7 ms·

The only people I know who hate Wordpress are the developers who have had the misfortune of having to manage an instance of Wordpress. All the marketing and con

The only people I know who hate Wordpress are the developers who have had the misfortune of having to manage an instance of Wordpress. All the marketing and content people I have worked with love it.

code_runner 4y ago
The matches my experience. They can manage whatever web of crazy they want in Wordpress… if they need something from the dev side we can play with some plugins until it works. Sometimes the answer is “oh god we can’t do that”… and that seemed to be ok if we had some alternatives
technion 4y ago
You can add to that "people who manage web hosting servers". Across our fleet, disabling hacked instances is a routine event. There is often a marketing person that wants to argue - according to their industry, WordPress is leading the security space. It's incredible how different industries view the product.
- ratww 4y ago
  > according to their industry, WordPress is leading the security space It's not the marketing industry. It's just that some people have this tendency of conflating popularity with supreme quality. "It can't be bad if it's popular". Specialists in the marketing industry knows very well that outdated Wordpress is a minefield.
- rhd 4y ago
  And SOC/CSIRT folks. A staggering amount of incidents involve an external wordpress install used as free real estate by threat actors in some way (e.g. phishing kit, malware infra).
peckrob 4y ago
I've done some Wordpress consulting work in the past. I wouldn't say I hate Wordpress. I advocate for it's use in some cases! I think it is a fantastic piece of software for what it natively does. You want a blogging platform? Wordpress is one of the best, hands down. You want a basic CMS that is so dead simple that anyone that can use a word processor can update the website? Wordpress excels at this, because that is what it was designed to do. But I do think it is a poor solution in a lot of cases where it has been shoehorned into. People keep grafting so much extra, unnecessary crap onto what is still, at it's core, a blogging platform. Often this is done by low-skill, low-paid "consultants" with very little experience in writing maintainable, secure code. Literally all they know how to do is write Wordpress code. I would often end up having to clean up the mess from these folks, who often still write PHP like it's 2007 and they haven't learned better [0]. Wordpress's architecture has, until relatively recently, encouraged this behavior. Their stubborn refusal to move beyond PHP 5 for many years (and continuing to support absolutely ancient versions of PHP 5 at that!) held their entire ecosystem back from writing better, more secure code for a long, long time. And, more broadly, held PHP as a whole back, as they were among its largest players. It was really hard to make the case for hosts to upgrade PHP when Wordpress still supported whatever ancient version of PHP the host was providing. Their internal architecture can be very messy in places and documentation often contradictory about what the "correct" or even preferred way to do something is because there are multiple ways implemented at different times. I will give them credit: Wordpress itself doesn't have too many gaping security holes anymore. Most of those has been patched. It's the plugins and themes that provide the attack surface now. The public plugins themselves (and to a lesser extent the themes) are of such widely variable quality that it is difficult to know what to use and trust. You're probably okay with the "official" plugins and most of the widely-installed third party plugins, but you get too far off the beaten path, you find a lot of garbage (and, to be fair, a few gems as well). And any custom plugin I find is immediately suspect for the reasons above. Building a theme? Which of these multiple ways of user customization do you support? All of them? None of them? Or do you just write your own customization further messing up the UX for writers and editors who have little idea how to manage Wordpress beyond the very basics of writing a post. Oftentimes when I would come into a Wordpress case, there's 30 or so plugins installed, half of which are disabled and you have no idea what is causing the client's problem. It takes a few hours just to untangle the mess, and you can't ask the last "consultant" because they wrote garbage code, threw it over the wall and disappeared. It's the reason I usually don't take Wordpress cases anymore unless it's someone I know or an installation I did, myself, from scratch that hasn't been messed with by anyone else. Wordpress is a great blogging platform and basic CMS. It's when people start trying to make it do things beyond this that problems start to accrue. I don't hate Wordpress. I hate what people try to do with it. When Wordpress is your hammer, everything looks like a custom post type. [0] https://phptherightway.com/ https://phptherightway.com/
- nukst 4y ago
  Thank you peckrob, this was very insightful. Let me be a SOB for a second and ask for your opinion. I'm interested in freelancing with WordPress, mostly small company websites, would you still recommend it for someone who's just getting in the market? TIA
  - peckrob 4y ago
