4 ms·

For at least a decade it baffles me why do people still use WordPress, self-hosted especially (a dedicated team of professional webmasters working 24x7 has at l

For at least a decade it baffles me why do people still use WordPress, self-hosted especially (a dedicated team of professional webmasters working 24x7 has at least some chance to manage protecting it). To me that seems suicidal behavior.

blueflow 4y ago
Many customers just don't want to spend much money. Wordpress is still one of the big players for small dynamic websites, probably because they have a good range of plugins to integrate with other services.
_fat_santa 4y ago
It really comes down to price and ease of use. If you are non-technical and want a website/blog without going to Wix, Squarespace, etc. WP is the best game in town.
chomp 4y ago
Is there a better CMS? WordPress has a huge plugin ecosystem, a huge developer talent pool, and is relatively straightforward to use. It also costs nothing, which is important for overseas developers, and can be extremely cheap to host. It also (can be) very easy to use. Plugins and theme bundles can make this more complex, but it's easy enough to hand a properly secured and deployed WordPress to a marketing or media team and have them do 90% of the work, which is a win for dev and ops teams.
- sidewndr46 4y ago
  Are the developers really that talented? The only interesting news I see about WordPress is the latest vulnerability being exploited.
  - deleted 4y ago
    [deleted]
  - jraph 4y ago
    WordPress is huge, it represents a big chunk of the web. I've read from a quarter to a third, or even more. It's a good target. Of course we are going to hear about security vulnerabilities more for WordPress than for any other CMS. There is nothing specific to WordPress about the issue this post relates IIUC apart from the fact it is a privileged target. And there's no news when everything is fine, which is most of the time.
    - Tijdreiziger 4y ago
      Your estimate is low: it's actually 43%. https://w3techs.com/technologies/overview/content_management https://w3techs.com/technologies/overview/content_management
      - chomp 4y ago
        This aligns with the numbers we had when I worked at a large webhosting company.
  - kevincox 4y ago
    You can say basically the same about any popular system. Chrome, Windows, iOS all have regular vulnerabilities. Maybe the difference is that they have very strong forced patching, whereas there are enough WordPress installs that don't get critical patches for far too long.
    - sidewndr46 4y ago
      In all measures, Windows is a dumpster fire. Usability, security, stability, etc. So what is your argument here? That Wordpress is at least as bad as a popular OS? I don't know enough about iOS to comment.
      - kevincox 4y ago
        My point is that all popular software is a security nightmare because our industry sucks at security. Anything that is a high value attack target gets pwned. Very little software appears to be actually secure. Maybe OpenSSH is on that short list, but even that has occasional problems. But for it's attack value the known vulnerabilities seem low.
- rwmj 4y ago
  It was the plugin ecosystem that got my website hacked. A plugin that I'd briefly installed to test, thought I had removed, but was somehow still there on disk.
- rglover 4y ago
  I no longer use it actively but CraftCMS was good to me for several years: https://craftcms.com/ https://craftcms.com/
FrenchDevRemote 4y ago
Well if your budget is nothing, and you have the technical skills of a rock, wordpress doesn't seems like the worst option the cost of getting your wordpress hacked for seo spam is not much for a business that don't have any sensitive data on wordpress(not that they even take it into account...)
prepend 4y ago
I’ve run it for 10+ years without any problems of note. Nothing massive, but a few thousand monthly users. It auto installs through cpanel and has always had an admin password. It’s actually really easy for non-professional webmasters to self host and saving $10-???/month on hosting fees is nice.
jacooper 4y ago
Its not that bad. WordPress is great for people who don't know how to code and just want to make a website, yes if you just want a blog you can do that with Hugo(but you need to know git and CI/CD and pages hosting etc..) But anything more advanced would be best on WordPress, its very easy to use and is extremely popular so you can find guides anywhere. There is yet to be any CMS which has the ease of use and capability of WordPress and its plugins. Unfortunately with it being that easy users are often not very security savvy and don't update plugins/themes and end up getting hacked.
jraph 4y ago
Well, it's easy to use for users, it maintains itself for the most part and doesn't break compatibility. It is also easy to setup. And to customize. It provides many tools out of the box, including though you would not think. An example that surprised me is the automatic addition of lazy loading for images at some point when browsers started supporting it natively without any intervention from me, which is very good. With a caching plugin it's as fast as a static website most of the time, which gets me 100% on Page Speed Insight, and the hosting is on a domestic connection. I've made sure to not use too many extensions and javascript-heavy things, to disable some stuff and avoid huge assets but I've not spent that much effort on it. I've been maintaining a few WordPress websites since 2015 and I would chose WordPress again today for any new site on which non technical people must intervene (to write or manage content). It just works and is user friendly. I'm not sure any CMS would save you if you don't do your security homework though.
TAKEMYMONEY 4y ago
It's feature-rich and has a huge ecosystem of plugins and developers. This specific vuln is related to the fact that every install uses /wp-admin/install.php for initial setup. You don't need a "dedicated team" to protect yourself from that.

blueflow 4y ago

Many customers just don't want to spend much money. Wordpress is still one of the big players for small dynamic websites, probably because they have a good range of plugins to integrate with other services.

