275 comments

[ 4.4 ms ] story [ 278 ms ] thread
I am getting old. I remember when b2 forked to b2evolution and Wordpress. I remember when cpanel started allowing for installations.

I’m glad they are doing so well.

I personally think it’s cool you got to see all that in real time OG :)
I remember CPanel and having to set up Wordpress installations or using it to create MySQL databases and install phpmyadmin + setup FTP accounts so I could deploy PHP applications I had written myself. I got into programming during this era to create a website for my uncles store and “share” his hosting to run a forum I built dedicated to Ocarina of Time.

I definitely look at those days with rose tinted glasses and had basically forgotten about the time before I used VPSs and knew enough of bash and Linux to set all these things up myself. And even that was quite awhile ago now I write frontend and back ends and deploy them to AWS or Heroku. I guess it just shows how much the web has changed and matured compared to using shared hosting from websites that only a few hundred people max used.

This thread is a giant bucket of nostalgia for me and I’m not even 30 yet. Crazy to imagine what the web will be like when I’m 50 longing for the days of React and Flask.

Well, cPanel hosting and shared hosting is still a thing. There's a LOT of such hosts around much thanks to WordPress.
I think I’ve been using it for my personal site for most of Wordpress’ life, wow. Certainly at least half the project’s life.
WordPress is synonymous with the progression of the web. It has allowed a lot of people and businesses to have a digital presence on the web and will likely continue to do so in the coming years.

Here's looking for more innovation and possibilities ahead!

I left the web hosting business in 2008 and came back in 2013. Prior to 2008, there was a little wordpress, but there was b2, b2 evolution, MovableType, and a lot of the landscape was Perl based.

I rejoined the ranks in 2013, and holy smokes. WordPress. WordPress everywhere. It's even more so now. These days, to be in Web Hosting is to be in WordPress Hosting.

There are many critics, but WordPress was an integral part in shaping the web today and the blog era.
Blogs have gotten worse recently. It was nice for a while, so many people with little hobby sites. Not it’s all content marketing and people branding themselves as experts for career growth. It’s hard to find those old blogs now, they are buried 3 pages deep in search results
Am I the only one that doesn't like WordPress anymore? The concept was great, but it has basically become a "website builder" and not really a piece of blogging software anymore.

Throw on top of it the architecture of plugins (no sandboxing!) and the culture this has developed for websites being "built" with a combination of 50+ outdated plugins and it frankly becomes a nightmare. Of course this can occur with any huge software project, so I somewhat concede this point.

The real turning point for me was the push to move to the "block" editor and effectively turn WordPress into Wix or Squarespace or whatever

I’m newish to wordpress. The Gutenberg block editor is really word presses answer to squarespace( they said so at a talk word camp Boston a couple years ago).

But it still has the ability to just type away and write stuff without ever leaving the keyboard. I think it’s not bad. And it gives the graphic designers some control.

It’s a weird ecosystem though, you need a solid theme to start and finding those is a little hit or miss. Same with plugins, it’s hard to tell the great from the ok sometimes.

Apparently, lots of people want a website builder.

We in the startup culture often forget that the market for building bespoke webapps using the latest and greatest frameworks is only a tiny part of the web. The vast majority of people who order websites just want something that works out of the box, and they want it yesterday.

I don't think anybody is particularly fond of WordPress's medieval internal structure or its byzantine plugin ecosystem. For the time being, though, I'm glad that there exists a well-known, open-source, self-hosted alternative to Wix and Squarespace.

There was a time when lots of people wanted something bloggish. Now that time is over, and WordPress has pivoted accordingly.

>The concept was great, but it has basically become a "website builder" and not really a piece of blogging software anymore.

You can definitely turn it into practically anything, and it quickly becomes a mess due to the fact that it was never meant to be an application platform. But WordPress is still best in class at what it was meant to do; a simple self hosted blog.

WordPress is highly complex... it has plugin extension points, convolutes HTML building into application logic, and regularly has new security vulnerabilities discovered and exploited.

A guy I know runs a blog for his non-profit on WordPress. At one point he asked me for help because pages were loading extremely slowly. It turned out the blog had been hacked and was being used to host gigabytes of junk pages with SEO boosting links to really trashy websites.

I used to recommend WordPress wholeheartedly for self-hosted blogs, but these days I strongly prefer something that doesn't have any back-end code that the site owner has to maintain and/or update -- a static site generator, a JAMStack-based blog, etc. Or consider using someone else's hosted blog platform (someone you really trust to host a secure platform).

Best-in-class for a simple blog is something more like Ghost I would say.

Or better yet, any static site generator (Hugo is nice) + Netlify.

Even with people moving to walled gardens, many people still want to build and collaboratively author websites.

WordPress is still best in that, even when it kind of sucks.

I myself prefer the "static builders" for small websites, like Hugo/Jekyll, but WordPress also have built-in editor and access control; with small websites it's whatever, but with bigger websites, it comes handy.

(comment deleted)
The core WordPress codebase has been polished until it's sorta OK. It's got some quirks, but many of the obvious problems have been patched over the years.

The plugin marketplace, on the other hand, is a disaster area. Plugins are marketed to non-software people who don't understand security and don't know how to evaluate products for it, even though they might care in the abstract. The result is that the typical WordPress installation is a festering mess of insecure plugins, and sites get hacked all the time.