    Not a bad question at all. It's all about what the client needs. The advice I give on this subject these days is that Wordpress is fine to use for a blog or a very basic, low traffic read-only company websites. Think like a small restaurant or something. The two things to be aware of: 1. Somebody has to support it, whether that be you or someone who comes after you. While Wordpress doesn't have as many security issues in and of itself as it used to, it still does have some occasionally and will still need to be patched up to more recent versions. Security vulnerabilities in Wordpress are almost immediately exploited, so the sooner you patch, the better. 2. The minute you start trying to push Wordpress beyond the bounds of being a basic CMS or blogging platform (like adding online ordering, inventory management, etc.) you are better off finding other, better suited options.
    - nukst 4y ago
      Once again, thank you! This aligns very well with what a few friends pointed out about this matter.
    - exodust 4y ago
      > (like adding online ordering, inventory management, etc.) you are better off finding other, better suited options. What better suited options? And why are they better for someone's small business or intention to sell a few products? To be fair, the "online ordering" part is handled by services such as Paypal and Stripe. Wordpress is not doing the heavy lifting. Inventory is just a bunch of products sitting in the database. I'm not sure it's fair to describe this as "pushing beyond the bounds of a blogging platform". At the end of the day, you get a new item in the Wordpress admin "products". Click that, add products, enter prices. Is it ideal? No. But what platform is that is affordable and predictable?
pluc 4y ago
WordPress is stupid easy to wrangle into what you want it to. That's the best thing about it and the worst, because you have a bunch of people who have no idea what they're doing doing high-profile things. As a freelancer, WordPress paid for my house. Naysayers are just elitists without a cause.
nr2x 4y ago
Wordpress code base is the best argument for the MVC design pattern specifically because it shows what goes wrong when you toss the idea of encapsulation out the window.
- lucideer 4y ago
  I wouldn't specifically say "MVC"; one could argue it's the best argument for many design patterns or QA approaches, as it flagrantly ignores all of them.
  - nr2x 4y ago
    Lol, fair - it’s basically spaghetti code
rubyist5eva 4y ago
I have a good friend who basically makes his living off of wordpress development and consulting. He hates WP but makes a solid living.
- aaaaaaaaata 4y ago
  Can you get him to comment on what he charges, even if it's a range? Also: Is he taking new contracts? =]
jillesvangurp 4y ago
This. I have a sales person and a designer that maintain our Wordpress instance. I login to the admin panel once every few months. Mostly these people do everything by themselves. Among the things they've done recently: - a major web site redesign (custom styling and look) - added translations (via a plugin) - updated how we gather analytics - added a hubspot integration I don't know many platforms where that can happen without technical people getting involved. All the next best options are SAAS platforms like shopify, squarespace, hubspot, etc. None of us have any php skills (well, I deny having them and tend to not touch it). It's not perfect. But it's there and it works. For me the main value is that it can do what it does without me needing to be involved. We spend a few days setting it up at some point and making sure it gets updates. That's it. It's not surprising wordpress market share is declining. I'd actually recommend new companies to pick one of the SAAS options. Even with wordpress, getting somebody else to host it for you is probably wise (there are a few good companies in this space).
agumonkey 4y ago
I wonder how the code looks like. Back in pre PHP5 days, it was surprisingly painful to read their docs (globals and side effects) and plugins source was just shocking. Angry 17yo levels of dirt loc (and that's insulting to 17yo)
- aliswe 4y ago
  the source code is the worst part of it all.
  - agumonkey 4y ago
    Surprisingly pentesters i work with say the core is not too bad
    - jorams 4y ago
      The core is not too bad in the sense that it's stable, well-maintained, and mostly well-documented. The online code reference is also pretty great. The quality of the code is otherwise atrocious. Nobody should look at WordPress for any sort of guidance on what good code looks like.
lucideer 4y ago
The other cohort of people who hate Wordpress are marketing/content people who've had the pleasure of using an install that lacks full-time developer maintenance for long enough for it to break, and being "stuck" with that breakage (or, worse, wading into the freelance market trying to find someone to fix it without a scratch rewrite).
ubermonkey 4y ago
...which is sort of like saying "the only people who hate Wordpress are the people who have to use it." It's legit AWFUL. It's a reasonable blog engine, sure, but it's been forced into being a general CMS, and it was never built for that. Our corp site is on it, and I fucking HATE it (fortunately I rarely have to deal with it). My personal blog (21 years old and counting) has been through a bunch of platforms (Blogger, Greymatter, Blosxom) before settling on Wordpress. As I said, as a blogging tool, it's mostly fine. I don't really HATE it there, but it's still too fiddly for my tastes.

