WordPress is my favorite example of "It doesn't have to be perfect, it just needs to work"
So many cool projects die because people over-complicate the first steps. You can always make it better later if people start using your thing, but first you gotta ship.
Funny, I think it proves the contrary. Wordpress effectively made their whole code base the public API, so now they’re stuck with the legacy code they have for eternity, unable to meaningfully improve it, as plugins may depend on the existing state.
It’s so bad, the PHP language developers are unable to implement some features/fixes in the language, as the Wordpress team refuses to migrate their code, which makes for a huge chunk of PHP usage. Imagine that.
This is stability. Stability is good. There is no need to change code that works just because it collides with modern taste.
If WordPress has a stabilizing influence on php that's even better. All the breaking changes of the new versions are a nightmare for an established project I work on.
Code is never just working. The environment it runs in changes, requiring refactoring things. We’re not talking about a showcase piece of artisan algorithm here, but bug-riddled legacy code reliant on outdated system packages, SQL queries that cannot use bound parameters for historic reasons and are ever-prone to injection attacks. Code that uses broken multibyte encoding, such that it is vulnerable to several attack classes. And that’s not even talking about performance. Are you seriously telling me software performance should not improved if the core functionality kinda, sorta, works?
> Are you seriously telling me software performance should not improved if the core functionality kinda, sorta, works?
I would not hesitate to take this position. Of course it depends, on how severe the bugs are, especially for the outer code (like plugins) calling it, and on how bad the performance is. But otherwise absolutely, never break user space.
> The environment it runs in changes
The web environment Wordpress runs in did not change all that much. The JS ecosystem simulates big changes, but that's all bullshit. Server code that worked 30 years ago still works - if projects like PHP don't go out of their way to break it.
> But otherwise absolutely, never break user space.
Neither the Linux kernel, nor OpenSSL, or any other reasonably complex project manages to do that over a given time frame. Sometimes you need to adapt, and things break in the process. Nobody would expect a house built 30 years ago to not require some maintenance and upgrades over time.
> The web environment Wordpress runs in did not change all that much. The JS ecosystem simulates big changes, but that's all bullshit. Server code that worked 30 years ago still works - if projects like PHP don't go out of their way to break it.
That sure sounds good, but is simply not true. We went from HTTP and FTP deployments to TLS and containers, from dialup to gigabit consumer uplink; the browser isn't a remote document viewer but a platform-agnostic virtual machine for fully-fledged applications; the web is centred around a few enormous platforms; people regularly stream GBs worth of video and expect services to deliver web apps on a variety of devices; they don't post on bulletin boards and in news groups, but use chat services; scammers distribute ransomware, steal your identity, remotely take compromising pictures from your webcam, or order stuff from your shopping accounts online. The modern web has almost nothing in common with the one from 30 years ago.
Sure it's true. Many users are still doing deployment FTP-style, even if it's not the original protocol anymore. That the pipes are bigger just meant we could up the thumbnail size, and the browser is still also a remote document viewer for sites that don't demand more. I just today answered a support question on a bulletin board, and so on.
There are other aspects of the web today, but the old way still exists.
> Nobody would expect a house built 30 years ago to not require some maintenance and upgrades over time.
You can do upgrades of software in a way that does not break compatibility, and you can definitely always aim to minimize breakage. Wordpress is not a bad example for just that. HN itself counts as a further example. If it weren't possible we wouldn't have this thread to discuss in.
Wordpress requires at least PHP 7.0... and will complain about it if it's not above 7.4 (which was released in 2019).
So this to me looks like WP is progressing with PHP, just slowly.
Frankly I don't have a massive problem with this.
The speed of Laravel's PHP baseline change may be appropriate for Laravel, because it is git-managed, more easily run in a container etc., but it's absolutely inappropriate for WordPress to chase the edge.
Compared to trying to stay up-to-date with needless Node.js changes and frameworks that get EOL'd as soon as there's something more fun to play with, it's a paradise.
Why don't people build things with a decade of life in mind?
To be honest, I never found WordPress easy to use. It's all flowers and rainbows as long as I can find good themes and plugins. However, it starts going south as soon as I need to make a very small custom change.
I've always considered myself an above average web developer, my friends would always have Wordpress websites, and ask me if I can just tweak a few things.
Without hesitation, I'd proclaim I could easily make those changes!
Then I'd load their site, load their plugin/theme code and css files, struggle for hours to get the desired effect, and even if I got it to work, I would break every other part of their site.
---
Denigrating anecdote aside, good job Matt, loved the story at the end.
I had the exact same thing happen years ago and I've never felt so helpless. Simple banner / color change. Ended up rebuilding the entire site from scratch it was easier.
Once you spend some time in the codebase and understand a bit of its legacy history it gets easier over time. A lot of plugins and solutions are aimed towards non-technical users and a lot of overlap. Where we might just write up some custom HTML others might install 3 plugins to make it work.
The overlap between plugins is crazy. It looks like every plugin comes with an entire SEO toolkit, a performance optimizer, a firewall and the kitchen sink. Unless you're very careful, you quickly end up with an unusable house with 5 kitchen sinks, no fridge, and 1 3/4 ovens that are perpetually trying to burn one another.
I think half the problem there is everyone offering half a house for free, but every company is offering a different half. No one wants to pay for the paid offerings that have all the features, they install one SEO plugin to get page metadata, another to get structured data / microdata, another to optimize keywords; when all they had to do was buy the premium version of Yoost, for example.