Anymore? I stopped liking Wordpress before 2010, especially being a PHP programmer (back then) in small town Midwest where 90% of gigs I landed was fixing some monstrosity that some guys nephew threw together made up of a dozen+ plug-ins that had since been hacked on by a series of online personalities and a theme they purchases three years ago that they had paid five different people to “customize.”

Yeah sure I’d be glad to quickly change over this theme to match new designs. Wait every plug-in also has to be fought with since the templates for those have also been “customized.” Wait I have to match the HTML almost to a tee because the chrome plugin no one else has ever heard of says you have perfect SEO (despite only getting first page results with a highly specific query no human would ever type) and you think this will lower your score? :(

I’ll take a stressful 10 hours at a startup over that any day.

> Wait I have to match the HTML almost to a tee because the chrome plugin no one else has ever heard of says you have perfect SEO (despite only getting first page results with a highly specific query no human would ever type) and you think this will lower your score? :(

That's hilarious. I'm assuming it would not have gone well to try to tell them otherwise?

Most of these people owned mom and pops or online stores; they weren’t tech savvy and tended to believe what they read on google (usually blogs trying to sell them Wordpress plugins, SEO guides and the like) so yeah it would have fell on def ears. It is funny, now that I don’t deal with it anymore.
There are definitely a lot of people who do not like WordPress anymore, there are people who complain about the same things as you do. There just is no other tool that fills the same niche that WP does, semi-easy to use for people without any technical know-how, to add new pages and content.

To me WordPress is a relic of a time long gone, of internet that does not exist anymore, and sometimes wish I could get back to - it enabled so many people to just put out things that they wanted, without having to learn HTML

(comment deleted)
I suspect you’re no longer in the circles that WordPress is targeting: it’s still a fairly common “no-/low-code” platform for people who just want to put together a site for themselves. I think that what’s going on is that programmers generally don’t encounter it as much in “real programming jobs” because it has been so successful in making programmers unnecessary for a whole swath of websites.
There's plenty you can do with WordPress as a developer. There are also no-code tools like Pinegrow that attach dynamic WP functions to static HTML templates.

Automattic's failure IMO is making Wordpress.com feel like a blog platform for far too long. A lot of what users would consider reasonable functionality for a website was not provided in WP core but by the plugin ecosystem. So people just defaulted to plugins for everything, which eventually gave WP a bad name, because plugins were often janky and poorly supported.

> Am I the only one that doesn't like WordPress anymore?

I stopped using WordPress over a decade ago. I use other website//blog platforms now. I may go back if there is nothing better available, but I have a control-streak in me.

At the time I started WordPress I just didn't have the knowledge coupled with just needing to start something quick.

I moved on.

(comment deleted)
I agree, unfortunately. For me, it's been on a decline since wordpress.com came along and from then it's felt more and more like Automattic is driving development to suit their business model. I still run a large-ish blogging network that uses WordPress Multisite, but I would love to migrate away from the platform if there was a suitable alternative.
I think there is a sizeable market for a basic 'none blocks' wordpress clone with a limited range of options for themes and plug-ins.

Anyone who needs to install a plugin to add a table or to do a redirect is already well catered for.

With you 100% on the 'block' editor. Instead of offering a decent alternative to regular site builders they have changed the landscape so someone may as well us wix or squarspace since wordpress is now offering nothing better?
>The real turning point for me was the push to move to the "block" editor

Yep, this as well as seeing random ads appear in my blog while scrolling through my posts. Recently, I tried going back to WP, but only if I could use the classic editor but they made it so confusing to find it and use it that I gave up. Too bad. I was a happy customer for many years prior to the block thing.

I recall installing it when it was still pretty new, freshly forked from another application.

The last time I looked, WP was running ~1/3 of the public-facing web. I use it for all sorts of things, as it makes a perfectly usable CMS. It's easy to keep it updated and secure these days, plus they've had an emphasis on security for a while now - or at least a better attitude with regards to security.

It's actually 40% now. "Running the web" might be stretching things a bit though, because a ton of sites use it just as a CMS layer for their existing front end or to host their blog subdomain.
During the early 2000's I was part of creating a competitor to Wordpress and Pyra labs (blogspot) in Sweden called blogg.se. The reason it succeeded (read: outgrew both at the time, at least regionally) was two-fold: 1) The platform was available in a language the users preferred and 2) there was a human support crew that answered to questions.

Many years later, I'm happy to see Wordpress thrive – the power of one person's voice is more important than the platform itself. This is how any platform should work: empower their users, not control them.

Localization is mostly a solved problem today but empowering the user and respecting their rights isn't. I hope us developers can help pushing the ball in that direction.

