by code standards (including the Yoda conditions stuff). WP itself will never be an MVC system, but then MVC is really at odds with the hooks-filters-and-actions API approach WP uses, which again you don't have to like but is crucial to its success. You can make tiny, targeted changes to the way a WP page renders -- with a single hook function -- that would be hard to replicate in MVC without vastly more effort. Magento tries to achieve this, and does it well, but at the cost of needing dependency injection, XML layout files, etc. etc.; it's enormously more complex. I personally think MVC is the right thing for app development but wholly the wrong thing for the rendering front end of a CMS site, but I acknowledge this is a contentious opinion.
- lnxg33k1 5y ago
  Wouldn't it be the same for any software? But Wordpress keeps up quite well, considering the amount of efforts that hackers put in finding bugs on it, given that it powers a big chunk of the web
emptybottle 5y ago
Totally. There is a stigma against Wordpress for $reasons but compared to all the other platforms listed in this article WP is one of the most aligned with the open web.
tyingq 5y ago
I think Wordpress does have some criticism-worthy parts, but criticizing a CMS from the context of a static site generator doesn't make sense. That's a much smaller problem space.
- unfocussed_mike 5y ago
  > I think Wordpress does have some criticism-worthy parts It absolutely does -- and different criticisms have landed harder at different times.
mwcampbell 5y ago
Besides all that, WordPress is doing something that scales [1], unlike all of us techies using static site generators that only people like us can use. If we want the open web to succeed, we should be getting behind things like WordPress. [1]: https://blogs.gnome.org/tbernard/2020/01/17/doing-things-that-scale/ https://blogs.gnome.org/tbernard/2020/01/17/doing-things-tha...
- jtbayly 5y ago
  I use and am in favor of Wordpress. However, I’m also in favor of making static site generators easier to use for more people.
  - CharlesW 5y ago
    > I use and am in favor of Wordpress. However, I’m also in favor of making static site generators easier to use for more people. Amen, and I think this is the thread creator's point — WordPress doesn't have to "lose" for Hugo to "win", and it's pointless to pick a fight with a wildly different solution that solves a different set of use cases.
    - unfocussed_mike 5y ago
      Pretty close, yes -- and I agree in both cases. The thing that bugs me about more or less any article about why static sites are better/easier/simpler is that they all depend on writing off WP as sort of a straw man. I have been playing with Publii again after being nudged towards it by a HN comment, and I think it might be a useful middle ground: https://getpublii.com/ https://getpublii.com/ It's far from perfect but it's kind of cute and fun to use, and definitely easier and more approachable than Hugo.
- Closi 5y ago
  > Besides all that, WordPress is doing something that scales [1], unlike all of us techies using static site generators that only people like us can use. If we want the open web to succeed, we should be getting behind things like WordPress. This is a great point - I built a website for a club I go to on Hugo and S3, and it is updated by users going to Forestry.io which then posts changes to Github, which then runs a Github Action which compiles it with Hugo and uploads to S3. I thought users would be able to get their head around it... nope! I'm the only one that can make changes to the website. It's still been worth it because of how cheap it is to run, and better for the environment than having a server idling to support our static site, but still a pain that I'm stuck being the one person that can update it.
rectang 5y ago
I agree that WordPress shouldn't be written off, but we have to consider its plugin architecture, and the ecosystem and culture whereby plugins and themes get installed and used. WordPress core is kept up to date by a responsive team. However, while some WordPress users may be content with a vanilla installation, there are many who are not. A traditional way to add functionality and style to a WordPress installation is to add plugins and themes. These plugins and themes are not sandboxed, and operate with full privileges. Unfortunately, there are many plugins and themes which do not uphold the standards of core WordPress with regards to security. And the people who determine which plugins get added to a WordPress install are often non-technical users who are not in a position to evaluate the security implications. The outcome is that while the WordPress core is hardened, typical WordPress installations which use themes and plugins are still a security shitshow. The only way I can see to solve this architectural/ecosystem problem would be to somehow nerf plugins, or at least themes, analogous to how browsers discontinued support for the old-style fully-privileged browser extensions. For example, themes could be restricted to inert HTML and CSS. But considering how WordPress gets used, this would be so disruptive that I can't ever see it happening. And therefore, static site generators like Hugo will continue to enjoy a huge comparative advantage over WordPress in terms of security, even if WordPress core has all the positive traits that you lay out.
