Don't focus on the WordPress part, focus on the $HOSTED_BY_NOT_ME_SOLUTION part.
I can't do that. My customers come to me expecting a solution that isn't hacky and just "there". They expect a solution that solves their issues and not tacks on more issues.
I've never seen any good results come from someone doing the least amount of work possible by finding out of the box solutions that half ass most of the features the client wants.
But I have seen many customers come back repeatedly satisfied with their completely custom solution because it has what they want and not confusing or anything, because it's to their specifications.
If doing half-assed work to get the client out the door and a new one in is the best thing, than I'd rather not be "the best".
IME that is fairly common among developers, who after all got into this line of work because they like writing code, not configuring a web interface. So, many developers will tend toward solutions that involve them writing lots of their own code, especially if it involves using an interesting new technology or framework. "Yes, node + Angular would be the perfect stack for your small business brochure site."
But let's think about the probabilities here, keeping in mind the customer wants a CMS (as specified in the parent comment). Wordpress is used by about a quarter of websites. What are the chances that your client wants a CMS feature that no one else has ever thought of before?
It's pretty unlikely. With very rare exceptions, there is a plugin available for what your client wants. You might need to modify the template to get exactly the look you want, but the feature is available. And Wordpress is not the only popular open-source CMS either--there are plenty of options to meet your client's needs.
From your business perspective, using a popular open-source CMS increases your margins: you spend less time building for the same quality. From a security perspective, a popular open-source CMS is superior to your code because so many other people are trying to attack and defend it. From the client's perspective, a popular open-source CMS is more future-proof--they can fire you and easily find another vendor to take over management. Even better if it's a commercially hosted instance and they don't have to worry about hosting at all.
You usually end up struggling with sub par plug-ins and unintuitive UI's that are a nightmare for you and the customer potentially wasting more time doing that then doing a custom build.
The point is it takes a 10X programmer to recognize when a out of the box popular solution might not be the right choice for the customer.
I used to work in the hosting industry - the overwhelming majority of abuse reports against customers were from people who had installed wordpress and plugins and one of the plugins had a major security flaw, and then the customer was off to the races as part of a botnet or spamming.
So you now have to audit the plugins, you have to worry about future updates to those plugins introducing vulnerabilities, you have to worry about a plugin no longer being maintained and becoming obsolete, etc.
Is there a business case for WP and plugins? Certainly. But the blanket idea that you can just drop a PHP application on a server, install a bunch of plugins, and move on to your next more interesting project is extremely naive.
If you're writing a reasonably complex CMS, you will create security flaws you can fly a 747 through. This is doubly true if the CMS isn't the end goal and rather a necessary dependency for what's actually needed.
The only guard against security holes is battle-testing your code - Wordpress may not be the most secure thing in the world, but it's likely more secure than something you can whip up yourself in a jiffy.
Ditto maintenance and obsolescence - in fact this problem is probably worse for a homebrew solution than WP, since the number of people qualified to maintain this homebrew codebase is approximately one, whereas you can actually hire for WP plugin maintainers if you need to. Likewise, homebrewing your own solution and then moving onto the next project literally means it's not being maintained from day one, which is strictly worse than even a casually maintained plugin.
WP installs aren't always the right solution, nor is deploying some off the shelf code, but choosing to write your own code needs to pass a higher standard than is normally applied in most companies - it's silly to complain that some open source thing might stop being maintained when by default what you write yourself is also not actively maintained ;)
I certainly agree to a large extent, but there's a lot that mitigates this as well:
When it's code you write, you have control over feature creep, documentation, comments, etc.
If you write something that only does what you need, you reduce a lot of the attack surface vs. off the shelf plugins, and you are in a position to make sure that the code commented and well documented. You don't have that sort of quality control over a third party plugin, and you may down the line be in for a rude awakening when it's no longer developer and has a breaking problem, and you open it up and find the code is a completely undocumented mess from top to bottom.
Of course if you're rushing something out the door, you might not produce anything better - but if you're a software shop with solid engineers, you have a high chance of being able to get better quality code out there than a lot of WP plugins.
(That being said, WP today is a lot more secure itself than it was in the past - the right option might be not writing the CMS from scratch, but writing any plugins you need from scratch)
I mean for crying out loud, just installing Wordpress invites people trying to get in using automated tools. You can deploy a wordpress blog at it's default state, and wake up 3 days later to it being spammed.
Instead they use automated attacks to test any website directly for the most common errors. Understand that this is not limited to Wordpress. The types of vulnerabilities they test for are universal: password brute force, directory permissions, code injection, XSS, etc.
Sometimes one of these tests works, a site gets hacked, and then the developer has to a) recognize the site has been hacked, b) diagnose the problem, c) patch the hole, and d) recover the site.