Wordpress made a great impact on the net, and I was happy when clients liked its ease of use and relieved from the burden of making content changes. (Though, I've always felt that https://textpattern.com/ was more secure and better than Wordpress).
I think that's the remarkable thing about wordpress. There have been better engineered platforms consistently, but WordPress wins because it's got a diverse long-tail module ecosystem, an enormous developer pool, and a self-perpetuating userbase.
Fun fact - Textpattern and WordPress are both 18yrs old, PHP and GPL.
I still remember the first Wordpress installation, I was in high school, China still had decent connection to outside world, I rented my first VPS, in west coast US, even tho the domain was eventually blocked by the great firewall after a year due to some personal thoughts I posted. But I learnt a lot from it, it’s the first time I tried to read and modify actual code to make things work the way I wanted. Oh and there was a huge community for Wordpress in China, they’d hold those events in top universities in China to talk about Wordpress, PHP, web and technology in general, always wanted to attend. I think things changed now. Exchanging links to each other’s blog was also a huge scene, I still know some of the people, some of them are still blogging, about their lives, kinda like diary, from high school to graduation from college to getting married and having kids.
From what I see PHP is still very strong in China. There are even frameworks like Swoole, with majority of contributors from China.
I wouldn’t doubt it about PHP, it’s just the fact people gather together to actually discuss and appreciate technology for the sake of it, not wanting to sell something is becoming rare. Or it could be my perspective have changed, and I didn’t realize people were selling things.

And the whole blogging community was so great, people exchange links not for SEO, but from appreciation of content or styles.

congratulations! WP has indeed come a long way, I was just checking up on what happened to Mambo, another CMS, and it seems to have fallen off the internet around 2008.
iirc Mambo was forked into Joomla which is still used but nowhere near as much as WordPress
Great, maybe now it can get fucked!

(This is a joke. Please don't respond with the useful applications of WordPress.)

“Do you know 1/3 of the web runs in Wordpress?“ should be it’s first tattoo
Does anyone have recommendations for learning Wordpress if you already experienced with modern practices like GitOps and immutable deployment artefacts (containers/VMs) using more fully featured frameworks like Django and Rails, which have abstractions like ORMs and Migration frameworks to look after all your database changes (within reason obviously since we all know these tools aren’t one size fits all) …

I know there’s value in Wordpress even if it’s just potential future revenue supporting a subset of the 1/3rd of the web running on Wordpress. So I’ve pushed but when I loose spend twelve hours over a whole week trying to work out how I’m supposed to manage my database (don’t even get me started on how frustrating it is that you are basically forced to use MySQL) and basically giving up because there both appears to be nothing other than do it yourself with SQL DDL if you don’t want the plug-ins doing it for you, and the fact the web is full of SEO for how to “migrate” your content from one Wordpress site to another hosted somewhere else…

Id love some recommendations as it feels like I’m making an uphill slog through a river of 18 years worth of outdated info posted by users and decaying SEO bacon written by developers.

Get your local environment set up (Linux, nginx, PHP, MySQL), then configure Netbeans with xdebug, and start stepping through the code.

I think this is probably both the most painful and most useful way to learn how Wordpress works under the hood. It will probably take you another 12 hours (and another week), but at least those hours won't be wasted.

Edit: oh, and take notes while stepping through with the debugger. Having a document you can refer to later that has some kind of outline with your own ideas and opinions is a huge help.

Use the official docs instead of going off what people say to do on stackoverflow and the other wp seo spam sites out there. The snippets are often not optimized correctly, using an outdated method, or just insecure.

I suggest going through the VIP docs as well as they have some really good advice on securing and speeding up wordpress along with what to avoid.

https://docs.wpvip.com/technical-references/

Also just a tip: https://github.com/WordPress/WordPress-Coding-Standards

https://pantheon.io/ has WordPress plans with dev/staging/prod sites integrated with git. If you want git, I would highly recommend trying their system out rather than trying to figure out how to make WP cooperate on your own. WP installs normally don't use a VCS at all.

Don't try to use WP for anything involving a lot of programming. It will just hold you back. Use it for projects simple enough that you don't mind writing a few MySQL DDL statements with DIY migrations.

> Does anyone have recommendations for learning Wordpress if you already experienced with modern practices like GitOps and immutable deployment artefacts (containers/VMs) using more fully featured frameworks like Django and Rails, which have abstractions like ORMs and Migration frameworks to look after all your database changes

Personally, I think trying to apply modern development practice to wordpress development is a waste of time. You're going to fight an uphill battle. Instead, just treat it as a legacy platform and use legacy development methodology: have at least two or three copies of the site (dev, staging and production). Use sftp to live edit the code on dev/staging, then copy to production regularly. Make sure to have a versioned daily backup in place which at least can pull the last 7 days daily backup and the last 6 months monthly backups, and you're set.

If your app is getting too complex for this development method, you can always switch back to django or other modern frameworks with modern tooling.

I agree with this approach. Fortunately, there are managed services specifically for Wordpress that handle all this stuff. Cloudways, WPEngine, there are several others too. Cloudways lets you set up and manage WP using Digital Ocean, Vultr, AWS or GCP if I recall.
I don't see why this would preferred over using something like vvv [0] to develop locally and then pull changes from a repository to a production site. That's how I've been doing it for my personal site and it works like a charm.

[0]: https://varyingvagrantvagrants.org/

What's great about this tool? since you can use Ansible to install Wordpress and more.
You use VVV for local development. Ansible is certainly something you can use to deploy.
Hate this kind of new, it make me feel old. It's like someone saying to you "Did you know <some child you still see in diapers> is now 18.
Yes, it's brutal. Other people's kids grow so fast.
I handled the inherent security risk of WP's plugin architecture by meticulously monitoring the plugin-code/plugin publisher, Firewall, File changes, 2FA Auth etc.

I handled the performance drawbacks with best hardware, cache etc.

I even accepted the premium for above activities. But random database errors was the final nail in the coffin.

After a decade of WP usage, I have ditched it for good. My current web stack for the past 2 years has been -

Simple websites- Vanilla HTML, CSS, JS.

