8 ms·

> Automattic CEO and WordPress co-creator Matt Mullenweg unleashed a scathing attack on a rival firm this week, calling WP Engine a “cancer to WordPress.” In m

> Automattic CEO and WordPress co-creator Matt Mullenweg unleashed a scathing attack on a rival firm this week, calling WP Engine a “cancer to WordPress.” In my experience, WordPress itself could be called a Cancer to the Web. The amount of new clients I've picked up who needed help rescuing broken and malware ridden WordPress sites is... well, it's more than I'd like as I really do not enjoy WordPress LOL

deleted 2y ago
[deleted]
arp242 2y ago
WordPress isn't that bad. Okay, the code is kinda messy in some places, but which 25 year old project isn't? And yes, in the early days it was cowboy coding, but those days have been over for more than 15 years. What "broken and malware ridden WordPress site" typically means is "customer installed a bunch of random plugins from random sites written by teenagers or bozos who don't know what they're doing". And yes, that can screw things up, but that's not really WordPress's fault IMHO. Maybe it can do more to protect users from this; I don't know. But obviously the plugin ecosystem is a hugely important part of the WordPress platform and you can't just lock that down technically. Just make sure you only install plugins from authors who aren't teenagers or bozos. I'll add that personally I don't especially like WordPress for various reasons. But at the same time I don't think this is really a fair criticism.
- chiefalchemist 2y ago
  The WP Community - as led by leadership (i.e., MM, Automattic, etc) is fond of bragging about the plugin and theme ecosystem. What they conveniently neglect to mention is how many are shite, many are ok but poorly coded, and only a very few are worth their weight. Even plenty of the premium plugins have performance issue, are sloppy, lack hooks, etc.
gjsman-1000 2y ago
And yet, reality is that for many companies, an off-the-shelf CMS is all they need, and all they can afford, and all they can figure out without hiring IT. Which means, if we want to kill WordPress, we need to offer a better solution. Not just for WordPress, but a coherent system that also reimplements the top hundred or so plugins. If anyone wants to join me rewriting it in Laravel so we could add a WSL-like layer for WordPress cancer plugins… I don’t know. I wish someone would have the conversation. I don’t even care whether it’s Rust.
- iambateman 2y ago
  Statamic for Laravel is pretty great for what it does. I wrote a WYSIWYG CMS for Laravel called Prodigy that I really enjoy but it hasn’t gotten much market pick up. There’s definitely some thinking in this area on how to move WP users toward Laravel.
  - gjsman-1000 2y ago
    Statamic is awesome; watching Jack McDade in person at Laracon last month was great. However, Statamic is not a WordPress replacement. We need a system that can be installed, with hundreds of themes and plugins available, without touching code. An open-source Squarespace, basically. Statamic has a role, but not as a WordPress replacement for most people unfortunately…
- bsder 2y ago
  > And yet, reality is that for many companies, an off-the-shelf CMS is all they need Except they don't. A static website would work for 99.9% of all businesses and could be hosted on a potato. The problem is that marketing wants a website that "Doesn't look embarassing and has 5 nines uptime." Translation: "Marketing wants a website that looks completely like our competitors(because reasons)! But make it completely different (because reasons)! And make sure it's on AWS (because reasons)!" Response from IT: "Our website results in zero revenue to the company and is a gigantic security problem and spam magnet. And because marketing is involved it's also a headache of a political football. Here's the WP Engine credentials. Now fuck off."
MathMonkeyMan 2y ago
I wonder to what extent that can be attributed to its ubiquity versus its quality. I've never worked with WordPress. For example, I notice that most of the automated "attacks" on my server are WordPress related. Is its defect rate significantly higher than other systems', or is it just that if you're going fishing you should bait for the most common fish? PHP and Apache come up a lot too.
- dylan604 2y ago
  It's like any other system designed to be used by people that are not technically savvy. Lots of things have default values that are not sane. That's why the script kiddies hit every server they can with known defaults and vulns. Otherwise, it's like any other publicly facing internet server in that it takes maintenance with patches and updates and being informed on what you're running and changes being made. So because the majority of users are not savvy, it's become a cesspool. Then you read about it on a tech forum like HN and it is derided as an inferior product rather than allowing improper use by the user/operator.
  - lnxg33k1 2y ago
    I've had an interview last week for a company doing WordPress stuff, and their tech lead, computer science guy, said their next project was a monitoring tool running unit tests in production to understand the health of the app It's not only the non-tech-savvy, even CS guys become trash when they go too close to WP
- smt88 2y ago
  > I wonder to what extent that can be attributed to its ubiquity versus its quality Its quality is astonishingly bad. It was clearly developed by someone who didn't even have a basic understanding of relational databases. Unless something has changed, plugins and themes can run arbitrary PHP on the server. Anything ubiquitous is going to be hated. I agree. But WordPress is bad from a fundamentals perspective.
  - joe_g_young 2y ago
econcon 2y ago
We had that problem in barebones WP with no plugins at all. Once we installed a few security plugins, it worked out just fine!
chris_wot 2y ago
I personally don't like block themes.
- lightlyused 2y ago
  Similar experience here. Poorly documented and inflexible.
theyknowitsxmas 2y ago
Yeah I run wp2static on clients, cancel the hosting then push the files to vercel/cloudflare pages/github pages. A PHP version is vulnerable. If you upgrade it, some plugin breaks. If you manually upgrade the offending plugin, the pesky developer now wants a subscription. Just a nono. I build on Hugo.