The only people I know who hate Wordpress are the developers who have had the misfortune of having to manage an instance of Wordpress. All the marketing and content people I have worked with love it.

code_runner 4y ago

The matches my experience. They can manage whatever web of crazy they want in Wordpress… if they need something from the dev side we can play with some plugins until it works. Sometimes the answer is “oh god we can’t do that”… and that seemed to be ok if we had some alternatives

technion 4y ago

You can add to that "people who manage web hosting servers". Across our fleet, disabling hacked instances is a routine event. There is often a marketing person that wants to argue - according to their industry, WordPress is leading the security space. It's incredible how different industries view the product.

ratww 4y ago
> according to their industry, WordPress is leading the security space It's not the marketing industry. It's just that some people have this tendency of conflating popularity with supreme quality. "It can't be bad if it's popular". Specialists in the marketing industry knows very well that outdated Wordpress is a minefield.
rhd 4y ago
And SOC/CSIRT folks. A staggering amount of incidents involve an external wordpress install used as free real estate by threat actors in some way (e.g. phishing kit, malware infra).

peckrob 4y ago

I've done some Wordpress consulting work in the past. I wouldn't say I hate Wordpress. I advocate for it's use in some cases! I think it is a fantastic piece of software for what it natively does. You want a blogging platform? Wordpress is one of the best, hands down. You want a basic CMS that is so dead simple that anyone that can use a word processor can update the website? Wordpress excels at this, because that is what it was designed to do. But I do think it is a poor solution in a lot of cases where it has been shoehorned into. People keep grafting so much extra, unnecessary crap onto what is still, at it's core, a blogging platform. Often this is done by low-skill, low-paid "consultants" with very little experience in writing maintainable, secure code. Literally all they know how to do is write Wordpress code. I would often end up having to clean up the mess from these folks, who often still write PHP like it's 2007 and they haven't learned better [0]. Wordpress's architecture has, until relatively recently, encouraged this behavior. Their stubborn refusal to move beyond PHP 5 for many years (and continuing to support absolutely ancient versions of PHP 5 at that!) held their entire ecosystem back from writing better, more secure code for a long, long time. And, more broadly, held PHP as a whole back, as they were among its largest players. It was really hard to make the case for hosts to upgrade PHP when Wordpress still supported whatever ancient version of PHP the host was providing. Their internal architecture can be very messy in places and documentation often contradictory about what the "correct" or even preferred way to do something is because there are multiple ways implemented at different times. I will give them credit: Wordpress itself doesn't have too many gaping security holes anymore. Most of those has been patched. It's the plugins and themes that provide the attack surface now. The public plugins themselves (and to a lesser extent the themes) are of such widely variable quality that it is difficult to know what to use and trust. You're probably okay with the "official" plugins and most of the widely-installed third party plugins, but you get too far off the beaten path, you find a lot of garbage (and, to be fair, a few gems as well). And any custom plugin I find is immediately suspect for the reasons above. Building a theme? Which of these multiple ways of user customization do you support? All of them? None of them? Or do you just write your own customization further messing up the UX for writers and editors who have little idea how to manage Wordpress beyond the very basics of writing a post. Oftentimes when I would come into a Wordpress case, there's 30 or so plugins installed, half of which are disabled and you have no idea what is causing the client's problem. It takes a few hours just to untangle the mess, and you can't ask the last "consultant" because they wrote garbage code, threw it over the wall and disappeared. It's the reason I usually don't take Wordpress cases anymore unless it's someone I know or an installation I did, myself, from scratch that hasn't been messed with by anyone else. Wordpress is a great blogging platform and basic CMS. It's when people start trying to make it do things beyond this that problems start to accrue. I don't hate Wordpress. I hate what people try to do with it. When Wordpress is your hammer, everything looks like a custom post type. [0] https://phptherightway.com/ https://phptherightway.com/