Blogs - Hugo.

Complex Web Applications with CMS - Custom Go framework.

I understand that none of the above is applicable to someone who doesn't have web-development experience, Even in that case website-builiders[1] are a better option than WP. At this point, the only reason I'm not nuclear on WP is because I believe there's a thriving economy based on WP especially from developing countries.

[1]https://startuptoolchain.com/#website-builders (Disclaimer: Mine).

> there's a thriving economy based on WP

a lot of digital marketing/service company use WP to quickly setup a website for their client. my current employer's website is a WP site build by a third party.

Yep, But I really don't know whether that's for good or bad overall.

Good for that 'digital marketing/service company', But there are better options for your employer in terms of cost/performance/security; Better options have been available for over past 5 years.

I’m curious what options you are considering here that are comparable and don’t take 10x more technical skill and time? Sites like Squarespace or Wix? Or Webflow?
Correct, Those are the ones I've linked to in my original comment.

Of course website-builders do come with the caveats of vendor locking, But then again the typical relationship between 'digital marketing/service company' and the client mentioned in the parent comment is often much worse.

this is just my experiences from years of working in small to mid size company.

company tend to see company's website as part of marketing thus marketing dept usually have the final say and they tend to go with what digital marketing/service company recommended.

edit: not sure if that's a blessing but at least I don't have to deal with marketing people going over some small details like color...etc. the website that I build is web application for internal use.

I can program and am very familiar with web technologies. For my own project https://rpgplayground.com, I decided to go with WordPress, and I haven't regretted it for a single day.

It started out as a landing page and a blog. But then I needed a forum for my users -> install BBPress and done!

Was getting some spam comments and posts, so installed some anti spam plugin and captcha plugin.

Seemed my users want to post their own games on my platform, so installed the BuddyPress community plugin.

Wrote my own plugin to integrate my game builder with the website.

I run a Discord server and wanted to notify Discord when a new game is published on my platform, so installed the Discord plugin to push posts to Discord. Plus, I can show Discord activity on my website.

Wanted to send out a newsletter for user retention. Very expensive options out there, so I installed a pay-once solution to run this from a wordpress plugin (50k subs and counting).

Soon I'm going to implement a marketplace where my users can sell and buy resources. And guess what, you have a WooCommerce plugin and some other one that enables this.

Oh yeah, I want to do this with virtual credits, and of course there is a plugin for that.

Absolutly awesome! And in the meantime, I can focus my developments on my RPG making tool.

I also sometimes hire a cheap developer to implement some custom things, and it works great.

Edit: plus, it's really fast to run experiments without losing development time. Just install or enable something, and if it doesn't add value, remove it again.

Did you setup a local installation to test drive plugins you want to add to your production installation ?
Most of the time I put it straight in production :D. I'm at CET time, and so if I do it in my morning, most users never find out when something would go wrong.

But I do have a custom script to create staging and test environments. Custom developments happen there.

It's basically copying all files and database, do a few config changes, and you have an exact copy of production that you can play with.

I looked into a proper development flow for WordPress, but it's very hard. Mainly because both data and config lives in the same spot. And you always want to work against the latest production vesion, since things might have changed there.

So no local setup, only multiple hosted ones. The DevOps flow could be improved, but right now it seems to work out fine.

So for custom developments, my developer works on test. Then I check it and move it to staging. There I check again if the update works fine, and do the same on production.

It's a pretty good flow for a 1 person project.

Be aware that WordPress makes it easy to breach GDPR compliance when the db is copied left and right and especially if other environments are shared with third parties (like external developers).
While I don't like WordPress either, I begrudgingly use it. My only wordpress website is a hobbyist news website where 1) 5-6 people need to be able to publish article on it, none of them (except me) have technical experience, and 2) we can only spare $10-$15 per month for the overall cost (and no, there's no way to make money here). This put me in a situation where almost the only option is self-hosted WordPress.
It makes sense and I think that's the reason WP has survived. In fact I started out like that, later building my startup product website(s) using WP; But once the tech-debt became too high I had to take a call.
Have you looked at https://ghost.org/? Self hosted on DO costs around $5/mo. Though it's much less customizable than WP
I went the static site via Hugo -> cloudflare workers sites route. It is so vastly superior to fiddling with hosting a SQL database, plugins, constant updates, etc.

I built an entire frontend around it (my username .co.uk) which tries to reshape how tech novices work with websites.

I have found small business owners I talked to (n=10) to be allergic to dealing with their WordPress or squarespace sites, because despite everything, they are just not simple to use. They just try to cater to too many use cases. Being everything to everyone comes with complexity that's very difficult to navigate as a tech-novice. Though I think squarespace do a better job than WordPress. Albeit more expensive.

The funny thing is, people have grown such an aversion to dealing with websites that I am also having quite a hard time trying to get anyone to look at it. As soon as they do though, it's like a lightbulb moment for them, to see how simple it can really be.

Naturally the trade off is flexibility, but I haven't had any complaints about that yet. I am not dealing with very complex sites though (and wouldn't want to either).