Thankfully there was a recent consolidation in a plugin called Admin & Site Enhancements (ASE). Probably got rid of 10 others with this thing. Includes duplicate post/page, admin menu cleanups & reorganization, hiding dashboard widgets, cleaning up the top bar, changing the login URL, an easy way to setup SMTP delivery, media replacement, hides the annoying admin notices, and a bunch more.
Initial setup of wordpress is super easy, but it gets very hard to maintain after a while. Updates require manual intervention, themes must be fixed, plugins deprecate. All of this adds a burden I am not willing to accept, which is why I moved all my sites to Hugo/Jekyll/Mkdocs (etc.) since about 2017.
How about PHP updates for major versions (e.g. 7 to 8), or how about maintainability for 10+ years? I was sick of all the work that emerged after a while for some simple sites. I have about 15 websites, all focus on a specific topic, with one or two updates per year. Wordpress is too much for this. Static sites can be moved around or hosted on the most basic nginx, whereas Wordpress requires a lot more.
I am not against wordpress in general, just that I found it not suited for my purposes.
I switched to ghost, at first it was a bit rough around the edges, but since they made the global cli. It has being quite nice. For blogs, would rather use that than WP. Of course I also prefer JS instead of PHP.
In a vertical where the barrier to entry is not high, being first to market with something simple that people can extend can create a decent-sized moat.
The downside is that much of the code in WP core is effectively un-modernizable, given how much depends on things working a certain way. Key classes and functions haven’t been meaningfully updated in over a decade.
WordPress is proof that clean code doesn't matter. Security doesn't matter. Out of the box performance doesn't matter. At least none of these matter if you are the 800 lb gorilla in the market and everyone else is trying to take a piece out of you.
The only things that matter are a decent admin UI and the illusion of choice of free plugins - most plugins are useless in 2024 because they have a pro version. When you add up the annual costs of all pro versions, the "free" WordPress (which requires a beefy hosting plan) becomes the most expensive and hardest to keep up publishing system nowadays!
From a business perspective the significant part of the website costs are man-hours for setup and maintenance.
Got something to say about how WP compares to others when it comes to man-hours (assuming you can buy any and all plugins you want)? Honest question, because I have no idea about CMS.
But they overprice and they forget people use multiple plugins, so I use a third-party service that leverages GPL to offer most premium themes and plugins for a low annual fee.
So basically you just want the functionality without paying for it.
> they overprice and they forget people use multiple plugins
People who complain about the prices also forget that a lot of these plugins take months or years to develop. You’re (we’ll not you since you made it clear you don’t pay the devs) literally getting thousands of man hours for like 60 bucks per year.
You said you’re buying from an unauthorized reseller because you don’t want to pay what they ask for. If you don’t agree with their prices that’s totally fine. But then why use their products? You want to use them but you don’t want to pay the developers.
Unauthorized?! It's 100% legal! Maybe not 100% moral, but I needed this for a nonprofit. I donated GiveWP to this and 2 more nonprofits - it costs me $420 per year and it's worth it. But no plugin developer offers a nonprofit discount, and the pricing is just cost-prohibitive. So, I donated the lifetime plan for GPL Vault. Keep in mind, that I could've decided not to pay for GiveWP as it's available from GPL Vault, but because I know it's a complex piece of work... although extremely buggy, I wanted the developers to continue the development and fix those bugs at some point far in the future, but the other stuff is just nice-to-haves and not worth the asking price.
Can’t blame the plugin authors, a freemium Wordpress plugin is about the best possible source of passive income there is. Have a security issue? Take your time, they are coming anyway!
No, but there weren’t any good contenders at the time, and Wordpress quickly grew from that cute baby gorilla into the massive beast we have now. We could also say that Google didn’t start as a world-spanning empire of search engine moat. Yet it is now, and it’s hard to build a new search engine unless you’re a multi-trillion dollar company (and it’s hard even for them apparently).
> No, but there weren’t any good contenders at the time,
Well yes and no. They were very few good blog focused CMS at the time. A contemporary one that comes to my mind and that actually predate Wordpress was Dotclear (which is still alive and still focusing on blogging). More general CMS like Typo3, Drupal, SPIP, Plone to name only a few open source ones were already around too and much more capable than Wordpress was.
What Wordpress did very well at the beginning, was focusing on one thing: blogging for non technical people. It was a much more limited software but that made it much easier for so much people. And it came exactly during the blog boom and only with time became a more general purpose CMS. But if you had to build a website for your business it was a very bad choice at the time.
Bottom line: making good software is one thing, but timing is everything.
> clean code doesn't matter. Security doesn't matter. Out of the box performance doesn't matter.
Absolutely so. Those are things for people to play, while the only thing taht matters is value. Does clean code provide value? No. Does security? No either.
It's funny because a lot of our growth has come from being one of the early CMSes to be completely W3C / XHTML compliant out of the box, security improvements including our update system give us auto-update numbers better than Android (but not as good as Chrome or iOS), and client-side performance and SEO performance are a huge reason why people choose WP! Some things are in the eye of the beholder.
I like Wordpress and it’s the CMS of choice for almost every situation, but Gutenberg has been out for a long time and it’s still far from good enough. Both as an enduser and as a developer.
I wish wordpress did fewer things but did them better. There should be something that is a notch better Jekyll but doesn't get gross when you install a dozen plug-ins. Out of the box wordpress produces a very slow and bandwidth heavy site.
* Google for “Dotclear”, get the first result with no description (“No information is available for this page. Learn why”) - not a good first impression
* Dotclear website’s theme is ugly verging on purposefully ugly. At least WP default themes look decent
* Click on “About” to see what this runs on (homepage doesn’t tell me), nothing loads. Oh! I have to click one of these header tabs/links, odd… “About” -> “Overview” still doesn’t tell me what language this is written in. Click “Pre-requisite” finally see it’s PHP+(MySQL/Postgres/SQLite)
For software that’s been around since 2003 I kind of expect better and I expect have heard of it since back in 2009-2011-ish I was doing a fair bit of WP development.