_fat_santa 4y ago

It really comes down to price and ease of use. If you are non-technical and want a website/blog without going to Wix, Squarespace, etc. WP is the best game in town.

chomp 4y ago

Is there a better CMS? WordPress has a huge plugin ecosystem, a huge developer talent pool, and is relatively straightforward to use. It also costs nothing, which is important for overseas developers, and can be extremely cheap to host. It also (can be) very easy to use. Plugins and theme bundles can make this more complex, but it's easy enough to hand a properly secured and deployed WordPress to a marketing or media team and have them do 90% of the work, which is a win for dev and ops teams.

sidewndr46 4y ago
Are the developers really that talented? The only interesting news I see about WordPress is the latest vulnerability being exploited.
- deleted 4y ago
  [deleted]
- jraph 4y ago
  WordPress is huge, it represents a big chunk of the web. I've read from a quarter to a third, or even more. It's a good target. Of course we are going to hear about security vulnerabilities more for WordPress than for any other CMS. There is nothing specific to WordPress about the issue this post relates IIUC apart from the fact it is a privileged target. And there's no news when everything is fine, which is most of the time.
  - Tijdreiziger 4y ago
    Your estimate is low: it's actually 43%. https://w3techs.com/technologies/overview/content_management https://w3techs.com/technologies/overview/content_management
    - chomp 4y ago
      This aligns with the numbers we had when I worked at a large webhosting company.
- kevincox 4y ago
  You can say basically the same about any popular system. Chrome, Windows, iOS all have regular vulnerabilities. Maybe the difference is that they have very strong forced patching, whereas there are enough WordPress installs that don't get critical patches for far too long.
  - sidewndr46 4y ago
    In all measures, Windows is a dumpster fire. Usability, security, stability, etc. So what is your argument here? That Wordpress is at least as bad as a popular OS? I don't know enough about iOS to comment.
    - kevincox 4y ago
      My point is that all popular software is a security nightmare because our industry sucks at security. Anything that is a high value attack target gets pwned. Very little software appears to be actually secure. Maybe OpenSSH is on that short list, but even that has occasional problems. But for it's attack value the known vulnerabilities seem low.
rwmj 4y ago
It was the plugin ecosystem that got my website hacked. A plugin that I'd briefly installed to test, thought I had removed, but was somehow still there on disk.
rglover 4y ago
I no longer use it actively but CraftCMS was good to me for several years: https://craftcms.com/ https://craftcms.com/

FrenchDevRemote 4y ago

Well if your budget is nothing, and you have the technical skills of a rock, wordpress doesn't seems like the worst option the cost of getting your wordpress hacked for seo spam is not much for a business that don't have any sensitive data on wordpress(not that they even take it into account...)

prepend 4y ago

I’ve run it for 10+ years without any problems of note. Nothing massive, but a few thousand monthly users. It auto installs through cpanel and has always had an admin password. It’s actually really easy for non-professional webmasters to self host and saving $10-???/month on hosting fees is nice.

jacooper 4y ago

Its not that bad. WordPress is great for people who don't know how to code and just want to make a website, yes if you just want a blog you can do that with Hugo(but you need to know git and CI/CD and pages hosting etc..) But anything more advanced would be best on WordPress, its very easy to use and is extremely popular so you can find guides anywhere. There is yet to be any CMS which has the ease of use and capability of WordPress and its plugins. Unfortunately with it being that easy users are often not very security savvy and don't update plugins/themes and end up getting hacked.

jraph 4y ago

Well, it's easy to use for users, it maintains itself for the most part and doesn't break compatibility. It is also easy to setup. And to customize. It provides many tools out of the box, including though you would not think. An example that surprised me is the automatic addition of lazy loading for images at some point when browsers started supporting it natively without any intervention from me, which is very good. With a caching plugin it's as fast as a static website most of the time, which gets me 100% on Page Speed Insight, and the hosting is on a domestic connection. I've made sure to not use too many extensions and javascript-heavy things, to disable some stuff and avoid huge assets but I've not spent that much effort on it. I've been maintaining a few WordPress websites since 2015 and I would chose WordPress again today for any new site on which non technical people must intervene (to write or manage content). It just works and is user friendly. I'm not sure any CMS would save you if you don't do your security homework though.

TAKEMYMONEY 4y ago

It's feature-rich and has a huge ecosystem of plugins and developers. This specific vuln is related to the fact that every install uses /wp-admin/install.php for initial setup. You don't need a "dedicated team" to protect yourself from that.