Does it make anyone else nervous that 40% of the web is run on software with such a poor track record when it comes to security?
Anything highly-used will be a larger target by default I'd guess.
Isn’t just the “Windows” of the internet? It’s heavily used, directly exposed to the internet, so it’s a bigger target, hence more bugs a found (and exploited).
If you'd have ever looked at the WordPress source code, you know why it's been having a crappy track record. It's one of the easiest example of "don't code like this".
Those issues went away with the automatic updates feature.
The 'poor track record' reputation comes from the giant number of mom-and-pop sites that got compromised. I imagine 40% of the web is really just a handful of massive commercial websites that have developers on hand to take care of security, backups, devops etc.
Trying to decide between these:

(a) Wordpress (b) SquareSpace (c) https://strapi.io/ (d) https://prismic.io/ (e) https://www.contentful.com/

The output will be a simple website, we already have all pages in HTML, and from the tech perspective we could use any of the above.

What I've seen was: SquareSpace is still rather limited, Prismic and Contentful are around $500 per month in their non-free-tier, and Strapi is just too expensive to find devs for. Plus their editor looks the same as Wordpress's if I'm honest.

On the other hand, Wordpress has a massive community of reasonably priced freelancers, has updates many times a year, and most things you want out of the box (such as SEO, or easy hosting on Heroku or elsewhere). The only thing it doesn't have is the excitement to work with it :)

Is there a good business case for any of the competitors?

My current headless CMS choice is sanity.io. you'd still need a dev for the frontend and sanity schema setup probably.
Squarespace has somehow managed to make <img> tags require 3rd party javascript to work.

I cannot take them as anything other then grossly incompetent.

Choose boring technology.

WordPress is 18 years old, there's a good chance that it will be around for quite some time longer.

Consider a static WordPress site via the WP2Static plugin: https://wp2static.com Going static solves most of the performance and security problems with WordPress. There's a prebuilt Docker setup at https://lokl.dev/ and an AWS template at https://staticweb.io/open-source/wordpress/ There are also commercial hosts (with their own plugins) at https://www.strattic.com/ and https://www.hardypress.com/

I've worked a bit with Contentful, and it seemed like a pretty good CMS, but pricey. The client was moving off of it because they wanted the more familiar WordPress UI.

Ohh thanks for this I'm going to try this out looks awesome!
I would choose something that would let me move my site to other vendors easily or self-hosting it.
Webflow.

Webflow is basically a super good editor that spits out static sites on build.

As easy to update as squarespace for non-tech folks, but as customizable and secure as a static site generator (since you can build everything from scratch).

Pretty awesome for a guy who studied jazz saxophone and political science. You may have to say a lot of things about Wordpress etc but I know a lot of arrogant computer science people with Phds who think they are programmers but have created nothing in particular.
I wish WordPress would bake a flat site exporter directly into an install, instead of forcing folks to mess about with plugins.
Simple in use and simple to extend. Still powerful and showcase for continuous innovation without large disruptions. The example that gpl software can be very successful.
Personally I think despite being unpopular with many developers (I dropped PHP/WP for most purposes many years ago due to the amount of hate it was getting and general poor reputation) and the problems of the past, the concept of plugins and what you can do with WordPress is terrific.

And not something that anyone who really understands software engineering should scoff at.

I would go so far as to invite the downvotes with a comment like this: WordPress may now be the most powerful (low-code/no-code) application development platform ever created.

What is the WordPress of the 2020s? Something built on web assembly or TypeScript or Python or whatever maybe?

> I would go so far as to invite the downvotes with a comment like this: WordPress may now be the most powerful (low-code/no-code) application development platform ever created.

And you would be correct.

The WP API is mature and stable, so much so that tools around fast WP scaffolding are already available. You can create a site in Webflow, export the HTML and use a tool like Pinegrow Theme Converter to attach WP functions to HTML elements, such as Posts loop, ACF fields, WP Customizer, etc. No PHP knowledge needed. Pinegrow will export a fully featured WP theme to your site folder, and handle enqueuing the functions and stylesheets. You never have to open functions.php again.

Add to that the vast library of plugins for things like Ecommerce, online courses, appointment scheduling, user accounts, social networking etc. and you can create a pretty complex prototype.

WordPress is like Craigslist in that software engineers hate it, but everyone else happily uses it, and both are thriving businesses providing a sustainable livelihood to their employees and owners instead of trying to take over the world. You should be so lucky to invent something as well-loved and as useful as WordPress, and to stick to your principles for as long as Matt has.
The headaches are simply not worth it. No designer should be using WordPress for client websites in the age of squarespace/wix. It is just irresponsible to build something for a client that is going to break itself within 1-2 years max.
It completely depends. I think building a site on Squarespace/Wix can very easily be considered irresponsible.

edit: For Wordpress only install reputable, necessary plugins. Turn on auto-update. Keep backups. Things should be just fine. Now you aren't locked into a single platform and you can extend your website as much as needed (unlike Squarespace/Wix which severely limit what you can do).

> Turn on auto-update

Having been paid quite well to migrate to and from WordPress, and to help maintain the WP sites of major publishers, I have to say that this is questionable advice. In most cases in my experience, the publisher has employed third-party providers (at huge cost) to develop frameworks and custom plugins that can easily be broken by automatic updates.

Updates need evaluation and testing in staging sites before they can be rolled out. For publishers, the first install of WP is free - everything after that costs plenty.

