12 ms·

WordPlate: WordPress on Composer with sensible defaults

71 points by nedp 4y ago

tiger_hoods8 4y ago
[dead]
noeltock 4y ago
Congrats on releasing, we built something similar (WP/composer) for our stack, you can see the details here: https://docs.altis-dxp.com/getting-started/ https://docs.altis-dxp.com/getting-started/
jpoesen 4y ago
What advantages does WordPlate have over Bedrock[1], some of whose packages WordPlate also uses? [1] https://roots.io/bedrock/ https://roots.io/bedrock/
- e12e 4y ago
  Found some discussion here, but tbh it's a little light for me not to think that NIH syndrome doesn't come into it? https://github.com/vinkla/wordplate/issues/234 https://github.com/vinkla/wordplate/issues/234
luckylion 4y ago
I always wonder, at what point is it easier to just ditch Wordpress completely and instead spend the time to add an admin theme that looks & behaves like it for familiarity of users, and maybe add whatever magic functions your favorite framework might be missing. This isn't a critique, I use WP intensively, and we heavily modify and extend it as well, but the familiarity of the team (in dev, seo and content) is pretty much the only selling point, because we shut down most extra features (feeds, rpc, json-rpc, emojis, gutenberg, comments etc etc etc), use a complex varnish-setup, do image optimization etc outside of it and most plugins aren't really good, so we roll out something custom instead. Getting rid of it it isn't an option for us because we're so committed and have built so much custom stuff around it, but with a green field, I'm not sure.
- noeltock 4y ago
  I think you answered your own question, the familiarity for users (seo & content) which is "end-to-end no-code" is massive (especially once extended with user-facing plugins). And you're not even speaking about making the move to Gutenberg yet. Just too much value there.
  - luckylion 4y ago
    Yeah, certainly, but that's what I meant to address by making your framework's backend look & feel like WP and adding e.g. shortcodes to it and having a media library that works the same way (but doesn't suffer from WP's clunky bolted-on attachment). Gutenberg isn't a thing for the folks I work with, nobody there likes freedom (freedom only leads to errors!), everything is form-based (ACF is slow but it works, and here, too, it's not users setting up the fields, it's developers) with a few shortcodes to pull in special elements. I'm not complaining, I like building tools and solving problems and using WP allows for plenty of both, but in hindsight WP is slowing us down, I believe. Of course, it's hard to predict the scale of things when you start, so having something you can quickly iterate with is useful.
  - minusf 4y ago
    what familiarity? every single plugin's dashboard/admin page looks completely different.
    - tehbeard 4y ago
      Somewhat of a facetious argument, like saying the posts and site settings pages look completely different. It's not to say there aren't some that say sod it and have their own UI library. But quite a few leverage wordpress admin styles and conventions (such as the wp_list_table). But the quality is all over the place, much like with composer packages.
9dev 4y ago
Just reading this again gives me a backflash of the horrors of working with WordPress. If you haven’t seen the source, you don’t know just how god-awful the code is - and it just won’t die, because of all the ecosystem traction it has. Even the PHP developers have chosen to ignore WordPress in language evolution considerations, as the WordPress community refuses to do accept kind of progress for their project - they still use the unsafe, outdated mysql-API without parametrised queries, for example. Whatever you do in 2023—if you can avoid it, don’t use WordPress as a CMS.
- mpol 4y ago
  WordPress uses the PHP-mysqli extension. The PHP-mysql extension is unused since WordPress 3.9, quite some years ago. You might mean PHP-pdo is advised. Can you explain why it is better in this regard? Also $wpdb->prepare() uses parametrised values. Not everywhere in WordPress core is it being used. Most plugins use it for direct queries (not that common), but I don't know if the plugin team refuses plugins when they are not using it.
  - 9dev 4y ago
    Read this article for a primer on why PDO is a vastly better choice: https://phpdelusions.net/pdo#why https://phpdelusions.net/pdo#why And the fact that it’s 2023 and we’re somehow ok with the biggest web application there is not using parametrised queries in its core completely stumps me. Time and time again, SQL injection attacks in Wordpress or it’s plugins pop up. PDO with parametrised queries simply eliminates this issue.
    - luckylion 4y ago
      > PDO with parametrised queries simply eliminates this issue. True, but plugin authors not caring about using them is the primary issue, and that doesn't change just because wpdb uses a different API under the hood.
      - 9dev 4y ago
        No, but nobody will encourage them to. Wordpress has fostered an ecosystem of bad practices that is mostly resistant to change.
eisa01 4y ago
Wow, Wordpress still use MD5 hashes for passwords? That's really taking backward compatibility with old PHP versions too far! https://github.com/roots/wp-password-bcrypt#readme https://github.com/roots/wp-password-bcrypt#readme https://core.trac.wordpress.org/ticket/21022 https://core.trac.wordpress.org/ticket/21022
- iLoveOncall 4y ago
  It's not about backwards compatibility. It's about sheer incompetence of the WordPress developers. I have never seen such a badly coded mess. I ask every downvoter to prove me wrong. I'm sure none of them have ever seen any piece of WordPress code (or documentation, or anything else).
- jeroenhd 4y ago
  Assuming you use unique passwords for your services, I think the crackability of a password isn't too big of a risk. You need to find a password dump somewhere for a specific website. I'd wager that most WordPress instances have only a few (if more than one) users in their database, you won't easily find a WordPress dump with a million passwords in it. With an admin password you can probably upload some executable code, but if you can find a database dump online I doubt you'll have too much effort exploiting a WordPress plugin anyway.
