3 ms·

WordPress core is lacking a lot of features you'd expect for basic sites though (e.g. contact forms, caching, FAQ, SEO tags, social sharing) so anything but bas

WordPress core is lacking a lot of features you'd expect for basic sites though (e.g. contact forms, caching, FAQ, SEO tags, social sharing) so anything but basic blogs require plugins or custom code. A big draw of WordPress is that non-developers can customise it with all the plugins that are available, so saying WordPress is secure as long as you avoid plugins nullifies this. It's terrifying that a contact form or caching plugin that you need to install because the functionality isn't built-in could result in a remote code execution exploit.

kijin 5y ago
Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. IMO the problem with the plugin ecosystem is not that they're required, but that so much of the well-known plugins are bloated crap. Popular SEO plugins don't stop at inserting SEO tags into your <head>. They come with AMP integration, an online robots.txt editor, automatic content generator, competitor site analyzer, spam blocker, and even a rudimentary caching feature to speed up your site! Meanwhile, caching plugins offer to minify your javascript, photo galleries include a Stripe payment gateway, and contact forms come with their own markup language. Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. There are really neat plugins that do one thing, do it well, and are easy to audit. Sadly, they are buried under all the spammy alternatives. WordPress really needs to invest in a better plugin search & ranking system that discourages bloat and offers incentives for high-quality code, perhaps by integrating some sort of static analyzer.
- seanwilson 5y ago
  > Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. > ... Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. If these plugins were in core though, they'd likely have much better security and be less bloated. The problem with the plugin ecosystem you mention I think stems from monetization - there's the incentive to stuff freemium plugins with functionality so you can charge for paid features. I really don't know how WordPress can reign this in. I think the WordPress core that plugins build upon has bad security fundamentals as well e.g. the default PHP templating language doesn't even escape strings by default, most theme and plugin file permissions aren't locked down to read-only, Git-based versioning and deploys isn't built-in or widely practiced. > There are really neat plugins that do one thing, do it well, and are easy to audit. What plugins would you recommend? I find you can get pretty far with Advanced Custom Fields and an SEO plugin.
- zelphirkalt 5y ago
  There may be some neat plugins, which might work well, but the problem is, that the usual user, which Wordpress is targetting as audience, does not have the skills or knowledge to distinguish between crap plugins and plugins that work. When you find yourself fixing bugs in plugins or trying to unlimit their functionality, because in their design someone introduced an unnecessary limitation via the chosen primitives and abstractions, then you are already clearly above the level of skill or knowledge, that Wordpress targets and are able to use more advanced tools to better effect. Since Wordpress targets that not so experienced developer or simply hobby blogger audience and aims to make it simple for them to create a blog, that is also the group, from which most people arise to become plugin developers. That in turn leads to inexperienced developers using PHP, which has its own set of problems. For example treating HTML as a string by default, allowing for countless injection and XSS vulnerabilities. Or the incessant spam of PHP open and close "tags" in the code, intermingling PHP, HTML, CSS and JS in the same files, switching context so much, that, given a point in the code, you are no longer sure what context you are really in, instead of them using a proper template engine, or starting to not treat HTML as a string in other ways. The problem is the knowledge and experience gap that is between a person, who can write a secure and useful plugin and a person, who starts writing plugins, because they are a WP user and got some motivation to start with plugin writing. PHP does nothing to reduce that gap. Another problem in Wordpress itself is, that its recommended or assumed theme architecture encourages concattenation instead of composition. HTML is again treated as a string, that is to be concattenated from smaller parts. Instead what any good templating engine would do is to have blocks of things, which you define elsewhere and keep every part independent. No stuff like head tag open in one document and closing it in another, making the parts not reusable. Most people creating themes do not even think about this stuff. They just go with whatever WP assumes them to do.
  - seanwilson 5y ago
    So I know you can add Blade or Twig templates on top of WordPress to at least make your own code contribution a bit better (e.g. at least some automatic escaping, saner templates), but at what point is it a lost cause and it's time to move to something with a better foundation? I've seen people use WordPress as a headless CMS but I don't think the admin interface is particular good either. > The problem is the knowledge and experience gap that is between a person, who can write a secure and useful plugin and a person, who starts writing plugins, because they are a WP user and got some motivation to start with plugin writing. PHP does nothing to reduce that gap. That's my feeling. Anybody used to working with secure and well written codebases with CD/CI, tests and just basic Git versioning will want to run away when they see how typical WordPress sites work under the hood.