Like you said, "major publishers" will have those problems due to custom code. Not the sort of websites where Wix or Squarespace would have ever even entered the conversation. You need to keep context in mind.
And not so major publishers, including hundreds, if not thousands in the top 10,000 sites. So it isn't just the Washington Post, et al. This is why I intervene on generalized advice to enable auto-updates on WordPress. I have seen it cause publishers a ton of money, and have lost a number of weekends when called in to perform damage limitation.

'Make sure you keep everything updated!' has a ton of caveats and pitfalls, that's just the reality.

How do you know if a plug-in is reputable without being neck deep in the ecosystem for a year talking to other devs?
I just make sure the install count is something high (if it is lower than say 100k, then probably there is a better plugin out there to do the job) and it has been updated in the past couple months, and it is compatible with the latest version of Wordpress. All that info is directly visible while you are searching for plugins within Wordpress itself on the search page itself. And typically I'll also do a Google search for whatever problem I'm trying to solve and make sure it's recommended by at least two people.

Btw, I'm a senior full stack software engineer. But for my digital media business I operate several Wordpress websites. I don't talk to any Wordpress devs and do any custom Wordpress theme or plugin development (aside from what is available in the GUI and extremely minor CSS tweaks).

WordPress is an open source project, immensely supported, fully customizable to it's core and that let's you port your website to virtually any hosting service out there, that let's you export all your data however and wherever you want.

Wix and alikes are proprietary software, that lock in users on their services, have limited customization options, don't allow you to edit code and have little to no export options.

Whoever pays someone else to have it's website built on wix or alikes is getting a very bad deal, due to the above mentioned restrictions (compared to WP) they'll end up very dissatisfied in few years if things go well (meaning more traffic and more needs).

Source: experience. As a developer I feel the frustration coding for WP, but at the same time it's the best compromise to provide a CMS that the average user can manage

Scaling is famously a good problem to have. Unmaintained wordpress instances are the internet equivalent of toxic waste dumped in the river. I agree that open standards are important, but IMO it's irresponsible to leave someone with a website hosting setup that doesn't have a qualified person responsible for ongoing maintenance. (Fully managed wordpress hosting from a reputable, established company is one possible answer, of course).
Is it impossible to make a secure CMS? I'd think step 1 would be to not have the admin stuff with the same access as the public website, and step 2 would be to have a way to sandbox plugins, but are those things possible?
Step 1 is possible nowadays (with SNI) but was hard until recently, and I don't think practices have really caught up with that yet.

Step 2 is difficult to even define properly. What is a plugin supposed to be able to do, and what is a plugin supposed to not be able to do? If you can answer that question precisely, then you can solve the problem, but if you can answer that question precisely then you probably don't need plugins in the first place.

I understand wp is more flexible and from a development perspective is superior. However it's inferior if you are just hooking up some small business with a website they can maintain and they don't want to pay you for ongoing maintenance.
>Wix and alikes are proprietary software, that lock in users on their services, have limited customization options, don't allow you to edit code and have little to no export options.

If you are building a simple brochure website, none of this matters.

i am going to strongly agree.

i set up my first real blog over a decade ago. i picked wordpress, because that seems to be the default, and i didn't know any better. oh my god, i hated maintaining that thing so, so much. it pretty much killed my desire to blog, as a matter of fact.

i recently started another blog, and this time i used a static site generator. i wouldn't recommend such a thing for non-technical people, but if you are willing to get your hands a little bit dirty, it is a hell of a lot easier to fix than wordpress ever was.

That’s a pretty bad comparison. The entire reason WP is a better solution than SS and Wix is it’s extensibility, data portability and usability.

Plus: what headaches? Do it well, keep it updated ( uh, yeh, like literally ALL the software, ever ) and it’ll work flawlessly for years.

It's so interesting to see just how successful WordPress is. Among developers especially. I look at small business websites all around where I live and it's all WordPress and every single one was made by yet another wordpress-shop that does nothing but setup WordPress for people. It's a huge ecosystem.

And you know what I have learned by talking to these businesses? It's that WordPress is still not easy enough to use for non techy people.

Nobody wants to touch their website, out of fear of doing something wrong. So they have to go pay someone to do it every time.

I'm running pinkpigeon.co.uk, which tries to actually make websites easy enough to use for everyone. But I am actually running into a problem where people expect all websites to be like WordPress and the first thing you hear is "oh I don't want to learn another thing". It's only when I show them the system, that they go "oh wow, that really is a lot easier". The problem is trying to convince anyone of this remotely via the Internet. Much easier to do in person.

I have the utmost respect for WordPress and used it much myself, but at the moment it's challenging to have to be compared against it when simpler solutions exist.

What baffles me is that huge portion of those small business websites have absolutely no need for Wordpress or any backend altogether. At best they need some static site generator and a CI/CD pipeline maintained by the provider to rebuild the site if it is an actual blog, which is not that common.
How are the small businesses supposed to update their websites, if there is no backend? You can't expect them to write HTML.

Not sure if suitable WYIWYG editors are still around, or if Word exports to HTML have become usable.

" or if Word exports to HTML have become usable"

I doubt there is beauty to be found.

And websites are a lot about beauty.

Businesses, even very capable with web dev, update their websites very rarely. Businesses want to update the content, which is different. Static site generators are built exactly for that.
Can I open an app on my phone to create/update a post? Can I Use my phone to create another user so a friend can guest-post on my blog? Can I send an email to a certain address to publish a new post?

Nope

Now you just take things a blogging platform can do and try to morph that into an argument against static site generators. The very point of static site generators is to drop a whole host of functionality.