  - 9dev 4y ago
    You do realise 70% of the web is powered by Wordpress, including huge communities and platforms? That most people do not, in fact, use unique passwords per service? That password dumps are easy to find online? That haveibeenpwnd is a thing? Just because Wordpress plugins are notoriously bad quality, you absolutely shouldn’t be lax with password security.
Neil44 4y ago
A lot of this seems to be change for change’s sake. Creating something non standard for anyone used to working with wordpress for no big benefit. The main benefit of wordpress is the compatibility and the number of people who know it inside out. To be honest it smells like a project by a bored agency wordpress dev who would rather eat their own head than code another custom theme so spent a few weeks throwing this up instead. Every big wordpress agency has devs like this.
- permarad 4y ago
  This is exactly my thoughts when I came to my current agency and they used bedrock. It was way more complexity and hassle than help.
Brendinooo 4y ago
Favoriting this for any possible WP project in the future, thanks. Would want to take a closer look to see how it compares to stuff like Roots’ Sage project. I’m glad I’ve been able to develop on https://wagtail.org/ https://wagtail.org/ for the past few years though. Usually such a pleasure to work with.
iambateman 4y ago
Adding composer to WordPress isn’t gong to fix it. The problem is more fundamental - WP was conceived as a blog engine and has proven itself constitutionally incapable of truly moving beyond that frame. * features People say that “you can just add a plug-in” for whatever, and that’s true. But so many things that should be core are not (advanced custom fields, forms) and other features have no place in modern WordPress (comments). Gutenberg is an incomplete answer to page builders. While the page builders are impressive, they still have a pretty substantial learning curve. * cost I’ve been using WordPress for over a decade and it’s fallen woefully behind other CMS’s. Recently I spun up a site for a client and the plug-ins cost over $1000 just to get them going. That isn’t _WordPress’s_ fault, but it doesn’t help. * speed WordPress inexplicably gets slow after about a year unless it’s managed by someone with masters-degree level skill. It’s like the system gets tired. The caching plug-ins help, but why doesn’t WordPress offer better caching itself? * deploying Recently, I decided I’d had enough. I was doing a one-day build for a small marketing site and it took two hours to deploy because the “yoast” plug-in broke the WP CLI’s ability to search and replace the database for URL’s. Not to mention that source control is a nightmare because people can install their own plug-ins from the dashboard. I’m writing an open source visual page builder for Laravel. It fixes the problems I see with WordPress for building marketing sites. Think of it as a blend between the visual ease of Webflow and the programmatic power of Laravel. By default, it’ll run off of SQLite (but any sql db will work), so they’re awe only two things living outside source control - the SQLite database and the uploads folder. That makes managing transitions from dev to production an absolute breeze. I’m very excited about it! It should be ready for beta testing in a few weeks…if anyone wants to give it a shot, let me know.
- kokolores 4y ago
  Sounds like you're building exactly what I'm currently looking for. I'd love to give it a shot as soon as your beta is ready.
  - iambateman 4y ago
    Shoot me an email - Stephen@bate-man.com and I’ll add you to the list!
montroser 4y ago
WordPress is plain crazy. Marketing people insisted on WordPress so we reluctantly put it off in its own isolated network and expected bad things to happen. And, they did... - WordPress consultant hired by marketing people while "editing the theme" introduced an infinite loop which caused OOM killer. That's when we learned you can point-click your way to editing actual php code in the admin web interface! Complete and total chaos and anarchy. - Content manager "upgraded the SEO plugin" which downloaded from the Internet some hot-new code which used some language features beyond the version of php we were running, and bam, the whole thing was 500s, and everyone freaked out! - Content people messed up the syntax editing the theme trying to change contact info in the footer, site wouldn't load anymore, they panicked and reverted the whole theme back to the stock default, and then ops people had to help them resurrect from the daily git check-in of the 1gb docroot they set up after the last time this happened. It's a rough ride all around...
- noeltock 4y ago
  Why do you give non-devs the ability to upgrade PHP plugins and edit theme syntax, shouldn't that be the site admin handling? Why are you not using staging to test? These don't seem like WP problems :/
  - bottled_poe 4y ago
    For better or worse, part of the appeal of Wordpress is ease of use for non-developers to update their website. Most small businesses definitely don’t employ a dedicated site admin/developer - if they had to they wouldn’t bother with a website. In fact, it looks like that’s the way things are going - pushing small businesses into walled gardens like FB, Insta, Wix, etc. And I don’t blame them, that’s probably the right decision for most businesses.
    - gnz11 4y ago
      "part of the appeal of Wordpress is ease of use for non-developers to update their website." Seems like in every HN thread regarding Wordpress this is brought up, but later the thread fills up with horror stories of sites being melted down when non-technical users are left to manage these Wordpress sites. Just my two cents, but that supposed benefit of Wordpress seems more like wishful thinking.
pacifika 4y ago
Why remove RSS? It’s one of the best features.
MonaroVXR 4y ago
Any alternatives for Wordpress?
- lukeholder 4y ago
  Yes many. Craft CMS. Statamic. Expression Engine.
Lucitabee46 4y ago
[dead]
Infamousxwho70 4y ago
[dead]
Arcadezwade22 4y ago
[dead]
Gameclord34 4y ago
[dead]
givemethrill09 4y ago
[dead]
givemethrill09 4y ago
[dead]
ruggedhuman3 4y ago
[dead]
out_lurking4 4y ago
[dead]
imma_adonis1 4y ago
[dead]
corden_kimmel1 4y ago
[dead]