- unfocussed_mike 5y ago
  > However, while some WordPress users may be content with a vanilla installation, there are many who are not. Very true. But it is clear that WP's broad trajectory is towards GUI-configurable, block layout themes that do satisfy more users. They are doing more on this than any other CMS project. > A traditional way to add functionality and style to a WordPress installation is to add plugins and themes. These plugins and themes are not sandboxed, and operate with full privileges. This is true, as is the risk with third party plugins. (Though ultimately end users will just install some other bodgy CMS if they can't get what they want from plugins. The tradeoff with WP is that those plugins receive some scrutiny through vulnerability databases, better educated WP developers etc.) Sandboxing themes is always going to be a little tricky, but it is plausible (and indeed it's not out of the question to project WP moving in that direction, given the way its internals are being reconsidered around the REST API). But do you know of any widely-installable, user-friendly CMS that sandboxes its plugins? That is a huge undertaking. It's something I've thought of many times before, but I can't think of a way to make that practical on the sheer range of hosting options that WP makes possible.
seanwilson 5y ago
WordPress has many problems with the way it's usually used that you don't get with static site generators though: - WordPress can be auto-updating but when you update the core files, theme, and plugins, and want to upgrade PHP, there's lots of incompatibilities that can take your site down and cause other problems so it's not set and forget. - Most sites also require a combo of plugins because core is missing essentials (e.g. page caching, SEO tags, contact forms, image optimisation), where each can give page speed, security, and maintenance issues. - Dynamic PHP code is inherently less secure than static HTML files e.g. there's been remote code execution exploits via WordPress contact form and caching plugins in the past which isn't something you have to worry about with static sites. - Versioning, deploys and updates via Git and CI/CD isn't standard practice with the WordPress community either. Plugins that update themselves and write files to the server is the norm which is another source of stability and security problems. - Configuration being split across the filesystem and the database gets in the way of predictable staging/production deploys and QA. - When writing PHP theme templates, there's minimal default escaping when you output fields so you have to be extra careful to not introduce exploits. Static sites are fundamentally more secure, more performant and easier to test by default. There's bandaids to some of the above but you'll be fighting against WordPress standard practices all the time. I'm still trying to find a good open source WYSIWYG page builder experience here that can compete with WordPress though. Using WordPress as a CMS and a static site generator to deploy it is an option though.
- unfocussed_mike 5y ago
  > Static sites are fundamentally more secure and more performant by default. I'm afraid to say I consider "performant" to be a term almost without meaning, but especially here where you just mean "faster". Any true comparison of performance would have to address the functional things that WP can do that a static generated site cannot do without third party services or serverless functions etc.
  - seanwilson 5y ago
    I mean page speed, like what Google Lighthouse gives you a rating for. Optimising WordPress for this is much more challenging than static pages in my experience. What functionality are you thinking about here? I find most business websites don't need much beyond static HTML contact forms, nothing that would need serverless functions. A themed search page is a bit more challenging but you can embed Google Search or something like Algolia. Messaging widgets, analytics are usually JavaScript snippets, same with a lot of buy-button functionality.
Fnoord 5y ago
Its all the plugins which are the mess.