- anonzzzies 2y ago
  Many (some very large) companies would not allow that route; their marketing team is trained on wp and they specifically implemented it (in the EU this is per country generally) to sidestep the head office enterprise cms that is unusable and takes days of workflow steps to get anything published; they want more dynamic, not less and they want less techy not more.
  - theyknowitsxmas 2y ago
    Why? Hugo is Markdown, child's play. You can use GitHub as a CMS.
    - anonzzzies 2y ago
      Yes, I know, I use it too. But github is hardly usable by non technical users , nor is markdown. We are talking about marketing deps of billion$ companies.
    - joenot443 2y ago
      I think your question answers itself if you look from the perspective of a non-technical marketing person who's used to WYSIWYG tools, rather than a programmer who's reading a site called Hacker News.
    - vundercind 2y ago
      “I need to add an image gallery” “I need to add and edit multistep forms that send an email to me” “I need to change one of our social media links” That can be mostly or entirely self-serve for marketing folks on Wordpress, with all the work happening in their browser. Plus tons of other stuff.
breck 2y ago
I'd love to get your feedback on https://hub.scroll.pub/ https://hub.scroll.pub/. Create new sites in 0.1 seconds. No signup required. It's a new stack, but it's pretty revolutionary foundation, and as we get some good templates and imrpove the UX, I think it should bring a lot of joy to people who currently suffer with wordpress. It's all open source/public domain. Having started my programming career in Wordpress ~17 years ago, I have been able to take my favorite parts from it and get rid of all the annoying parts (like requiring a database, php/javascript hybrid, etc).
anonzzzies 2y ago
> as I really do not enjoy WordPress LOL me neither but it pays; when we get called, bad things already happened, so it's always an emergency which means we can ask for 400-500$/hr to fix it. And there are so many bad wp sites that we can retire on that alone. But let me tell you about OpenCart, Drupal, etc which also are all lovely targets and more niche so higher hourlies! As someone with a formal verification and static typing background, it is the most terrible crap there is, but it is very good business.
- DaiPlusPlus 2y ago
  > As someone with a formal verification and static typing background, it is the most terrible crap there is, but it is very good business. May I ask how you find this kind of work? The kinds of orgs with hacked/broken/incompetently-run WP installs don’t tend to be the type of orgs you’d find via professional networking, but by going through the dregs of Craigslist’s gigs pages, no?
- mmarian 2y ago
  Any recommendations on how you can find that kind of work? I'd personally enjoy it, but I don't know how to break into it without working as a WP dev at an unsustainably-low wage.
busterarm 2y ago
That's on the customers. I used to work at a shop that used WP and it was a huge force multiplier. We were WP Engine customers and at some point we moved to Pantheon.io and then we moved to a static site with an internal-only WP frontend for content editors. We had 2 developers, a PM, 20-30 content writers and $5B ARR. Websites were strictly for marketing/leadgen. Even when we switched to building a static site, we still had our content editors write markdown in WordPress because it was easier to do that and pull all of the content from the database on deploy than train them. The absolute worst part of being a WP Engine customer was being on Linode and the yearly Christmas Eve DDOS.
- andruby 2y ago
  > 2 developers, a PM, 20-30 content writers and $5B ARR Please tell me that these 30 people weren't the full company generating $5B in annually recurring revenue?
  - busterarm 2y ago
    No we had an army of call center folks, case managers, etc. But given the nature of the business there is no sales, only marketing generating revenue. Basically, no our marketing team didn't turn the coal into diamonds, but obtaining the coal was our team's primary function and 100% our output. We spent several hundred million annually on advertising (roughly the GDP of Tonga!).
- nottorp 2y ago
  > Websites were strictly for marketing/leadgen. So they weren't web sites but spam. What I'm curious about though is if your former workplace still exists or is now AI generating the spam...
  - manuelmoreale 2y ago
    That’s pretty unfair. Most of the work I do can be considered “marketing” since it’s corporate sites and portfolios. Businesses need to have an online presence of some sort and someone has to create one for them. Not everything is SEO spam.
sixtyj 2y ago
And so nice it looked at the beginning… Instead of WordPress, what solutions do you use? Wix, Squarespace, Webflow, Webnode and other wysiwyg ones are even worse imho. Are there any non-Nodejs or non-React open source CMS that don’t vendor lock you? Because I feel that WP somehow sucks in details and maintenance, but I can’t find anything comparable without being sucked into development hell. :) Thanks for suggestions.
- pjerem 2y ago
  Are the good old PHP CMS dead ? Things like Joomla, Dotclear, Drupal …
  - sixtyj 2y ago
    They are not dead. The reason why WP took web by storm and Joomla and Drupal became less visible is that WP did a lot of work in instant usability - their 2 minutes’ installation changed the game imho.
- manuelmoreale 2y ago
  After a few years building on WP I switched to https://getkirby.com/ https://getkirby.com/ and never looked back.
  - sixtyj 2y ago
    Thanks. It seems really good. PHP, files and folders instead of db, easy templating, plugins, admin interface built on Vue.js, open source at GitHub and a commercial license as well. Since 2012. The only issue is to have more themes available, at getkirby-themes_com there are 22 only.
    - manuelmoreale 2y ago
      Because it's not designed with a theme approach. It's designed to build custom sites. Themes aren't really a thing inside kirby because of the tight relationship between content itself and admin interface. I like to think at it as an in between something like Laravel and WordPress.

