3 ms·

There are two types of WordPress sites from my perspective as someone who got their start in webdev in that ecosystem. The first and arguably largest is exactl

There are two types of WordPress sites from my perspective as someone who got their start in webdev in that ecosystem. The first and arguably largest is exactly what you describe. Little sites for small businesses who just want an online presence and maybe to facilitate some light duty business development with a small webshop or forum. These sites are done by fly by night marketers who are also hawking SEO optimization and ads on Facebook and they’ll host your site for the low low price of $100/mo while dodging your phone calls when the godaddy $5/mo plan they are actually hosting your site on shits the bed. The second, and more influential group of WordPress users, are very large organizations who publish a lot of content and need something that is flexible, reasonably scalable and cheap to hire developers for. Universities love WP because they can setup multisite and give every student in every class a website with some basic plugins and then it’s handsoff. Go look at the logo list for WordPress VIP to see what media organizations are powered by WP. Legit newsrooms run on mostly stock WP backends but with their own designers and some custom publishing workflows. These two market segments are so far apart though that it creates a lot of division and friction from lots of different angles. Do you cater to the small businesses and just accept that they’ll outgrow the platform someday? Or do you build stuff that makes the big publishers happy because the pay for most of the engineering talent working on the open source project more generally? And all that while maintaining backwards compatibility and somewhat trying to keep up with modern-ish practices (they did adopt React after all). WordPress is weird and in no way a monoculture is what I guess I’m trying to say.

transcriptase 6mo ago
I have no idea if it’s still true but it used to be the case that you had 3 choices with a Wordpress install and even a couple plugins: 1) Have a part time job updating it and plugins, making sure you weren’t introducing vulns at every step 2) Leave it as is and hope that no vulns are discovered for your particular version or plugin versions 3) Have things auto-update and pray that your plugins don't get sold or compromised and backdoor your site
- wolrah 6mo ago
  4) Don't use a stack of plugins, if you must use any keep them as dumb as possible and stick to those with a longstanding reputation. A basic instance, set to auto-update, installed on a shared webhost where OS/web server updates are someone else's problem is pretty foolproof. A VPS running a long-term distro set to auto update is almost as good. --- That said I personally dropped Wordpress for static site generation years ago because I realized I didn't actually need any of the dynamic features and wasn't using the WYSIWYG editor. Now I write Markdown in to a file in a git repo and then trigger a regeneration whenever I update it.
  - mort96 6mo ago
    Sure, that's possible, but so much of the value of Wordpress is in the plugins.

transcriptase 6mo ago

I have no idea if it’s still true but it used to be the case that you had 3 choices with a Wordpress install and even a couple plugins: 1) Have a part time job updating it and plugins, making sure you weren’t introducing vulns at every step 2) Leave it as is and hope that no vulns are discovered for your particular version or plugin versions 3) Have things auto-update and pray that your plugins don't get sold or compromised and backdoor your site

wolrah 6mo ago
4) Don't use a stack of plugins, if you must use any keep them as dumb as possible and stick to those with a longstanding reputation. A basic instance, set to auto-update, installed on a shared webhost where OS/web server updates are someone else's problem is pretty foolproof. A VPS running a long-term distro set to auto update is almost as good. --- That said I personally dropped Wordpress for static site generation years ago because I realized I didn't actually need any of the dynamic features and wasn't using the WYSIWYG editor. Now I write Markdown in to a file in a git repo and then trigger a regeneration whenever I update it.
- mort96 6mo ago
  Sure, that's possible, but so much of the value of Wordpress is in the plugins.