Hacker News Reader

Comment by forinti | Hacker News Reader

I don't like PHP or MySQL, but WP is a pretty decent piece of software.

As someone who has been using WordPress since 2006, my brain exploded when I saw this.

WordPress has always been an absolute mess. The basic architecture was insane even in the early 2000s. There is no effective sandbox for plugins or themes, and you can't really make serious use of WordPress without those.

Nowadays, there are so many better applications that accomplish the same thing, and they aren't stuck on a half-baked database schema from 2003, they can be version-controlled, multiple people can work on them at the same time...

WordPress is one of the worst widely used pieces of software on the web. It is a catastrophe.

What are good alternatives these days that have as much flexibility?

Wagtail [0]

[0] https://wagtail.io/

Wagtail requires tens of hours of development to achieve WordPress's stock functionality, and there are very few plugins.

The CMS space is incredibly crowded. The vast majority of WordPress websites would be cheaper, faster, and more secure if they were just moved to SquareSpace, which has the WordPress features that 99% of sites would need.

For more custom projects, I prefer the headless variety[1] because it makes sense to separate the data and presentation layers. That means you have the full ecosystem and flexibility of HTML/CSS/JS.

Ghost[2] was the first serious competitor I saw years ago. Gatsby is among the most popular these days[3].

But honestly, information sites should just use SquareSpace or something like it. There's no reason to maintain static site infrastructure at this point.

1. https://jamstack.org/

2. https://ghost.org/

3. https://www.gatsbyjs.com/

If we're starting to compare to hosted offers, then hosted WordPress (WP.org or any other managed host that curates access to plugins/themes) surely needs to be added back to the list?

For enterprise level stuff, Drupal. Drupal development is a pain in the ass, but it's incredibly powerful, has a great community, and has a huge focus on security. But for the average blog/site, Drupal is overkill and too technical for what most people need

> here is no effective sandbox for plugins or themes, and you can't really make serious use of WordPress without those.

I mean, literally thousands of sites do make serious use of WordPress. Quite surprised that in your use of WordPress since 2006 you haven't heard about any of them.

I think the commenter’s point was that making “serious use” of WordPress generally requires also using plugins or theme(s).

The trouble with WordPress is that it makes it too easy to set up and far too easy to install random plugins.

People spin up a WordPress instance for their blog that they're totally going to use every day, install a bunch of plugins and a fancy theme, then within a few months have completely forgotten about it. Meanwhile, vulnerabilities are discovered in the plugins they installed. Maybe they're patched and maybe they're not, but either way their server doesn't get updated.

Within a few months it's hacked, and the ex-blogger probably doesn't know until they get an email from their hosting service complaining about malware being served from their blog.

This is made worse by the fact that, since WordPress is everywhere, it's worth the time for bad actors to write scripts to exploit vulnerabilities in outdated versions of popular plugins. It doesn't matter how obscure your site is, if it's written in WordPress and not up-to-date, it's as good as hacked.

The value of managed solutions for the every day person/company is almost priceless. Squarespace / hosted email / cloud storage etc should be standard vs Wordpress/self hosted email/ a shared drive on the local network.

Unless hosting the product is your core business model, let someone else do it, because then there will be one or more people dedicated to making sure it works perfect and is regularly updated.

After building some sites with Wordpress recently, I think another problem is the business model of most plug-in vendors.

They all seem to charge $90 for a year of updates. Gets steep quickly- theme, backups, layout builder etc. Fine for the first year but probably don’t get renewed and then the plug-ins don’t get updated.

I’d love to see a list of fully featured open source plug-ins.

wordpress now allows auto updates,but this does require setup and you still need to monitor for bad auto updates.

Its also totally possible to be burned by auto updates. Say for example if you're running php 7.3 and the vendor specifies the plugin needs php 7.4 (even if it doesn't!) . Your plugin gets updated, you get the white page of death, your site is offline, and now you need to ftp/ssh in and rename the directory for that plugin.

i'd rather have a white page of death than a security issue. I have automated checks for the white page of death too

WP is possibly the most powerful and widely adopted footgun we’ve ever seen.

Reply on news.ycombinator.com