The idea of tons of 3rd-party plugins, with WordPress and also Drupal, is just disastrous for security. Anyone with any ability to write a little PHP would be

The idea of tons of 3rd-party plugins, with WordPress and also Drupal, is just disastrous for security. Anyone with any ability to write a little PHP would be far far better off building their site in a CMS like ProcessWire [1], which has a very small core, but a extremely powerful content (PHP) API [2], which means you can replicate pretty much everything you have in Wordpress and Drupal with a few API calls in your templates. This means you build your listing and presentation-logic custom made with the minimal amount of code needed, and the attack vector shrinks to pretty much nothing, as long as you don't voluntarily do something stupid. [1] https://processwire.com/ https://processwire.com/ [2] https://cheatsheet.processwire.com/ https://cheatsheet.processwire.com/