Quick judgments and strong opinions have unfortunately become part of the community.
Having spent the last 2-3 months working excessively on WordPress development, I would like to say a word about the excellent isolation of code with blocks ("Gutenberg"). As standalone plugins or in combination with Advanced Custom Fields, these allow for perfect, modular websites and development flows (design system), where even the HTML is 100% in your own hands. I can recommend everyone to understand and learn WordPress properly.
Can you recommend some of the better ways to understand and learn it properly?
(Worked with it extensively 2009-2011, including authoring/modifying plugins, but never felt like I really understood it, only vaguely understood/appreciated it)
What's the best skeleton theme to build your own theme on in 2024, that supports Full site editing, Gutenberg etc?
After a decade away from WP I wanted to set up a new site. The default 2024 theme doesn't meet my needs, and I couldn't find a modern skeleton theme where I could add in Tailwind and build what I wanted. I've used https://roots.io/sage/ previously but they're moving further and further away from the WP way of doing things.
Edit: or instead of a skeleton theme, a good free FSE theme to build on?
One of my first programming moments when I was a child - I naïvely opened the wp index.php to understand how it works. I remember I couldn't understand a thing except the comment in the top of the file "code is poetry".
Dear op thank you for changing my mentality about code, inspiring me and pushing me into it.
It sure seems that way until you need to get just a little bit deeper and you realize what a dumpster fire WordPress is.
You want metadata on posts, you install ACF. You want to filter on that metadata, good luck if it's over a couple filters simultaneously, the SQL queries will time out. Take a look at WP's insane schema to figure that one out.
Gutenberg promises to have WYSIWYG editable React components, which is a big deal, but they made insane decisions like storing the attributes in HTML, rendering HTML in the database, and requiring component developers to keep an array of deprecated changes when they want to modify anything on the component.
There are some people trying to untangle Wordpress by refactoring and bolting Laravel onto it[1], but every layer is just a nightmare; the authors of different parts can barely assess why things randomly break.
You might find WP appealing for the plugin ecosystem, but the plugins are completely random in implementation, so you're likely to get a bloated scramble of CSS and JS pushed to your users.
I moved to Directus and Astro, but I would probably use a Laravel-based CMS like October or Statamic for more generalized PHP deployment.
I think most peoples judgments have been formed over 21 years. WordPress initially gained a reputation for being a fast and easy way to setup a website, then gained a reputation for being a security nightmare.
Maybe its not anymore but people are right to be sceptical. I sure do see a lot of CVEs in the weekly update I check - maybe they're all low risk, or relate to rarely used plugins.
I think the root of bad reputation was due to various plugins and their usage pattern:
lots of non-tech users heard that they can use plugins X Y Z for fun and profit, so they started to use them, but no one told them that managing dependencies requires some skill or at least discipline; that the fact some 3rd party pluggable software exists doesn't automatically mean it's good, viable, maintainable and safe; and that things in IT don't work by means of cargo cult, copy-pasting without underdstanding and by crossing fingers. So, there was a fallacy: these people believed (and many believe until this day) that they can remain being non-tech users while maintaining their wordpress-with-plugins installation, but it's impossible; one needs to become tech-aware in the process.
I am not sure what WP community did to dissolve this fallacy; maybe they did something. maybe didn't.
We've expanded our HackerOne and other security apparatus to cover the top 100 plugins directly and do our best to work with every plugin in the directory, including many contributions from web hosts who of course want their sites to be secure. The update system has become very robust, and all the top hosts also protect their sites at the network layer so many CVEs are blocked even if the code hasn't been updated yet.
I'm doing what you're proposing literally right now.
I have a fascinating error 500 on production because somehow, somewhere, today Gutenberg and ACF w/Blocks are having a disagreement on parsing the content of a nested media field. Which could be ranging from "the user added an image description where he shouldn't have" to "a global object from a plugin is polluting other global objects passed to acf_register_block_type()".
Maybe I should call the already irate client and tell him he should avoid quick judgments and strong opinions.
By the way, the issue was cunningly appropriate for this thread: Considering that in wordpress EVERYTHING is stored in the DB as an article in the WP_POST table (Yes, even stuff like attachments, images, and the menus) an hook from a slider plugin was messing up with the image descriptions, which are stored as...the main body text of an article. Which is actually an image.
In a classic wordpress install this would just cause some weird garbage in the output, but given that in a gutenberg+ACF setup the content data is passed to the React/Block rendering engine, it would absolutely go crazy.
This was a bit of a reaction to other CMSes that were creating dozens or hundreds of tables, which creates a different set of problems for things like search or overly complex joins.
WP is the perfect tool for 95% of the job with the last 5% of tweaking being incredibly frustrating. I've used it extensively and it's longevity is a testament to its usefulness may it be around for another 21yrs.
No matter how long it has been, on the one hand, WordPress can be seen as a victim of its success, as widespread adoption has led to various challenges such as security vulnerabilities and performance issues after maintining clients' website for the past 3 years. There are remaining security that is essentials and yet not many website does it correctly.
Nah, that’s not how it works. People are also complaining about the quality of Google‘s search results, but has anyone come up with a something that can beat them?
Technically, yes! But practically, Wordpress has such a velocity, it’s mostly impossible to stop at this point. There’s an ecosystem of millions of plugins, themes, entire agencies around Wordpress, that’s something you can’t really solve.
