I think Wordpress gets a lot of unfair blame. I often see the size of its code-base touted as one of the reasons to avoid its use. It seems the general consensu

I think Wordpress gets a lot of unfair blame. I often see the size of its code-base touted as one of the reasons to avoid its use. It seems the general consensus amongst a lot of developers out there is that Wordpress isn't OOP. Seriously when was the last time someone building a Wordpress website had to do anything outside of the wp-content folder? I have been working with it for like 8 years now. I used it before it even had half the CMS features that it has now. Making Wordpress completely OOP isn't going to make it any better than it already is, nor will it make more people visit your website or make you breakfast in the morning. I don't care if the Wordpress code-base is a mixture of procedural and object-oriented PHP code, I use the hooks/actions system to change things, I never have a need to go into the wp-includes folder unless I am trying to work out how a new feature works that isn't fully documented (which is extremely rare). I also see people calling PHP a bad language because of the way Wordpress was built on-top of it, like some can't make the distinction between the language and the prolific CMS built on-top of it. When a Wordpress website gets hacked, you know who should also shoulder the blame? The developer that set it up and or the server admin that setup the server. If you're setting up Wordpress on a server that doesn't have the appropriate folder permissions set, the wp-config file moved back one level from root (and thus not publicly accessible), you're using the default "wp_" database table prefix and you use FTP to move files to and from the server because setting up SSH access intimidates you, then it is your fault as well. A properly secured Wordpress installation is very difficult to attack. Sure it doesn't protect you from all attack vectors, but it goes a long way. Making sure your username in Wordpress isn't admin always goes a long way. On all Wordpress sites that I monitor I see numerous brute force scripts being run trying to guess the password for a user named "admin" jokes on them, no such user even exists, so they just instantly IP banned (which is annoying because some seem to cycle through thousands of IP addresses). Running an old version of Wordpress and you get attacked, is it Wordpress' fault or your own? People love to bash Wordpress, but you want to know the harsh reality? There is no better alternative (trust me, I tried looking once, I legitimately spent weeks trying alternatives and found nothing better). Wordpress is the number #1 CMS because it is the best, regardless of its code-base, nothing else compares. Some people will try telling you to use Drupal, but they generally don't know what they are on about. "Oh, don't use Wordpress it gets hacked all of the time" - no, it doesn't. Your lack of technical competency is the reason you get hacked all of the time. A bad workman blames his tools. My personal blog gets 3k hits per day, I see numerous attempts to hack my site and in the 5 years I have been running Wordpress on my personal blog alone, I have never been successfully hacked once. Because I don't just set Wordpress up using the default settings, I use strong passwords, I use unique usernames, I lock file and folder permissions, I move credentials out of the root directory. Wordpress is slightly cursed in that it has a low learning curve, it makes it incredibly easy for just about anyone to setup their own self-hosted Wordpress installation. While exploits are not the users fault, a lot of the most common hacks you see on Wordpress were in part due to the fact the user kept a default setting or set something up incorrectly. The auto update functionality is great in Wordpress, I don't think this feature alone is a big selling point for the CMS. The auto-update functionality in Wordpress doesn't always work, but it is better than nothing. As the author points out, particular Drupal and Magento are both so complicated (even though they have clean code-bases) that they make it difficult to perform updates or do basic tasks people take for granted in Wordpress. Compared to the number of times I have been infected with malware and viruses over the years as a Windows user (many times due to my own fault), Wordpress does not even register on the Richter scale of insecurity and annoyance in comparison. Lets start taking responsibility for our own actions, developers. We can't blame PHP and Wordpress for all security issues. Somewhere along the line you need to make some effort and not assume a CMS or framework has your best interests at heart or has covered every possible angle.