nunez 5y ago

This right here. For us technical folk, Wordpress is a beast that needs to be slayed. For John, the non-technical, world-travelling coffee shop owner, that wants to maintain a simple blog describing his adventures, it's perfect. (I say this as someone who used Wordpress and now uses Hugo)

Saris 5y ago

I feel like a lot of people dismiss WordPress purely on it being complex or heavy to run while completely dismissing the huge benefits it offers.

cleancoder0 5y ago

I do not like Hugo at all. Quite hard to map data inside templates.

Nextgrid 5y ago

> security-patched Unless bad guys "patch" it first before the official patches are out.

unfocussed_mike 5y ago
(You did not deserve downvoting on this; it's a reasonable point. Not sure when the last zero-day was exploited in WP itself, but it definitely happens in plugins and themes.) I usually find out there is an official patch when I get an email from a WP installation telling me it has already been installed. Core WP copes with zero-day attacks better than most platforms. To the extent that they will even mitigate problems in widely-installed third party plugins and themes if they think it necessary. Sure, there is a paradox with anything popular like this, that the people who are installing it are the people least likely to be able to deal with security patches. And that is an endless source of tension. But it is also why WP auto-patches, why plugin and theme auto-updates are now possible etc.
- Nextgrid 5y ago
  My problem is less about zero-days - people aren't perfect and make mistakes, but Wordpress is asking for it: https://github.com/WordPress/WordPress/blob/master/wp-login.php https://github.com/WordPress/WordPress/blob/master/wp-login.... This garbage was normal in early-2000s web development but nowadays this problem has been solved - just look at any modern server-side MVC framework (whether PHP or others - PHP isn't to blame in here). Maybe it's indeed "good" at handling zero-days in terms of raw numbers, but maybe it would be better to just not have as many zero-days in the first place?
  - unfocussed_mike 5y ago
    wp-login.php is in need of attention, I think, and will get it through REST eventually. But it's also entangled with the last bastion of one of WP's most underrated/underdiscussed features: pluggable authentication. If you mean the appearance of the code: it's not to my taste! But it's actually really heavily governed by code standards (including the Yoda conditions stuff). WP itself will never be an MVC system, but then MVC is really at odds with the hooks-filters-and-actions API approach WP uses, which again you don't have to like but is crucial to its success. You can make tiny, targeted changes to the way a WP page renders -- with a single hook function -- that would be hard to replicate in MVC without vastly more effort. Magento tries to achieve this, and does it well, but at the cost of needing dependency injection, XML layout files, etc. etc.; it's enormously more complex. I personally think MVC is the right thing for app development but wholly the wrong thing for the rendering front end of a CMS site, but I acknowledge this is a contentious opinion.
lnxg33k1 5y ago
Wouldn't it be the same for any software? But Wordpress keeps up quite well, considering the amount of efforts that hackers put in finding bugs on it, given that it powers a big chunk of the web

emptybottle 5y ago

Totally. There is a stigma against Wordpress for $reasons but compared to all the other platforms listed in this article WP is one of the most aligned with the open web.

tyingq 5y ago

I think Wordpress does have some criticism-worthy parts, but criticizing a CMS from the context of a static site generator doesn't make sense. That's a much smaller problem space.

unfocussed_mike 5y ago
> I think Wordpress does have some criticism-worthy parts It absolutely does -- and different criticisms have landed harder at different times.

mwcampbell 5y ago

Besides all that, WordPress is doing something that scales [1], unlike all of us techies using static site generators that only people like us can use. If we want the open web to succeed, we should be getting behind things like WordPress. [1]: https://blogs.gnome.org/tbernard/2020/01/17/doing-things-that-scale/ https://blogs.gnome.org/tbernard/2020/01/17/doing-things-tha...

jtbayly 5y ago
I use and am in favor of Wordpress. However, I’m also in favor of making static site generators easier to use for more people.
- CharlesW 5y ago
  > I use and am in favor of Wordpress. However, I’m also in favor of making static site generators easier to use for more people. Amen, and I think this is the thread creator's point — WordPress doesn't have to "lose" for Hugo to "win", and it's pointless to pick a fight with a wildly different solution that solves a different set of use cases.
  - unfocussed_mike 5y ago
    Pretty close, yes -- and I agree in both cases. The thing that bugs me about more or less any article about why static sites are better/easier/simpler is that they all depend on writing off WP as sort of a straw man. I have been playing with Publii again after being nudged towards it by a HN comment, and I think it might be a useful middle ground: https://getpublii.com/ https://getpublii.com/ It's far from perfect but it's kind of cute and fun to use, and definitely easier and more approachable than Hugo.
Closi 5y ago
> Besides all that, WordPress is doing something that scales [1], unlike all of us techies using static site generators that only people like us can use. If we want the open web to succeed, we should be getting behind things like WordPress. This is a great point - I built a website for a club I go to on Hugo and S3, and it is updated by users going to Forestry.io which then posts changes to Github, which then runs a Github Action which compiles it with Hugo and uploads to S3. I thought users would be able to get their head around it... nope! I'm the only one that can make changes to the website. It's still been worth it because of how cheap it is to run, and better for the environment than having a server idling to support our static site, but still a pain that I'm stuck being the one person that can update it.