So just because Wordpress sticks around doesn’t mean it’s the superior solution; it just happened to suck less than the competition a decade ago.
I think developers underestimate the ecosystem and community aspects. Software is definitely not a space where "if you build it, they will come". There is better codebases, but no one has held a candle to the ecosystem yet. I believe this is because the core users of WP are not it's developers, the users (admins, agency clients etc) hold a considerably larger stake in typical business engagements.
I have been doing eComm agency work for years and even if the chosen eComm platform does have a CMS, we're very often asked to integrate a wordpress site for the company's marketing/content team to use.
People are also complaining about JS/PHP/Python, Excel, JIRA, people-complaining, Windows, Teams, Google, death of RSS, ...
I think it helps some people re-evaluate their decisions, helps products to get some unfiltered feedback, and perhaps motivate entrepreneurs to analyze the market needs. What's there to complain? :)
It’s HN. This is where WordPress comes to get bashed :-)
Although - to be fair, I’m not seeing nearly as many anti-WP comments as you’d expect here - most people are being reasonably balanced with their criticisms.
As a long time WP agency owner I agree with a fair number of the comments.
My main beef now with the platform is that there are three fairly distinct types of WordPress in 2024.
1) “Classic” WordPress with no Gutenberg: great for data rich sites where you want many custom post types and taxonomies
2) “Gutenberg” WordPress for rich front end editing
3) “FSE” WordPress for quickly throwing up a one pager or simple brochureware site
I wish WP was a bit more vocal about explaining these types and how they differ. And in fact I think they’re sufficiently distinct that the installation path should be explicit about these types and which to choose.
There are of course endless things that really should be in core and not provided by plugins - it’s sometimes galling to have a team pushing endless changes out to Gutenberg when the underlying software doesn’t have obvious stuff. Page duplication, acf style custom field support, rich seo, sitemaps, better media handling, etc - all of this should just be there without plugins.
But - as said above, it’s easy to snipe and overall I bloody love most of the whole ecosystem :-)
I love Wordpress. People install it on their own, install dozens of useless, unsecure and buggy plugins ("it's easy, just clic clic clic... I love my admin panel !") and after a while their websites break and then we can charge them for a more secure and resilient solution.
They sure made it enticing to install plugins, if not just by putting this UI to the forefront. Also, when images aren’t compressed by default, it’s a perfect alliance with the various SEO analyzers which mandate you to compress them…
Back in 2011, I had the pleasure to take a peak at the sociable plugin (#2 on their plugin ladderboard) and it was one of the more brittle and bloated piece of code I ever saw. Felt like an unfinished weekend project that dragged too long and ended up published, 5 screens long for loops over massive globals, duplicated to then do whatever.
I avoided wordpress like a plague. Used stuff like django, flask, grav and who knows what. But recently I had to make a website with lots of unknowns which needed to be authored by dummy users and I just said ** it and went with wordpress.
What I struggled with are: 1) Interesting site design, 2) custom functionality through plugins, 3) making it easy to add pages and blog posts with a nice editor.
I'm glad open source solutions exist, but I swear, they always have drawbacks. Either they are code heavy, plugins are out of date, maintenance takes a lot of time or there is no way to easily design a page.
So for Wordpress I bought Oxygen, for which you can still buy a lifetime license for, and oh my god, even I can make a nice, responsive website without touching code. It's such a game changer.
I think lots of people avoid wordpress because of security. But that is not primarily a wordpress fault. Linux & PHP complicates it a lot. And I'm sure those other open source projects have severe bugs, too, but nobody knows or talks about them.
What could bring down wordpress, imho, are expensive license fees for plugins. Who wants to spend 50 to 100 bucks per year and per page for a builder plugin? Everyone wants one, but no one wants to pay yearly. And it seems that all plugin makers are starting to go that way.
I agree about builder plugins -- they are expensive mossy lock-in.
WordPress now has a full-site editing system that lets you GUI edit the templates that are in the normal flow. It is not what I would call easy to master at the code level, but there is a global styles system and a way to use Gutenberg blocks to control layout outside the main content flow.
So we are getting towards a point where page builder plugins won't be needed for skilled shops. But IMO until there are really easy to use themes based around FSE (there may be some), small design shops are still likely to use Elementor, which is a slow, frustrating experience (slower and more frustrating than Squarespace can be)
There are a few deeply frustrating things, if you ask me:
All the media files are stored in a single uploads/year/month (maybe year/month/day) directory, which can mean some very big directories of file variations
There's code that cannot be fun to support anymore, like the Pluggable functions (that still let you get Wordpress to check some external login system)
There's still really not enough of a sense of a "model" anywhere.
It still (AFAIK) stores some things in the database using PHP serialization (which is unambiguously the most annoying serialization format on earth, and means that search and replace tasks must be done in PHP)
I mean... it's hard to blame them for not wanting to break stuff, and the commitment to backwards-compatibility is very nearly unprecedented.
I think WordPress is great, and I am not judging. I'm just saying, there are decisions that might have gone better with a little more foresight. But some of them are literally twenty years old and hard to change now.
Not that WP is alone in that -- FreeCAD is just getting through its "fix a two decade legacy problem" as we speak!
Matt is right about zip uploads. I mean it's better than explaining to random users how to upload nested hierarchies over FTP, but still.
I've "inherited" a website using Divi for all of its styling.
It's absolutely one of the worst pieces of commercial software I've ever seen. Just saving a blog post is capable of putting the entire website in an unrecoverable condition if there's even the slightest timeout in the execution of the terrifying javascript UI they wrote on top of Wordpress. The italian and french localization is genuinely abysmal, on par with some japanese games from the '90s. Responsive options are absolutely non-working, unless by responsive you mean "hide and show content on specific breakpoints". And even then, everything is absolutely brittle given that the front-end "theme" is basically an unreadable dump of jquery-era javascript.