deleted 2y ago

[deleted]

arp242 2y ago

WordPress isn't that bad. Okay, the code is kinda messy in some places, but which 25 year old project isn't? And yes, in the early days it was cowboy coding, but those days have been over for more than 15 years. What "broken and malware ridden WordPress site" typically means is "customer installed a bunch of random plugins from random sites written by teenagers or bozos who don't know what they're doing". And yes, that can screw things up, but that's not really WordPress's fault IMHO. Maybe it can do more to protect users from this; I don't know. But obviously the plugin ecosystem is a hugely important part of the WordPress platform and you can't just lock that down technically. Just make sure you only install plugins from authors who aren't teenagers or bozos. I'll add that personally I don't especially like WordPress for various reasons. But at the same time I don't think this is really a fair criticism.

chiefalchemist 2y ago
The WP Community - as led by leadership (i.e., MM, Automattic, etc) is fond of bragging about the plugin and theme ecosystem. What they conveniently neglect to mention is how many are shite, many are ok but poorly coded, and only a very few are worth their weight. Even plenty of the premium plugins have performance issue, are sloppy, lack hooks, etc.

gjsman-1000 2y ago

And yet, reality is that for many companies, an off-the-shelf CMS is all they need, and all they can afford, and all they can figure out without hiring IT. Which means, if we want to kill WordPress, we need to offer a better solution. Not just for WordPress, but a coherent system that also reimplements the top hundred or so plugins. If anyone wants to join me rewriting it in Laravel so we could add a WSL-like layer for WordPress cancer plugins… I don’t know. I wish someone would have the conversation. I don’t even care whether it’s Rust.