71 points by nedp 4y ago

[dead]

Congrats on releasing, we built something similar (WP/composer) for our stack, you can see the details here: https://docs.altis-dxp.com/getting-started/ https://docs.altis-dxp.com/getting-started/

jpoesen 4y ago

What advantages does WordPlate have over Bedrock[1], some of whose packages WordPlate also uses? [1] https://roots.io/bedrock/ https://roots.io/bedrock/

e12e 4y ago
Found some discussion here, but tbh it's a little light for me not to think that NIH syndrome doesn't come into it? https://github.com/vinkla/wordplate/issues/234 https://github.com/vinkla/wordplate/issues/234

luckylion 4y ago

I always wonder, at what point is it easier to just ditch Wordpress completely and instead spend the time to add an admin theme that looks & behaves like it for familiarity of users, and maybe add whatever magic functions your favorite framework might be missing. This isn't a critique, I use WP intensively, and we heavily modify and extend it as well, but the familiarity of the team (in dev, seo and content) is pretty much the only selling point, because we shut down most extra features (feeds, rpc, json-rpc, emojis, gutenberg, comments etc etc etc), use a complex varnish-setup, do image optimization etc outside of it and most plugins aren't really good, so we roll out something custom instead. Getting rid of it it isn't an option for us because we're so committed and have built so much custom stuff around it, but with a green field, I'm not sure.