I'm 100% sure nobody would use that if Elegant Themes (Divi authors) weren't massively spending on advertising.
I checked it out around the same time Mark Pilgrim moved to it. Movable Type came and went but to their credit they tried a GPL version but sadly OpenMelody never caught on.
This isn't true at all. The vacation policy is "Our time off policy is short: take the time that you need" and "There is no minimum or maximum, but we encourage you to take at least 25 days of time off per year".
Haven't used it a lot in the last decade, but WordPress was great for quickly setting up a basic website that needs a nice beginner friendly CMS.
Just make sure you stick to the base theme with a custom child theme and only use a select few plugins (like custom fields and contact form), that don't stab you in the back or begin to fight with each other later on.
I just still don't understand how Gutenberg is an improvement. It's so clunky and confusing to get even the most basic things done with it.
My gf has a WP ecommerce site that her business revolves around, it was built buy some local guys doing WP development who have an agency solving problems just with WP. She told me how fast they were able to iterate and solve all their problems. The site has a bunch of plugins integrating various social services, ad tracking, SEO and whatnot.
The site generates PDF shipment labels for parcels, one day her sales got high enough to buy a label printer, one that spits out 10x15cm stickers. The problem - PDFs from the site come out as A4 and text gets tiny if squeezed to fit into that sticker. She asked her developers to fix it, they said it's impossible and refused. Now that's interesting, nothing is impossible I shouted with my nerd hat on. I'm in the tech space for a good few decades now, I have FAANG experience, complex systems are my thing!
I spent 5 hours diving through tons of spaghetti code plugins masquerading as highly abstracted set of interfaces to arrive at the conclusion that these guys were right, the PDF blob comes from the shipment company's SOAP API, though it's obfuscated deep enough. In the end I solved it with a simple PyQT+fPDF UI utility to crop out the printable parts and project them onto the right sized canvas for printing, it took me 2h to complete with binary packaging and all, less time than it took to understand why the WordPress site can't do it natively, and much less than than it would have taken me to integrate this PDF modification into WordPress. These guys were basically right.
Her site now backs up to 4GB zip with photo assets. I dread the day when her site goes down due to some "hack" but I have no idea how to replicate this functionality for this cost without WP. No way in hell I would say I can do it from scratch for her, my previous Web dev experience doesn't matter at this point. Shopify? Sigh.
4GB? Those are rookie numbers. I have a site where /wp-content/ is 20GB. Tens if not hundreds of thousands of images that have been auto generated by WordPress because of how thumbnails and minifaction works, but also converting images to WebP. And if you delete old posts or any other content, the images stay.
And it’s my understanding that there is no safe way to remove unused images. I have tried to do it using the in-built media manager but eventually I gave up because it’s tedious and I don’t want to risk leaving pages without images by accident.
But 20GB is not a big deal these days, even cheapest hosting solutions give "unlimited" storage (only limited by inodes mostly, but those go into absurd numbers too).
In my eyes it's more optimal to just don't worry and take the WordPress site as simply a tool - yes, it will break after 5 years, but by that time you would have needed new site anyway.
It's amazing how much lock-in you get by developing ecommerce sites with WP for clients. Her site was recently down, just didn't load. She paid a few hundred for the agency to take a look, they said they updated plugins and "removed viruses" and all is good again. If you're someone not technical or without a huge sum of money to pay someone to replicate the functionality to migrate off WP you're on the hook for the life of business.
You can migrate hosts but that's about all the freedom you have, paying Shopify 20-30 USD / mo is nothing compared to what you'll have to eventually pay with WP if you build your business around it IMHO.
182 comments
[ 3.0 ms ] story [ 213 ms ] threadSo many cool projects die because people over-complicate the first steps. You can always make it better later if people start using your thing, but first you gotta ship.
It’s so bad, the PHP language developers are unable to implement some features/fixes in the language, as the Wordpress team refuses to migrate their code, which makes for a huge chunk of PHP usage. Imagine that.
If WordPress has a stabilizing influence on php that's even better. All the breaking changes of the new versions are a nightmare for an established project I work on.
I would not hesitate to take this position. Of course it depends, on how severe the bugs are, especially for the outer code (like plugins) calling it, and on how bad the performance is. But otherwise absolutely, never break user space.
> The environment it runs in changes
The web environment Wordpress runs in did not change all that much. The JS ecosystem simulates big changes, but that's all bullshit. Server code that worked 30 years ago still works - if projects like PHP don't go out of their way to break it.
Neither the Linux kernel, nor OpenSSL, or any other reasonably complex project manages to do that over a given time frame. Sometimes you need to adapt, and things break in the process. Nobody would expect a house built 30 years ago to not require some maintenance and upgrades over time.
> The web environment Wordpress runs in did not change all that much. The JS ecosystem simulates big changes, but that's all bullshit. Server code that worked 30 years ago still works - if projects like PHP don't go out of their way to break it.
That sure sounds good, but is simply not true. We went from HTTP and FTP deployments to TLS and containers, from dialup to gigabit consumer uplink; the browser isn't a remote document viewer but a platform-agnostic virtual machine for fully-fledged applications; the web is centred around a few enormous platforms; people regularly stream GBs worth of video and expect services to deliver web apps on a variety of devices; they don't post on bulletin boards and in news groups, but use chat services; scammers distribute ransomware, steal your identity, remotely take compromising pictures from your webcam, or order stuff from your shopping accounts online. The modern web has almost nothing in common with the one from 30 years ago.