How often does a construction/handyman "online flyer" webpage need a change? Once a year, maybe. The primary point I am trying to make is that websites of a lot of small business (obviously ones that are not webshops) serve more or less static content and therefore have no need for a backend at all.

You have a food blog where you publish recipes/reviews daily? Surely a blogging platform is a much better fit for you. You have a restaurant page where you publish contacts, coordinates and a menu which changes every second year? Well, maybe a static site generator is a better fit.

You say that, but what if they want to add GA? Or an image gallery? Or a chat box?

Those are just some examples that with Wordpress, it's a click and pretty much plug and play. With the static site generator you're proposing, you quickly need to do coding yourself.

If you buy website development service you do not necessarily care whether the provider writes custom code for WP or static site generator.

Why do you need a backend for GA or image gallery?

Because you don't want to keep paying ongoing fees for new development when it could be as easy as installing a plugin.
But image gallery does not need any "additional development". All it needs is frontend code to display the gallery nicely, some storage mechanism and a "manifest" of sorts with relevant metadata of the gallery.

If that is a photo-sharing website, then yes, proper backend is needed. But for a portfolio website of a photographer, which gets updated once a month at best, static manifest will work wonders.

I love the idea that "frontend code" is somehow not "additional development". Have fun with your "manifest" and "metadata".
I equally love the idea that hiring a web agency to build a wordpress template is somehow entirely different thing from hiring a web agency to build a not-wordpress template.

The frontend code which eventually renders the image gallery does not care whether fetched image list is produced by PHP code or is served by http server directly from filesystem.

> But image gallery does not need any "additional development". All it needs is frontend code to display the gallery nicely, some storage mechanism and a "manifest" of sorts with relevant metadata of the gallery

I can't tell if u missed a /s or genuinely think that isn't additional dev.

> At best they need some CI/CD pipeline maintained by the provider

My business requires a what now?

Missed a part. A static site generator with build/deploy happening on provider's infra.
> A static site generator with build/deploy happening on provider's infra.

“Say what now? Where do I login to update a photo on the site?”

In software engineering, CI/CD or CICD is the combined practices of continuous integration and either continuous delivery or continuous deployment.[1]

In short everything has to be continuous, otherwise you'll stall and die. Now go buy some CI/CD from the shop.

[1] wikipedia

Cool. Now imagine I’m a business owner that makes and sells my own socks and happen to need a website to do so. What you’re talking about would still make zero sense to me.
> At best they need some static site generator and a CI/CD pipeline maintained by the provider to rebuild the site if it is an actual blog, which is not that common.

What most people want is to have something that works, where they can focus on their content and not on your tools. Wordpress works for people.

If they get a CI/CD pipeline maintained by someone, how do they create pages, get updates, fix those pesky security issues, write a blog post on their mac that when saved automatically gets posted? How easy is it to apply a theme to your CI/CD pipeline? Your tools work for you, but are you going to maintain them with the same level of features as Wordpress?

Oops, it's holiday time, will you write a greeting card plugin for your CI/CD pipeline for them to purchase cards on their website and send site-specific cards to their email list by Monday? No? Sorry, they just switched off of your CI/CD pipeline to Wordpress.

When moving to a different hosting provider, people want to conduct business not learn a to use a new CI/CD pipeline to match the tools at the new hosting company.

What about when you get tired of updating their site generator code for them? They will need to start over, and they won't pick another CI/CD tool that's unmaintained and is expected to get horribly outdated after a year.

People go into business in order to conduct business.

And they will want to automatically publish to twitter/facebook, integrate shopify on the site, some forms, etc...

Wordpress has 1 click install for all those things as plugins (or work out-of-the-box)

"Joe's porchbuilding" does not send automated greetings. They want a website that is discoverable on Google by new clients and can display their pitch, everything else is negotiated on phone or by email anyway. You only need to worry about security issues if you build such a site on top of a dynamic platform. The updates and security issues disappear if you serve factually static content as static content.

Static site generators are bad for dynamic websites, but that does not mean you have to try and fit a whole dynamic platform into a static website. Different use cases, different tools.

> "Joe's porchbuilding" does not send automated greetings.

And, that's false. Unless you make them run one of your restricted platforms that doesn't have the features they want and need for their business.

Wordpress runs 60% of CMS websites. 15% of the most viewed websites run Wordpress.

> You only need to worry about security issues if you build such a site on top of a dynamic platform.

Do you actually believe that there are no security issues with static websites?

Thank you for the conversation, but I'm going back to running my business.

>Nobody wants to touch their website, out of fear of doing something wrong. So they have to go pay someone to do it every time.

i think it's a mistake to believe that this is a problem to be solved, or that the reason people don't want to touch their website is just a "fear of doing something wrong". it's not a question of how easy the admin panel is to use - the vast network of people willing to handle wordpress sites is a feature of wordpress. a business owner doesn't want to deal with their website, they want to pay somebody else to do it for them. tech people like self-serve solutions that they can log in and administer themselves, but there's a whole lot of people who really don't want that - they want to just call somebody up, explain what they want, and have it taken care of. the reason wordpress runs 40% of the internet is because it delivers that experience.