iambateman 2y ago
Statamic for Laravel is pretty great for what it does. I wrote a WYSIWYG CMS for Laravel called Prodigy that I really enjoy but it hasn’t gotten much market pick up. There’s definitely some thinking in this area on how to move WP users toward Laravel.
- gjsman-1000 2y ago
  Statamic is awesome; watching Jack McDade in person at Laracon last month was great. However, Statamic is not a WordPress replacement. We need a system that can be installed, with hundreds of themes and plugins available, without touching code. An open-source Squarespace, basically. Statamic has a role, but not as a WordPress replacement for most people unfortunately…
bsder 2y ago
> And yet, reality is that for many companies, an off-the-shelf CMS is all they need Except they don't. A static website would work for 99.9% of all businesses and could be hosted on a potato. The problem is that marketing wants a website that "Doesn't look embarassing and has 5 nines uptime." Translation: "Marketing wants a website that looks completely like our competitors(because reasons)! But make it completely different (because reasons)! And make sure it's on AWS (because reasons)!" Response from IT: "Our website results in zero revenue to the company and is a gigantic security problem and spam magnet. And because marketing is involved it's also a headache of a political football. Here's the WP Engine credentials. Now fuck off."

MathMonkeyMan 2y ago

I wonder to what extent that can be attributed to its ubiquity versus its quality. I've never worked with WordPress. For example, I notice that most of the automated "attacks" on my server are WordPress related. Is its defect rate significantly higher than other systems', or is it just that if you're going fishing you should bait for the most common fish? PHP and Apache come up a lot too.

dylan604 2y ago
It's like any other system designed to be used by people that are not technically savvy. Lots of things have default values that are not sane. That's why the script kiddies hit every server they can with known defaults and vulns. Otherwise, it's like any other publicly facing internet server in that it takes maintenance with patches and updates and being informed on what you're running and changes being made. So because the majority of users are not savvy, it's become a cesspool. Then you read about it on a tech forum like HN and it is derided as an inferior product rather than allowing improper use by the user/operator.
- lnxg33k1 2y ago
  I've had an interview last week for a company doing WordPress stuff, and their tech lead, computer science guy, said their next project was a monitoring tool running unit tests in production to understand the health of the app It's not only the non-tech-savvy, even CS guys become trash when they go too close to WP
smt88 2y ago
> I wonder to what extent that can be attributed to its ubiquity versus its quality Its quality is astonishingly bad. It was clearly developed by someone who didn't even have a basic understanding of relational databases. Unless something has changed, plugins and themes can run arbitrary PHP on the server. Anything ubiquitous is going to be hated. I agree. But WordPress is bad from a fundamentals perspective.
- joe_g_young 2y ago

econcon 2y ago

We had that problem in barebones WP with no plugins at all. Once we installed a few security plugins, it worked out just fine!

chris_wot 2y ago

I personally don't like block themes.

lightlyused 2y ago
Similar experience here. Poorly documented and inflexible.

theyknowitsxmas 2y ago

Yeah I run wp2static on clients, cancel the hosting then push the files to vercel/cloudflare pages/github pages. A PHP version is vulnerable. If you upgrade it, some plugin breaks. If you manually upgrade the offending plugin, the pesky developer now wants a subscription. Just a nono. I build on Hugo.

anonzzzies 2y ago
Many (some very large) companies would not allow that route; their marketing team is trained on wp and they specifically implemented it (in the EU this is per country generally) to sidestep the head office enterprise cms that is unusable and takes days of workflow steps to get anything published; they want more dynamic, not less and they want less techy not more.
- theyknowitsxmas 2y ago
  Why? Hugo is Markdown, child's play. You can use GitHub as a CMS.
  - anonzzzies 2y ago
    Yes, I know, I use it too. But github is hardly usable by non technical users , nor is markdown. We are talking about marketing deps of billion$ companies.
  - joenot443 2y ago
    I think your question answers itself if you look from the perspective of a non-technical marketing person who's used to WYSIWYG tools, rather than a programmer who's reading a site called Hacker News.
  - vundercind 2y ago
    “I need to add an image gallery” “I need to add and edit multistep forms that send an email to me” “I need to change one of our social media links” That can be mostly or entirely self-serve for marketing folks on Wordpress, with all the work happening in their browser. Plus tons of other stuff.