Sure it's true. Many users are still doing deployment FTP-style, even if it's not the original protocol anymore. That the pipes are bigger just meant we could up the thumbnail size, and the browser is still also a remote document viewer for sites that don't demand more. I just today answered a support question on a bulletin board, and so on.
There are other aspects of the web today, but the old way still exists.
> Nobody would expect a house built 30 years ago to not require some maintenance and upgrades over time.
You can do upgrades of software in a way that does not break compatibility, and you can definitely always aim to minimize breakage. Wordpress is not a bad example for just that. HN itself counts as a further example. If it weren't possible we wouldn't have this thread to discuss in.
I'd be horrified to expose ANY software written 30 years ago to the internet, if it touches money or valuable data in any way.
So this to me looks like WP is progressing with PHP, just slowly.
Frankly I don't have a massive problem with this.
The speed of Laravel's PHP baseline change may be appropriate for Laravel, because it is git-managed, more easily run in a container etc., but it's absolutely inappropriate for WordPress to chase the edge.
Compared to trying to stay up-to-date with needless Node.js changes and frameworks that get EOL'd as soon as there's something more fun to play with, it's a paradise.
Why don't people build things with a decade of life in mind?
Without hesitation, I'd proclaim I could easily make those changes!
Then I'd load their site, load their plugin/theme code and css files, struggle for hours to get the desired effect, and even if I got it to work, I would break every other part of their site.
---
Denigrating anecdote aside, good job Matt, loved the story at the end.
Once you spend some time in the codebase and understand a bit of its legacy history it gets easier over time. A lot of plugins and solutions are aimed towards non-technical users and a lot of overlap. Where we might just write up some custom HTML others might install 3 plugins to make it work.
Thankfully there was a recent consolidation in a plugin called Admin & Site Enhancements (ASE). Probably got rid of 10 others with this thing. Includes duplicate post/page, admin menu cleanups & reorganization, hiding dashboard widgets, cleaning up the top bar, changing the login URL, an easy way to setup SMTP delivery, media replacement, hides the annoying admin notices, and a bunch more.
A lot of the stuff you want to do can be maintained at the command line. And it even gives you a way to do some fleet management.
I am not against wordpress in general, just that I found it not suited for my purposes.
The downside is that much of the code in WP core is effectively un-modernizable, given how much depends on things working a certain way. Key classes and functions haven’t been meaningfully updated in over a decade.
Got something to say about how WP compares to others when it comes to man-hours (assuming you can buy any and all plugins you want)? Honest question, because I have no idea about CMS.
> they overprice and they forget people use multiple plugins
People who complain about the prices also forget that a lot of these plugins take months or years to develop. You’re (we’ll not you since you made it clear you don’t pay the devs) literally getting thousands of man hours for like 60 bucks per year.
but it didn't start out as an 800 lb gorilla. Simply saying it's an 800 lb gorilla in the room is lazy.
Well yes and no. They were very few good blog focused CMS at the time. A contemporary one that comes to my mind and that actually predate Wordpress was Dotclear (which is still alive and still focusing on blogging). More general CMS like Typo3, Drupal, SPIP, Plone to name only a few open source ones were already around too and much more capable than Wordpress was.
What Wordpress did very well at the beginning, was focusing on one thing: blogging for non technical people. It was a much more limited software but that made it much easier for so much people. And it came exactly during the blog boom and only with time became a more general purpose CMS. But if you had to build a website for your business it was a very bad choice at the time.
Bottom line: making good software is one thing, but timing is everything.
Absolutely so. Those are things for people to play, while the only thing taht matters is value. Does clean code provide value? No. Does security? No either.
At least it isn't Magento.
Yeah. Like, for example, forcing users to install the "Classic Editor" plugin to use, well, a normal editor that is more than sufficient for a blog.
You do have to lean in slightly to how Gutenberg and Full Site Editing works -- I recommend this amazing documentation site:
https://fullsiteediting.com
* Dotclear website’s theme is ugly verging on purposefully ugly. At least WP default themes look decent
* Click on “About” to see what this runs on (homepage doesn’t tell me), nothing loads. Oh! I have to click one of these header tabs/links, odd… “About” -> “Overview” still doesn’t tell me what language this is written in. Click “Pre-requisite” finally see it’s PHP+(MySQL/Postgres/SQLite)
For software that’s been around since 2003 I kind of expect better and I expect have heard of it since back in 2009-2011-ish I was doing a fair bit of WP development.
A couple essential ones for me are Advanced Custom Fields Pro and Admin Columns Pro.
Having spent the last 2-3 months working excessively on WordPress development, I would like to say a word about the excellent isolation of code with blocks ("Gutenberg"). As standalone plugins or in combination with Advanced Custom Fields, these allow for perfect, modular websites and development flows (design system), where even the HTML is 100% in your own hands. I can recommend everyone to understand and learn WordPress properly.
– no relation or connection to WordPress.
(Worked with it extensively 2009-2011, including authoring/modifying plugins, but never felt like I really understood it, only vaguely understood/appreciated it)
https://fullsiteediting.com will help you.
It's a great project.
After a decade away from WP I wanted to set up a new site. The default 2024 theme doesn't meet my needs, and I couldn't find a modern skeleton theme where I could add in Tailwind and build what I wanted. I've used https://roots.io/sage/ previously but they're moving further and further away from the WP way of doing things.
Edit: or instead of a skeleton theme, a good free FSE theme to build on?
I am tempted by Anders Norén's Björk, which is also FSE:
https://andersnoren.se/teman/bjork-wordpress-theme/
I think I did most of my learning with Carolina's own Jace theme.
