6 ms·

Yes. Keep the real application on a subdomain, and make your marketing website a simple wordpress install. Minimal effort, and works great if you don't care abo

Yes. Keep the real application on a subdomain, and make your marketing website a simple wordpress install. Minimal effort, and works great if you don't care about authorization / integration between the two.

kerblang 3y ago
Worked at a company that combined the two, which eventually led to half the dev team working for... the marketing dept. It was a horrible mess.
- anotherhue 3y ago
  Yup, I've seen that. Catastrophic.
- ssss11 3y ago
  Reminds me of when IT reported to Supply Chain in a company I was at. For some strange reason supporting supply chain systems and initiatives made up 60% of our work…
  - ethbr0 3y ago
    To be fair, Supply Chain is 60% of a lot of companies' value.
    - ssss11 3y ago
      This was retail so we also had all the POS store systems, finance systems of course, payroll, collaboration (email, SharePoint and so on..)
      - ethbr0 3y ago
        I figured it was retail from the capital letters. ;) And not diminishing the other components, but my understanding of retail at scale from working corporate for a moment shifted to "Supply Chain is where profit is made or lost: everything else is follow-through."
- hoofhearted 3y ago
  Thank you for validating my comment above Kerblang! I have experienced this myself personally, and have contracted with numerous companies who ran into the same issue. The biggest issue I ran into was when the dev department started to not care about the WP instance because they don't work for marketing, and the marketing department failed to report one of their accounts was hacked, and a plugin was taken over :(
- cosmodisk 3y ago
  This is poor business management and has nothing to do with the technologies at hand. If a company has a software product but the devs can be pulled into ' let's fix this button on our contact form' anytime, then it's simply mismanaged.
daveslash 3y ago
Yes. Put the Wordpress on a completely separate server so the WordPress instance is properly firewalled from your main application/database. But don't leave it on a subdomain -- set up a reverse proxy so you can route to a subdirectory on your main domain. Better SEO. I'm not an SEO hawk, but if the point of Wordpress is marketing, then it's important. Edit: All good replies regarding cookies. Thank you for the correction. It is not "properly firewalled". The server side code is on a different machine, but this doesn't get you "proper firewall".
- chadd 3y ago
  this is dangerous because then a rogue piece of content in your wordpress instance can exfiltrate user cookies. subdomains are much safer, if worse for SEO.
- vermilingua 3y ago
  And then a malicious/compromised plugin has access to your primary sites cookies. I think that’d be worse for SEO.
  - jansommer 3y ago
    Couldn't one set the path of cookies to be for your app? Then a malicious plugin shouldn't be able to read your apps cookies, since they won't be sent to Wordpress
  - danielheath 3y ago
    Most web frameworks use encrypted cookie storage by now, right? Without the server key those cookies are useless.
    - sznio 3y ago
      Not if someone takes the cookie and just passes it back to the app from their own browser to steal someone's authentication.
- hobobaggins 3y ago
hoofhearted 3y ago
Nope, I do not recommend this. This is not really a safe and scalable solution for startups anymore. In your scenario, the app developers create something that gains traction. But they have not spent any time writing guides, docs, or any sort of marketing content. They are only worried about their app code, and someone else will fix the tech debt eventually when they set up the WordPress blog site on a sub domain. If the devs ever reach that point in success, they have now created a silo between the main app, and the WordPress instance. They two apps usually run out of sync in consistency and feel, and factioned teams form around who works within the app, and who works within WP on the content. The two teams eventually get out of sync, and the users never get the basic info they need to use your app. Then when nobody is paying attention, someone takes advantage of a vulnerabilty in a dumb WP plugin, and they spam your blog site with porn links and offensive content. Now you have to handle damage control, and closing the hole and erasing the content. The only successful YC company in recent history I have seen pull this off is OpenSea, but I'm not even sure what they are up to today. To the contrary, launching a startup is: 20% writing code. 80% writing docs, guides, and marketing content. Further to the contrary, I have found that the most successful YC companies and products all started their code products with documentation. Stripe and Shopify both launched, and immediately started building out user guides and marketing content. The common denominator between Stripe and Laravel at launch was users commenting how easy their product was to use, and how complete and simple their documentation was to understand. These companies didn't wait to find a content solution, they started writing their content alongside their code since day 1.
- clintonb 3y ago
  It’s pretty easy to point <hostname>/docs to an appropriate server. This is literally what Stripe does. There is no need to merge the marketing site with the API or docs.
  - hoofhearted 3y ago
    I don't think that is how Stripe is doing it. The React app code is baked into their docs seamlessly, it's not two different things. I have researched this to get the definitive, but it's difficult to find out what Stripe is using exactly. They are 100% generating their content statically though, and their user docs are dynamic with data.