noeltock 4y ago
I think you answered your own question, the familiarity for users (seo & content) which is "end-to-end no-code" is massive (especially once extended with user-facing plugins). And you're not even speaking about making the move to Gutenberg yet. Just too much value there.
- luckylion 4y ago
  Yeah, certainly, but that's what I meant to address by making your framework's backend look & feel like WP and adding e.g. shortcodes to it and having a media library that works the same way (but doesn't suffer from WP's clunky bolted-on attachment). Gutenberg isn't a thing for the folks I work with, nobody there likes freedom (freedom only leads to errors!), everything is form-based (ACF is slow but it works, and here, too, it's not users setting up the fields, it's developers) with a few shortcodes to pull in special elements. I'm not complaining, I like building tools and solving problems and using WP allows for plenty of both, but in hindsight WP is slowing us down, I believe. Of course, it's hard to predict the scale of things when you start, so having something you can quickly iterate with is useful.
- minusf 4y ago
  what familiarity? every single plugin's dashboard/admin page looks completely different.
  - tehbeard 4y ago
    Somewhat of a facetious argument, like saying the posts and site settings pages look completely different. It's not to say there aren't some that say sod it and have their own UI library. But quite a few leverage wordpress admin styles and conventions (such as the wp_list_table). But the quality is all over the place, much like with composer packages.

9dev 4y ago

Just reading this again gives me a backflash of the horrors of working with WordPress. If you haven’t seen the source, you don’t know just how god-awful the code is - and it just won’t die, because of all the ecosystem traction it has. Even the PHP developers have chosen to ignore WordPress in language evolution considerations, as the WordPress community refuses to do accept kind of progress for their project - they still use the unsafe, outdated mysql-API without parametrised queries, for example. Whatever you do in 2023—if you can avoid it, don’t use WordPress as a CMS.

mpol 4y ago
WordPress uses the PHP-mysqli extension. The PHP-mysql extension is unused since WordPress 3.9, quite some years ago. You might mean PHP-pdo is advised. Can you explain why it is better in this regard? Also $wpdb->prepare() uses parametrised values. Not everywhere in WordPress core is it being used. Most plugins use it for direct queries (not that common), but I don't know if the plugin team refuses plugins when they are not using it.
- 9dev 4y ago
  Read this article for a primer on why PDO is a vastly better choice: https://phpdelusions.net/pdo#why https://phpdelusions.net/pdo#why And the fact that it’s 2023 and we’re somehow ok with the biggest web application there is not using parametrised queries in its core completely stumps me. Time and time again, SQL injection attacks in Wordpress or it’s plugins pop up. PDO with parametrised queries simply eliminates this issue.
  - luckylion 4y ago
    > PDO with parametrised queries simply eliminates this issue. True, but plugin authors not caring about using them is the primary issue, and that doesn't change just because wpdb uses a different API under the hood.
    - 9dev 4y ago
      No, but nobody will encourage them to. Wordpress has fostered an ecosystem of bad practices that is mostly resistant to change.

eisa01 4y ago

Wow, Wordpress still use MD5 hashes for passwords? That's really taking backward compatibility with old PHP versions too far! https://github.com/roots/wp-password-bcrypt#readme https://github.com/roots/wp-password-bcrypt#readme https://core.trac.wordpress.org/ticket/21022 https://core.trac.wordpress.org/ticket/21022

iLoveOncall 4y ago
It's not about backwards compatibility. It's about sheer incompetence of the WordPress developers. I have never seen such a badly coded mess. I ask every downvoter to prove me wrong. I'm sure none of them have ever seen any piece of WordPress code (or documentation, or anything else).
jeroenhd 4y ago
Assuming you use unique passwords for your services, I think the crackability of a password isn't too big of a risk. You need to find a password dump somewhere for a specific website. I'd wager that most WordPress instances have only a few (if more than one) users in their database, you won't easily find a WordPress dump with a million passwords in it. With an admin password you can probably upload some executable code, but if you can find a database dump online I doubt you'll have too much effort exploiting a WordPress plugin anyway.
- 9dev 4y ago
  You do realise 70% of the web is powered by Wordpress, including huge communities and platforms? That most people do not, in fact, use unique passwords per service? That password dumps are easy to find online? That haveibeenpwnd is a thing? Just because Wordpress plugins are notoriously bad quality, you absolutely shouldn’t be lax with password security.