(FWIW I have always thought the roots.io stuff is a mistake, conceptually.)
Dear op thank you for changing my mentality about code, inspiring me and pushing me into it.
You want metadata on posts, you install ACF. You want to filter on that metadata, good luck if it's over a couple filters simultaneously, the SQL queries will time out. Take a look at WP's insane schema to figure that one out.
Gutenberg promises to have WYSIWYG editable React components, which is a big deal, but they made insane decisions like storing the attributes in HTML, rendering HTML in the database, and requiring component developers to keep an array of deprecated changes when they want to modify anything on the component.
There are some people trying to untangle Wordpress by refactoring and bolting Laravel onto it[1], but every layer is just a nightmare; the authors of different parts can barely assess why things randomly break.
You might find WP appealing for the plugin ecosystem, but the plugins are completely random in implementation, so you're likely to get a bloated scramble of CSS and JS pushed to your users.
I moved to Directus and Astro, but I would probably use a Laravel-based CMS like October or Statamic for more generalized PHP deployment.
[1]: https://roots.io/
I think most peoples judgments have been formed over 21 years. WordPress initially gained a reputation for being a fast and easy way to setup a website, then gained a reputation for being a security nightmare.
Maybe its not anymore but people are right to be sceptical. I sure do see a lot of CVEs in the weekly update I check - maybe they're all low risk, or relate to rarely used plugins.
lots of non-tech users heard that they can use plugins X Y Z for fun and profit, so they started to use them, but no one told them that managing dependencies requires some skill or at least discipline; that the fact some 3rd party pluggable software exists doesn't automatically mean it's good, viable, maintainable and safe; and that things in IT don't work by means of cargo cult, copy-pasting without underdstanding and by crossing fingers. So, there was a fallacy: these people believed (and many believe until this day) that they can remain being non-tech users while maintaining their wordpress-with-plugins installation, but it's impossible; one needs to become tech-aware in the process.
I am not sure what WP community did to dissolve this fallacy; maybe they did something. maybe didn't.
The real problem is the plugin ecosystem, which is not impossible to navigate for the disciplined, but at times bears resemblances to the Wild West.
So, what ends up happening is:
1. Cheap ’experts’ install every plugin under the sun.
2. One of these plugins inevitably gets pwned.
3. Headline: ‘WordPress backdoored’.
I have a fascinating error 500 on production because somehow, somewhere, today Gutenberg and ACF w/Blocks are having a disagreement on parsing the content of a nested media field. Which could be ranging from "the user added an image description where he shouldn't have" to "a global object from a plugin is polluting other global objects passed to acf_register_block_type()".
Maybe I should call the already irate client and tell him he should avoid quick judgments and strong opinions.
In a classic wordpress install this would just cause some weird garbage in the output, but given that in a gutenberg+ACF setup the content data is passed to the React/Block rendering engine, it would absolutely go crazy.
The fact that people use it for something else is what create strong opinions.
Example : woo commerce.
Products ? In the WP_POST db. Orders ? In the WP_POST db.
And in every post about WP it says that using WP_POST for storing your data is good practice.
Well I don't think it is (but it's only my opinion. A strong one).
And the problem is that a LOT of plugins and themes are like that.
> Orders ? In the WP_POST db.
No longer true, at least for new installations: https://woocommerce.com/document/high-performance-order-stor...
Technically, yes! But practically, Wordpress has such a velocity, it’s mostly impossible to stop at this point. There’s an ecosystem of millions of plugins, themes, entire agencies around Wordpress, that’s something you can’t really solve. So just because Wordpress sticks around doesn’t mean it’s the superior solution; it just happened to suck less than the competition a decade ago.
I have been doing eComm agency work for years and even if the chosen eComm platform does have a CMS, we're very often asked to integrate a wordpress site for the company's marketing/content team to use.
I think it helps some people re-evaluate their decisions, helps products to get some unfiltered feedback, and perhaps motivate entrepreneurs to analyze the market needs. What's there to complain? :)
Although - to be fair, I’m not seeing nearly as many anti-WP comments as you’d expect here - most people are being reasonably balanced with their criticisms.
As a long time WP agency owner I agree with a fair number of the comments.
My main beef now with the platform is that there are three fairly distinct types of WordPress in 2024.
1) “Classic” WordPress with no Gutenberg: great for data rich sites where you want many custom post types and taxonomies
2) “Gutenberg” WordPress for rich front end editing
3) “FSE” WordPress for quickly throwing up a one pager or simple brochureware site
I wish WP was a bit more vocal about explaining these types and how they differ. And in fact I think they’re sufficiently distinct that the installation path should be explicit about these types and which to choose.
There are of course endless things that really should be in core and not provided by plugins - it’s sometimes galling to have a team pushing endless changes out to Gutenberg when the underlying software doesn’t have obvious stuff. Page duplication, acf style custom field support, rich seo, sitemaps, better media handling, etc - all of this should just be there without plugins.
But - as said above, it’s easy to snipe and overall I bloody love most of the whole ecosystem :-)
You can have a full fledged site and blog using it. Not sure what you mean by this comment.
https://en.wikipedia.org/wiki/Economic_moat
https://en.wikipedia.org/wiki/Barriers_to_entry
https://en.wikipedia.org/wiki/Sunk_cost#Fallacy_effect
Something can be mind-numbingly bad, yet be almost impossible to dislodge.
What I struggled with are: 1) Interesting site design, 2) custom functionality through plugins, 3) making it easy to add pages and blog posts with a nice editor.
I'm glad open source solutions exist, but I swear, they always have drawbacks. Either they are code heavy, plugins are out of date, maintenance takes a lot of time or there is no way to easily design a page.