breck 2y ago

I'd love to get your feedback on https://hub.scroll.pub/ https://hub.scroll.pub/. Create new sites in 0.1 seconds. No signup required. It's a new stack, but it's pretty revolutionary foundation, and as we get some good templates and imrpove the UX, I think it should bring a lot of joy to people who currently suffer with wordpress. It's all open source/public domain. Having started my programming career in Wordpress ~17 years ago, I have been able to take my favorite parts from it and get rid of all the annoying parts (like requiring a database, php/javascript hybrid, etc).

anonzzzies 2y ago

> as I really do not enjoy WordPress LOL me neither but it pays; when we get called, bad things already happened, so it's always an emergency which means we can ask for 400-500$/hr to fix it. And there are so many bad wp sites that we can retire on that alone. But let me tell you about OpenCart, Drupal, etc which also are all lovely targets and more niche so higher hourlies! As someone with a formal verification and static typing background, it is the most terrible crap there is, but it is very good business.

DaiPlusPlus 2y ago
> As someone with a formal verification and static typing background, it is the most terrible crap there is, but it is very good business. May I ask how you find this kind of work? The kinds of orgs with hacked/broken/incompetently-run WP installs don’t tend to be the type of orgs you’d find via professional networking, but by going through the dregs of Craigslist’s gigs pages, no?
mmarian 2y ago
Any recommendations on how you can find that kind of work? I'd personally enjoy it, but I don't know how to break into it without working as a WP dev at an unsustainably-low wage.

busterarm 2y ago

That's on the customers. I used to work at a shop that used WP and it was a huge force multiplier. We were WP Engine customers and at some point we moved to Pantheon.io and then we moved to a static site with an internal-only WP frontend for content editors. We had 2 developers, a PM, 20-30 content writers and $5B ARR. Websites were strictly for marketing/leadgen. Even when we switched to building a static site, we still had our content editors write markdown in WordPress because it was easier to do that and pull all of the content from the database on deploy than train them. The absolute worst part of being a WP Engine customer was being on Linode and the yearly Christmas Eve DDOS.

andruby 2y ago
> 2 developers, a PM, 20-30 content writers and $5B ARR Please tell me that these 30 people weren't the full company generating $5B in annually recurring revenue?
- busterarm 2y ago
  No we had an army of call center folks, case managers, etc. But given the nature of the business there is no sales, only marketing generating revenue. Basically, no our marketing team didn't turn the coal into diamonds, but obtaining the coal was our team's primary function and 100% our output. We spent several hundred million annually on advertising (roughly the GDP of Tonga!).
nottorp 2y ago
> Websites were strictly for marketing/leadgen. So they weren't web sites but spam. What I'm curious about though is if your former workplace still exists or is now AI generating the spam...
- manuelmoreale 2y ago
  That’s pretty unfair. Most of the work I do can be considered “marketing” since it’s corporate sites and portfolios. Businesses need to have an online presence of some sort and someone has to create one for them. Not everything is SEO spam.

sixtyj 2y ago

And so nice it looked at the beginning… Instead of WordPress, what solutions do you use? Wix, Squarespace, Webflow, Webnode and other wysiwyg ones are even worse imho. Are there any non-Nodejs or non-React open source CMS that don’t vendor lock you? Because I feel that WP somehow sucks in details and maintenance, but I can’t find anything comparable without being sucked into development hell. :) Thanks for suggestions.

pjerem 2y ago
Are the good old PHP CMS dead ? Things like Joomla, Dotclear, Drupal …
- sixtyj 2y ago
  They are not dead. The reason why WP took web by storm and Joomla and Drupal became less visible is that WP did a lot of work in instant usability - their 2 minutes’ installation changed the game imho.
manuelmoreale 2y ago
After a few years building on WP I switched to https://getkirby.com/ https://getkirby.com/ and never looked back.
- sixtyj 2y ago
  Thanks. It seems really good. PHP, files and folders instead of db, easy templating, plugins, admin interface built on Vue.js, open source at GitHub and a commercial license as well. Since 2012. The only issue is to have more themes available, at getkirby-themes_com there are 22 only.
  - manuelmoreale 2y ago
    Because it's not designed with a theme approach. It's designed to build custom sites. Themes aren't really a thing inside kirby because of the tight relationship between content itself and admin interface. I like to think at it as an in between something like Laravel and WordPress.