nukst 4y ago
Thank you peckrob, this was very insightful. Let me be a SOB for a second and ask for your opinion. I'm interested in freelancing with WordPress, mostly small company websites, would you still recommend it for someone who's just getting in the market? TIA
- peckrob 4y ago
  Not a bad question at all. It's all about what the client needs. The advice I give on this subject these days is that Wordpress is fine to use for a blog or a very basic, low traffic read-only company websites. Think like a small restaurant or something. The two things to be aware of: 1. Somebody has to support it, whether that be you or someone who comes after you. While Wordpress doesn't have as many security issues in and of itself as it used to, it still does have some occasionally and will still need to be patched up to more recent versions. Security vulnerabilities in Wordpress are almost immediately exploited, so the sooner you patch, the better. 2. The minute you start trying to push Wordpress beyond the bounds of being a basic CMS or blogging platform (like adding online ordering, inventory management, etc.) you are better off finding other, better suited options.
  - nukst 4y ago
    Once again, thank you! This aligns very well with what a few friends pointed out about this matter.
  - exodust 4y ago
    > (like adding online ordering, inventory management, etc.) you are better off finding other, better suited options. What better suited options? And why are they better for someone's small business or intention to sell a few products? To be fair, the "online ordering" part is handled by services such as Paypal and Stripe. Wordpress is not doing the heavy lifting. Inventory is just a bunch of products sitting in the database. I'm not sure it's fair to describe this as "pushing beyond the bounds of a blogging platform". At the end of the day, you get a new item in the Wordpress admin "products". Click that, add products, enter prices. Is it ideal? No. But what platform is that is affordable and predictable?

pluc 4y ago

WordPress is stupid easy to wrangle into what you want it to. That's the best thing about it and the worst, because you have a bunch of people who have no idea what they're doing doing high-profile things. As a freelancer, WordPress paid for my house. Naysayers are just elitists without a cause.

nr2x 4y ago

Wordpress code base is the best argument for the MVC design pattern specifically because it shows what goes wrong when you toss the idea of encapsulation out the window.

lucideer 4y ago
I wouldn't specifically say "MVC"; one could argue it's the best argument for many design patterns or QA approaches, as it flagrantly ignores all of them.
- nr2x 4y ago
  Lol, fair - it’s basically spaghetti code

rubyist5eva 4y ago

I have a good friend who basically makes his living off of wordpress development and consulting. He hates WP but makes a solid living.

aaaaaaaaata 4y ago
Can you get him to comment on what he charges, even if it's a range? Also: Is he taking new contracts? =]

jillesvangurp 4y ago

This. I have a sales person and a designer that maintain our Wordpress instance. I login to the admin panel once every few months. Mostly these people do everything by themselves. Among the things they've done recently: - a major web site redesign (custom styling and look) - added translations (via a plugin) - updated how we gather analytics - added a hubspot integration I don't know many platforms where that can happen without technical people getting involved. All the next best options are SAAS platforms like shopify, squarespace, hubspot, etc. None of us have any php skills (well, I deny having them and tend to not touch it). It's not perfect. But it's there and it works. For me the main value is that it can do what it does without me needing to be involved. We spend a few days setting it up at some point and making sure it gets updates. That's it. It's not surprising wordpress market share is declining. I'd actually recommend new companies to pick one of the SAAS options. Even with wordpress, getting somebody else to host it for you is probably wise (there are a few good companies in this space).

agumonkey 4y ago

I wonder how the code looks like. Back in pre PHP5 days, it was surprisingly painful to read their docs (globals and side effects) and plugins source was just shocking. Angry 17yo levels of dirt loc (and that's insulting to 17yo)

aliswe 4y ago
the source code is the worst part of it all.
- agumonkey 4y ago
  Surprisingly pentesters i work with say the core is not too bad
  - jorams 4y ago
    The core is not too bad in the sense that it's stable, well-maintained, and mostly well-documented. The online code reference is also pretty great. The quality of the code is otherwise atrocious. Nobody should look at WordPress for any sort of guidance on what good code looks like.

lucideer 4y ago

The other cohort of people who hate Wordpress are marketing/content people who've had the pleasure of using an install that lacks full-time developer maintenance for long enough for it to break, and being "stuck" with that breakage (or, worse, wading into the freelance market trying to find someone to fix it without a scratch rewrite).

ubermonkey 4y ago

...which is sort of like saying "the only people who hate Wordpress are the people who have to use it." It's legit AWFUL. It's a reasonable blog engine, sure, but it's been forced into being a general CMS, and it was never built for that. Our corp site is on it, and I fucking HATE it (fortunately I rarely have to deal with it). My personal blog (21 years old and counting) has been through a bunch of platforms (Blogger, Greymatter, Blosxom) before settling on Wordpress. As I said, as a blogging tool, it's mostly fine. I don't really HATE it there, but it's still too fiddly for my tastes.