So for Wordpress I bought Oxygen, for which you can still buy a lifetime license for, and oh my god, even I can make a nice, responsive website without touching code. It's such a game changer.
I think lots of people avoid wordpress because of security. But that is not primarily a wordpress fault. Linux & PHP complicates it a lot. And I'm sure those other open source projects have severe bugs, too, but nobody knows or talks about them.
What could bring down wordpress, imho, are expensive license fees for plugins. Who wants to spend 50 to 100 bucks per year and per page for a builder plugin? Everyone wants one, but no one wants to pay yearly. And it seems that all plugin makers are starting to go that way.
WordPress now has a full-site editing system that lets you GUI edit the templates that are in the normal flow. It is not what I would call easy to master at the code level, but there is a global styles system and a way to use Gutenberg blocks to control layout outside the main content flow.
So we are getting towards a point where page builder plugins won't be needed for skilled shops. But IMO until there are really easy to use themes based around FSE (there may be some), small design shops are still likely to use Elementor, which is a slow, frustrating experience (slower and more frustrating than Squarespace can be)
Like everything, it takes learning. It has opinions.
It has some crazy history (I really wish media items were not handled the way they are), but it also has methodology to it.
If I said I know Go and JS and Perl and Java and Ruby and C, and I was enraged that Rust is so hard to learn, I'd be shot down for it, rightly.
WordPress looks like it does a simple job, but actually it's a whole, quite broad platform. You might have to read some documentation for a bit.
And if you've inherited a site using Elementor, ask the people who made it how to change the simple stuff, because they will be able to help.
If you've inherited a site using Visual Composer or Divi... shoot the people who made it.
If you think Gutenberg is bad (it is very much not, now!)... oh man, Divi was a time.
There are a few deeply frustrating things, if you ask me:
All the media files are stored in a single uploads/year/month (maybe year/month/day) directory, which can mean some very big directories of file variations
There's code that cannot be fun to support anymore, like the Pluggable functions (that still let you get Wordpress to check some external login system)
There's still really not enough of a sense of a "model" anywhere.
It still (AFAIK) stores some things in the database using PHP serialization (which is unambiguously the most annoying serialization format on earth, and means that search and replace tasks must be done in PHP)
I mean... it's hard to blame them for not wanting to break stuff, and the commitment to backwards-compatibility is very nearly unprecedented.
I think WordPress is great, and I am not judging. I'm just saying, there are decisions that might have gone better with a little more foresight. But some of them are literally twenty years old and hard to change now.
Not that WP is alone in that -- FreeCAD is just getting through its "fix a two decade legacy problem" as we speak!
Matt is right about zip uploads. I mean it's better than explaining to random users how to upload nested hierarchies over FTP, but still.
It's absolutely one of the worst pieces of commercial software I've ever seen. Just saving a blog post is capable of putting the entire website in an unrecoverable condition if there's even the slightest timeout in the execution of the terrifying javascript UI they wrote on top of Wordpress. The italian and french localization is genuinely abysmal, on par with some japanese games from the '90s. Responsive options are absolutely non-working, unless by responsive you mean "hide and show content on specific breakpoints". And even then, everything is absolutely brittle given that the front-end "theme" is basically an unreadable dump of jquery-era javascript.
I'm 100% sure nobody would use that if Elegant Themes (Divi authors) weren't massively spending on advertising.
Nah
Just make sure you stick to the base theme with a custom child theme and only use a select few plugins (like custom fields and contact form), that don't stab you in the back or begin to fight with each other later on.
I just still don't understand how Gutenberg is an improvement. It's so clunky and confusing to get even the most basic things done with it.
The site generates PDF shipment labels for parcels, one day her sales got high enough to buy a label printer, one that spits out 10x15cm stickers. The problem - PDFs from the site come out as A4 and text gets tiny if squeezed to fit into that sticker. She asked her developers to fix it, they said it's impossible and refused. Now that's interesting, nothing is impossible I shouted with my nerd hat on. I'm in the tech space for a good few decades now, I have FAANG experience, complex systems are my thing!
I spent 5 hours diving through tons of spaghetti code plugins masquerading as highly abstracted set of interfaces to arrive at the conclusion that these guys were right, the PDF blob comes from the shipment company's SOAP API, though it's obfuscated deep enough. In the end I solved it with a simple PyQT+fPDF UI utility to crop out the printable parts and project them onto the right sized canvas for printing, it took me 2h to complete with binary packaging and all, less time than it took to understand why the WordPress site can't do it natively, and much less than than it would have taken me to integrate this PDF modification into WordPress. These guys were basically right.
Her site now backs up to 4GB zip with photo assets. I dread the day when her site goes down due to some "hack" but I have no idea how to replicate this functionality for this cost without WP. No way in hell I would say I can do it from scratch for her, my previous Web dev experience doesn't matter at this point. Shopify? Sigh.
And it’s my understanding that there is no safe way to remove unused images. I have tried to do it using the in-built media manager but eventually I gave up because it’s tedious and I don’t want to risk leaving pages without images by accident.
In my eyes it's more optimal to just don't worry and take the WordPress site as simply a tool - yes, it will break after 5 years, but by that time you would have needed new site anyway.
Nothing though gives me the feeling of dread that I get when my partner's business WP site goes down and she asks if I can take a look.
You can migrate hosts but that's about all the freedom you have, paying Shopify 20-30 USD / mo is nothing compared to what you'll have to eventually pay with WP if you build your business around it IMHO.
If I hadn't named the exact issue for her in her communications I'm sure a consultant would have happily shaken her down for the same.
To be fair though, we get the same at work with Salesforce consultants