For open-source projects like WordPress, the developer can then contribute the patch back to the community, and everyone else can pre-emptively fix their sites, even if they haven't been hacked yet. Bad guys also get these patches, and add automated attacks based on them. These are often what you see in WP logs, but such attacks are easily defeated by simply applying patches when they come out.
For custom-developed sites, you the developer must do all those steps by yourself, and yes that means you probably won't know about vulnerabilities until they are exploited.
I believe this is honestly true for most software. The longer something has been around the more hacks it will inevitably have in it. The projects I have seen that last the longest are the ones built with a solid, generic foundation capable of handling all types of requests with minimal user touch.
I am not necessarily saying all out of the box solutions do this well but certainly, most if not all off the shelf parts have been iterated more to hammer out bugs, security issues, get the feel right, etc. than your homegrown bit ever could.
I of course couldn't advocate that wordpress is the solution to everything but if it meets the customer's needs right now and will do so for the foreseeable future, I see no reason not to use a mature, existing framework.
If I as a client came to a company and said I wanted a CRM built for my company, and they gave me a Wordpress blog with a shitty CRM plugin, I'd request a refund and find someone who is actually going to build to my needs, and not hurry me through the tunnel to get my money and go onto someone else.
But I believe in quality over quantity. I'd rather spend time building a custom solution (Note, just because I am building a CRM doesn't mean I build the whole thing from the ground up, I use frameworks) that is going to make my client ecstatic and return again and again, than be like a friend's company. No good reviews. My current boss told me he had them make him a website few years ago. He said that lets just say he wouldn't be going back to them anytime soon. Why? Because they build EVERYTHING on WordPress.
Sure, but that sounds like a strawman. The lesson in the original post isn't about building EVERYTHING on WordPress. It's about knowing when to use existing tools and solutions instead of reinventing the wheel.
>>I'd rather spend time building a custom solution... that is going to make my client ecstatic and return again and again
It completely depends on the project. If it is for a mission-critical application that needs a lot of custom, well-designed features, building it yourself might make sense. Otherwise using something someone else has built is just as likely to make your client ecstatic because you just saved them a lot of money and time.
No, I tell them to pay for Salesforce, because I'm not going to build something as good as Salesforce in anything approaching a normal project's budget, and I introduce them to trusted Salesforce consultants I know. It's more important to me that they get the right thing rather than pay me to do the wrong thing. And if you are building a CRM, even with a "framework", for any sort of business under, say, ten thousand employees, it's very likely--not without exception, but I'm betting hard in this direction and I will very rarely lose--that you are not doing the right thing for your client.
The parent comment at the head of this subthread specified that the client wants a CMS. That's how we got on the topic of Wordpress to begin with.
I agree that Wordpress would be a terrible platform for building a CRM. But I am dubious that anyone needs a custom CRM. There are literally dozens of commercially available CRMs at all price points and industries.
My customers pay me for the features I am building all into this service... Not to charge them to hook a membership for another company up to it.
Then I have to provide support for Salesforce. Their service goes down, now I have my customers mad at me because part of my service is down.
No thanks.
https://en.wikipedia.org/wiki/Category:CRM_software_companie...
Giving the customer direct ownership of their CRM database is a feature, not a bug. They will benefit from a CRM development team who has dedicated experience and expertise in CRM, plus they'll benefit from the feature and security requests of the other CRM customers. And it will make them less dependent on you, specifically. Which, from the client's perspective, is a good thing.
Edit to add: what's more likely, that Salesforce goes down, or that you are unavailable for some reason?
No, you modify the template so it's not showing the stuff they don't want. Problem solved.
"If I as a client came to a company and said I wanted a CRM built for my company, and they gave me a Wordpress blog with a shitty CRM plugin, I'd request a refund and find someone who is actually going to build to my needs, and not hurry me through the tunnel to get my money and go onto someone else."
And if I was your boss, I'd fire you for wasting my money.
"But I believe in quality over quantity."
Nobody here is any different. The difference is that I don't think that the only one who can deliver quality is me.
"I'd rather spend time building a custom solution (Note, just because I am building a CRM doesn't mean I build the whole thing from the ground up, I use frameworks) that is going to make my client ecstatic and return again and again, than be like a friend's company."
And again, you're assuming that result isn't possible with an off the shelf solution.
SuiteCRM/SugarCRM
Salesforce
CiviCRM
vTiger
Insightly
Now figure out the integration between it and the WP site.
It also saves you lots of time that could be used on the features they actually do want.
Most clients just want a soluton that works
I suppose it does allow you to lock them in easier with a custom solution.
To add to this: Very old custom software located on internal systems is one thing, imagine if you are relying on 15 year old web-based software from a vendor that no longer exists. How do you protect that?