And here I am, making a website with an image and boxes around links.
I can attest to that the fundamentals of Wordpress are truly awful. Will never return and can not recommend it for anything business related. It is a damned fine blog software though.
Define business though, most business do fine with wordpress alone. Then there's woocommerce with about a 20% market share iirc...
(comment deleted)
I hate WordPress because it has bad DX. But why would I hate CL, it's a simple, useful site with minimal JS.
What do you find bad about WordPress DX in particular?
I have not worked with it recently. I recall needing to rewrite a URL and it not being possible with .htaccess - which would have taken a couple minutes. Instead I had to learn the WordPress URL rewrite system.
> WordPress is like Craigslist in that software engineers hate it, but everyone else happily uses it

Why would a software engineer hate Craigslist? It's one of the most streamlined, responsive web sites I interact with on a regular basis. No third party scripts. It's built to purpose and it works very well without any fuss.

I suppose I have some minor gripes - with noscript it looks awful and they killed off their RSS feeds a while back. But hardly enough to inspire hate!

(comment deleted)
and to stick to your principles for as long as Matt has.

Technically he subtly shifted from supporting free software to open source. Just pointing that out, not making a big deal about terminology or anything as WP is still GPL'ed.

I’m an engineer and I always recommend people to use wordpress if they want to blog.
I used WP for various sites and blogs, and now I am left with one last instance, which I refuse to babysit, and will just turn it off. I had enough.
While WP's ecosystem is nothing less than impressive, but I'm still in shock to this day, how cumbersome is site migration.

For me and I guess for many other engineers it's quite normal to develop a site locally (or at least on a staging non-public domain name) and then move it into production under the final name.

In Wordpress, the site name is baked in all over the place — in config, in database, in generated stylesheets and so on. In theory, this should not be like this (if you use barebones install w/o plugins), but then you buy a theme or some less-than-perfect plugin and boom, you need a separate plugin just to handle migration (which may or may not work 100% of the time).

Installing a WordPress site is actually very straightforward, in fact the platform is famous for its 5 minutes install. What you are describing as hard to achieve is copying state that is kept in the database, but I don't think this is an inherent issue to WordPress. But if you are creating the entire site locally and want to deploy it to production, it seems that WordPress may jot be the right solution in your case, instead a static site generator would be more appropriate.
That's categorically untrue. Almost all websites are first developed by a developer on his local machine, and then when it's ready to showcase or put online, it will move to the 'real' domain. It is no different for WordPress, and it's true that moving a WordPress site from one domain to another is a bit of a headache.

It should be "gather all things, move it to another place, change the domain name somewhere", but instead it's "gather all things, move it to another place, change all the links, change the domain name in two different places, hope you didn't forget anything or made a mistake somewhere". There are plugins to help you do this though, but all-in-all it's an annoying inconvenience.

Maybe, but I do this on a weekly basis and even with complex custom sites/apps it takes me less than 10 mins to change the urls everywhere throughout the site/database. Decent plugins indeed exist to make this super simple.
This just isn’t the case if it’s done well.

If you do need help doing it then migratedbpro or migrateguru are seamless.

It’s, like, really really easy to move Wordpress.

> In Wordpress, the site name is baked in all over the place — in config, in database, in generated stylesheets and so on. In theory, this should not be like this (if you use barebones install w/o plugins), but then you buy a theme or some less-than-perfect plugin and boom, you need a separate plugin just to handle migration (which may or may not work 100% of the time).

WP-CLI is your friend:

    wp search-replace 'http://example.test' 'http://example.com'
Don't do that.

Wordpress store some information fields and the length of the string of those fields. Use a plugin that search and replace for those and recalculate the length.

Also, search for //example.test, not http://example.test.

Edit: I read a bit too fast, maybe it does implement the string size but I can't be sure https://github.com/wp-cli/wp-cli/issues/1224

Edit 2: https://github.com/wp-cli/wp-cli/pull/1261 sweet, looks like it does ^^.

As far as I know WP-CLI also handles serialized data correctly.

By the way, I very much prefer the wpmigrate-db plugin.

Also, wpmigrate-db has wp-cli commands to export the database, I don't know if wp-cli search-replace can do that.

Edit: And it does:

    [--export[=<file>]]
    Write transformed data as SQL file instead of saving replacements to the database. If <file> is not supplied, will output to STDOUT.
Well, wpmigrate-db allows to replace multiple strings in one command and that's something wp-cli default search-replace doesn't provide.
Why would have the site name in a generated stylesheet unless someone wrongly put it there ?
Some commercially available themes do it during installation. I was surprised to find that also as this contradicts every instinct I have as a web developer.
I agree the ecosystem is what makes WordPress attractive. I'm impressed by the efforts put into third party themes and plugins that are simply amazing but the WordPress core is a joke.

One of its function name is literally "the_content();" where you output the main content in a theme, no class, no context but just a dumb function that sits globally to force the output and there are global variables like "$wpdb" that keeps the database methods.

Of course, you don't want to look how messy the database schema is. Configuration values are just thrown into the db with serialized strings with random keys, you'll never know what's where.

Seriously a first year high school student would put out a better code and no wonder it took so long to iron out vulnerabilities and performance issues to acceptable levels but the mess is already there and people have to live with it unless someone brilliant creates a new platform with theme and plugin compatibilities to WordPress, so the ecosystem lives for people to move on to it.

18 years of polluting the planet with bloated and bad code, breeding insecure developers writing insecure plugins and themes.

Kudos!