rectang 5y ago

I agree that WordPress shouldn't be written off, but we have to consider its plugin architecture, and the ecosystem and culture whereby plugins and themes get installed and used. WordPress core is kept up to date by a responsive team. However, while some WordPress users may be content with a vanilla installation, there are many who are not. A traditional way to add functionality and style to a WordPress installation is to add plugins and themes. These plugins and themes are not sandboxed, and operate with full privileges. Unfortunately, there are many plugins and themes which do not uphold the standards of core WordPress with regards to security. And the people who determine which plugins get added to a WordPress install are often non-technical users who are not in a position to evaluate the security implications. The outcome is that while the WordPress core is hardened, typical WordPress installations which use themes and plugins are still a security shitshow. The only way I can see to solve this architectural/ecosystem problem would be to somehow nerf plugins, or at least themes, analogous to how browsers discontinued support for the old-style fully-privileged browser extensions. For example, themes could be restricted to inert HTML and CSS. But considering how WordPress gets used, this would be so disruptive that I can't ever see it happening. And therefore, static site generators like Hugo will continue to enjoy a huge comparative advantage over WordPress in terms of security, even if WordPress core has all the positive traits that you lay out.

unfocussed_mike 5y ago
> However, while some WordPress users may be content with a vanilla installation, there are many who are not. Very true. But it is clear that WP's broad trajectory is towards GUI-configurable, block layout themes that do satisfy more users. They are doing more on this than any other CMS project. > A traditional way to add functionality and style to a WordPress installation is to add plugins and themes. These plugins and themes are not sandboxed, and operate with full privileges. This is true, as is the risk with third party plugins. (Though ultimately end users will just install some other bodgy CMS if they can't get what they want from plugins. The tradeoff with WP is that those plugins receive some scrutiny through vulnerability databases, better educated WP developers etc.) Sandboxing themes is always going to be a little tricky, but it is plausible (and indeed it's not out of the question to project WP moving in that direction, given the way its internals are being reconsidered around the REST API). But do you know of any widely-installable, user-friendly CMS that sandboxes its plugins? That is a huge undertaking. It's something I've thought of many times before, but I can't think of a way to make that practical on the sheer range of hosting options that WP makes possible.

seanwilson 5y ago

WordPress has many problems with the way it's usually used that you don't get with static site generators though: - WordPress can be auto-updating but when you update the core files, theme, and plugins, and want to upgrade PHP, there's lots of incompatibilities that can take your site down and cause other problems so it's not set and forget. - Most sites also require a combo of plugins because core is missing essentials (e.g. page caching, SEO tags, contact forms, image optimisation), where each can give page speed, security, and maintenance issues. - Dynamic PHP code is inherently less secure than static HTML files e.g. there's been remote code execution exploits via WordPress contact form and caching plugins in the past which isn't something you have to worry about with static sites. - Versioning, deploys and updates via Git and CI/CD isn't standard practice with the WordPress community either. Plugins that update themselves and write files to the server is the norm which is another source of stability and security problems. - Configuration being split across the filesystem and the database gets in the way of predictable staging/production deploys and QA. - When writing PHP theme templates, there's minimal default escaping when you output fields so you have to be extra careful to not introduce exploits. Static sites are fundamentally more secure, more performant and easier to test by default. There's bandaids to some of the above but you'll be fighting against WordPress standard practices all the time. I'm still trying to find a good open source WYSIWYG page builder experience here that can compete with WordPress though. Using WordPress as a CMS and a static site generator to deploy it is an option though.

unfocussed_mike 5y ago
> Static sites are fundamentally more secure and more performant by default. I'm afraid to say I consider "performant" to be a term almost without meaning, but especially here where you just mean "faster". Any true comparison of performance would have to address the functional things that WP can do that a static generated site cannot do without third party services or serverless functions etc.
- seanwilson 5y ago
  I mean page speed, like what Google Lighthouse gives you a rating for. Optimising WordPress for this is much more challenging than static pages in my experience. What functionality are you thinking about here? I find most business websites don't need much beyond static HTML contact forms, nothing that would need serverless functions. A themed search page is a bit more challenging but you can embed Google Search or something like Algolia. Messaging widgets, analytics are usually JavaScript snippets, same with a lot of buy-button functionality.

Fnoord 5y ago

Its all the plugins which are the mess.