kijin 5y ago

Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. IMO the problem with the plugin ecosystem is not that they're required, but that so much of the well-known plugins are bloated crap. Popular SEO plugins don't stop at inserting SEO tags into your <head>. They come with AMP integration, an online robots.txt editor, automatic content generator, competitor site analyzer, spam blocker, and even a rudimentary caching feature to speed up your site! Meanwhile, caching plugins offer to minify your javascript, photo galleries include a Stripe payment gateway, and contact forms come with their own markup language. Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. There are really neat plugins that do one thing, do it well, and are easy to audit. Sadly, they are buried under all the spammy alternatives. WordPress really needs to invest in a better plugin search & ranking system that discourages bloat and offers incentives for high-quality code, perhaps by integrating some sort of static analyzer.

seanwilson 5y ago
> Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. > ... Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. If these plugins were in core though, they'd likely have much better security and be less bloated. The problem with the plugin ecosystem you mention I think stems from monetization - there's the incentive to stuff freemium plugins with functionality so you can charge for paid features. I really don't know how WordPress can reign this in. I think the WordPress core that plugins build upon has bad security fundamentals as well e.g. the default PHP templating language doesn't even escape strings by default, most theme and plugin file permissions aren't locked down to read-only, Git-based versioning and deploys isn't built-in or widely practiced. > There are really neat plugins that do one thing, do it well, and are easy to audit. What plugins would you recommend? I find you can get pretty far with Advanced Custom Fields and an SEO plugin.
zelphirkalt 5y ago
There may be some neat plugins, which might work well, but the problem is, that the usual user, which Wordpress is targetting as audience, does not have the skills or knowledge to distinguish between crap plugins and plugins that work. When you find yourself fixing bugs in plugins or trying to unlimit their functionality, because in their design someone introduced an unnecessary limitation via the chosen primitives and abstractions, then you are already clearly above the level of skill or knowledge, that Wordpress targets and are able to use more advanced tools to better effect. Since Wordpress targets that not so experienced developer or simply hobby blogger audience and aims to make it simple for them to create a blog, that is also the group, from which most people arise to become plugin developers. That in turn leads to inexperienced developers using PHP, which has its own set of problems. For example treating HTML as a string by default, allowing for countless injection and XSS vulnerabilities. Or the incessant spam of PHP open and close "tags" in the code, intermingling PHP, HTML, CSS and JS in the same files, switching context so much, that, given a point in the code, you are no longer sure what context you are really in, instead of them using a proper template engine, or starting to not treat HTML as a string in other ways. The problem is the knowledge and experience gap that is between a person, who can write a secure and useful plugin and a person, who starts writing plugins, because they are a WP user and got some motivation to start with plugin writing. PHP does nothing to reduce that gap. Another problem in Wordpress itself is, that its recommended or assumed theme architecture encourages concattenation instead of composition. HTML is again treated as a string, that is to be concattenated from smaller parts. Instead what any good templating engine would do is to have blocks of things, which you define elsewhere and keep every part independent. No stuff like head tag open in one document and closing it in another, making the parts not reusable. Most people creating themes do not even think about this stuff. They just go with whatever WP assumes them to do.
- seanwilson 5y ago
  So I know you can add Blade or Twig templates on top of WordPress to at least make your own code contribution a bit better (e.g. at least some automatic escaping, saner templates), but at what point is it a lost cause and it's time to move to something with a better foundation? I've seen people use WordPress as a headless CMS but I don't think the admin interface is particular good either. > The problem is the knowledge and experience gap that is between a person, who can write a secure and useful plugin and a person, who starts writing plugins, because they are a WP user and got some motivation to start with plugin writing. PHP does nothing to reduce that gap. That's my feeling. Anybody used to working with secure and well written codebases with CD/CI, tests and just basic Git versioning will want to run away when they see how typical WordPress sites work under the hood.