Neil44 4y ago

A lot of this seems to be change for change’s sake. Creating something non standard for anyone used to working with wordpress for no big benefit. The main benefit of wordpress is the compatibility and the number of people who know it inside out. To be honest it smells like a project by a bored agency wordpress dev who would rather eat their own head than code another custom theme so spent a few weeks throwing this up instead. Every big wordpress agency has devs like this.

permarad 4y ago
This is exactly my thoughts when I came to my current agency and they used bedrock. It was way more complexity and hassle than help.

Brendinooo 4y ago

Favoriting this for any possible WP project in the future, thanks. Would want to take a closer look to see how it compares to stuff like Roots’ Sage project. I’m glad I’ve been able to develop on https://wagtail.org/ https://wagtail.org/ for the past few years though. Usually such a pleasure to work with.

iambateman 4y ago

Adding composer to WordPress isn’t gong to fix it. The problem is more fundamental - WP was conceived as a blog engine and has proven itself constitutionally incapable of truly moving beyond that frame. * features People say that “you can just add a plug-in” for whatever, and that’s true. But so many things that should be core are not (advanced custom fields, forms) and other features have no place in modern WordPress (comments). Gutenberg is an incomplete answer to page builders. While the page builders are impressive, they still have a pretty substantial learning curve. * cost I’ve been using WordPress for over a decade and it’s fallen woefully behind other CMS’s. Recently I spun up a site for a client and the plug-ins cost over $1000 just to get them going. That isn’t _WordPress’s_ fault, but it doesn’t help. * speed WordPress inexplicably gets slow after about a year unless it’s managed by someone with masters-degree level skill. It’s like the system gets tired. The caching plug-ins help, but why doesn’t WordPress offer better caching itself? * deploying Recently, I decided I’d had enough. I was doing a one-day build for a small marketing site and it took two hours to deploy because the “yoast” plug-in broke the WP CLI’s ability to search and replace the database for URL’s. Not to mention that source control is a nightmare because people can install their own plug-ins from the dashboard. I’m writing an open source visual page builder for Laravel. It fixes the problems I see with WordPress for building marketing sites. Think of it as a blend between the visual ease of Webflow and the programmatic power of Laravel. By default, it’ll run off of SQLite (but any sql db will work), so they’re awe only two things living outside source control - the SQLite database and the uploads folder. That makes managing transitions from dev to production an absolute breeze. I’m very excited about it! It should be ready for beta testing in a few weeks…if anyone wants to give it a shot, let me know.

kokolores 4y ago
Sounds like you're building exactly what I'm currently looking for. I'd love to give it a shot as soon as your beta is ready.
- iambateman 4y ago
  Shoot me an email - Stephen@bate-man.com and I’ll add you to the list!

montroser 4y ago

WordPress is plain crazy. Marketing people insisted on WordPress so we reluctantly put it off in its own isolated network and expected bad things to happen. And, they did... - WordPress consultant hired by marketing people while "editing the theme" introduced an infinite loop which caused OOM killer. That's when we learned you can point-click your way to editing actual php code in the admin web interface! Complete and total chaos and anarchy. - Content manager "upgraded the SEO plugin" which downloaded from the Internet some hot-new code which used some language features beyond the version of php we were running, and bam, the whole thing was 500s, and everyone freaked out! - Content people messed up the syntax editing the theme trying to change contact info in the footer, site wouldn't load anymore, they panicked and reverted the whole theme back to the stock default, and then ops people had to help them resurrect from the daily git check-in of the 1gb docroot they set up after the last time this happened. It's a rough ride all around...

noeltock 4y ago
Why do you give non-devs the ability to upgrade PHP plugins and edit theme syntax, shouldn't that be the site admin handling? Why are you not using staging to test? These don't seem like WP problems :/
- bottled_poe 4y ago
  For better or worse, part of the appeal of Wordpress is ease of use for non-developers to update their website. Most small businesses definitely don’t employ a dedicated site admin/developer - if they had to they wouldn’t bother with a website. In fact, it looks like that’s the way things are going - pushing small businesses into walled gardens like FB, Insta, Wix, etc. And I don’t blame them, that’s probably the right decision for most businesses.
  - gnz11 4y ago
    "part of the appeal of Wordpress is ease of use for non-developers to update their website." Seems like in every HN thread regarding Wordpress this is brought up, but later the thread fills up with horror stories of sites being melted down when non-technical users are left to manage these Wordpress sites. Just my two cents, but that supposed benefit of Wordpress seems more like wishful thinking.