kerblang 3y ago

Worked at a company that combined the two, which eventually led to half the dev team working for... the marketing dept. It was a horrible mess.

anotherhue 3y ago
Yup, I've seen that. Catastrophic.
ssss11 3y ago
Reminds me of when IT reported to Supply Chain in a company I was at. For some strange reason supporting supply chain systems and initiatives made up 60% of our work…
- ethbr0 3y ago
  To be fair, Supply Chain is 60% of a lot of companies' value.
  - ssss11 3y ago
    This was retail so we also had all the POS store systems, finance systems of course, payroll, collaboration (email, SharePoint and so on..)
    - ethbr0 3y ago
      I figured it was retail from the capital letters. ;) And not diminishing the other components, but my understanding of retail at scale from working corporate for a moment shifted to "Supply Chain is where profit is made or lost: everything else is follow-through."
hoofhearted 3y ago
Thank you for validating my comment above Kerblang! I have experienced this myself personally, and have contracted with numerous companies who ran into the same issue. The biggest issue I ran into was when the dev department started to not care about the WP instance because they don't work for marketing, and the marketing department failed to report one of their accounts was hacked, and a plugin was taken over :(
cosmodisk 3y ago
This is poor business management and has nothing to do with the technologies at hand. If a company has a software product but the devs can be pulled into ' let's fix this button on our contact form' anytime, then it's simply mismanaged.

daveslash 3y ago

Yes. Put the Wordpress on a completely separate server so the WordPress instance is properly firewalled from your main application/database. But don't leave it on a subdomain -- set up a reverse proxy so you can route to a subdirectory on your main domain. Better SEO. I'm not an SEO hawk, but if the point of Wordpress is marketing, then it's important. Edit: All good replies regarding cookies. Thank you for the correction. It is not "properly firewalled". The server side code is on a different machine, but this doesn't get you "proper firewall".

chadd 3y ago
this is dangerous because then a rogue piece of content in your wordpress instance can exfiltrate user cookies. subdomains are much safer, if worse for SEO.
vermilingua 3y ago
And then a malicious/compromised plugin has access to your primary sites cookies. I think that’d be worse for SEO.
- jansommer 3y ago
  Couldn't one set the path of cookies to be for your app? Then a malicious plugin shouldn't be able to read your apps cookies, since they won't be sent to Wordpress
- danielheath 3y ago
  Most web frameworks use encrypted cookie storage by now, right? Without the server key those cookies are useless.
  - sznio 3y ago
    Not if someone takes the cookie and just passes it back to the app from their own browser to steal someone's authentication.
hobobaggins 3y ago

hoofhearted 3y ago

Nope, I do not recommend this. This is not really a safe and scalable solution for startups anymore. In your scenario, the app developers create something that gains traction. But they have not spent any time writing guides, docs, or any sort of marketing content. They are only worried about their app code, and someone else will fix the tech debt eventually when they set up the WordPress blog site on a sub domain. If the devs ever reach that point in success, they have now created a silo between the main app, and the WordPress instance. They two apps usually run out of sync in consistency and feel, and factioned teams form around who works within the app, and who works within WP on the content. The two teams eventually get out of sync, and the users never get the basic info they need to use your app. Then when nobody is paying attention, someone takes advantage of a vulnerabilty in a dumb WP plugin, and they spam your blog site with porn links and offensive content. Now you have to handle damage control, and closing the hole and erasing the content. The only successful YC company in recent history I have seen pull this off is OpenSea, but I'm not even sure what they are up to today. To the contrary, launching a startup is: 20% writing code. 80% writing docs, guides, and marketing content. Further to the contrary, I have found that the most successful YC companies and products all started their code products with documentation. Stripe and Shopify both launched, and immediately started building out user guides and marketing content. The common denominator between Stripe and Laravel at launch was users commenting how easy their product was to use, and how complete and simple their documentation was to understand. These companies didn't wait to find a content solution, they started writing their content alongside their code since day 1.

clintonb 3y ago
It’s pretty easy to point <hostname>/docs to an appropriate server. This is literally what Stripe does. There is no need to merge the marketing site with the API or docs.
- hoofhearted 3y ago
  I don't think that is how Stripe is doing it. The React app code is baked into their docs seamlessly, it's not two different things. I have researched this to get the definitive, but it's difficult to find out what Stripe is using exactly. They are 100% generating their content statically though, and their user docs are dynamic with data.