for my company we still see it in use after all these years and countless security incidents because it's just left there. I could not personally ever imagine wanting to install that and thinking it's a good thing.

Recently I have had to help restore one that was completely infected, before we acquired the business. The amount of BS that still is exactly the same as it was the last time i was forced to manage WP in the early 2000's is insane. I get the draw, I just don't agree with it and would never openly advocate for it to be considered.

Every reason to not use it can be excused if you want to make an excuse for it or do something different with it, but at the end of the day it's dated and offers more headache and pain than any usefulness of it as a tool in hosting a site.

Here's some of my bug A boos...

- Doesn't scale

- Wants open permissions on files

- Wants you to use plugins

- Exposes services it doesn't need to expose

- Hardcode's FQDN in links and resources, and everything it can

- Defaults to be the dumbest install settings to make it "easy" for everyone

- Debugging is still a nightmare

- Logging is not consistent

- Maintains state on a machine, preventing you from scaling or high availability

- Codebase has no real framework to extend and use, preference on adding your own bad code to it in order to make it work.

- Does not work well with CI/CD automations

- Is a huge target of vulnerability scanners

- Page updates use a huge post size that is expensive to inspect w/firewall

- Making changes can and will take your site down

- Lets you modify a template file from the gui, but only the first directory level, making you still need to push changes to underlying files in a template.

- Performance is a joke

- Problem with a plugin can crash the full site

- SQL injection is still a significant problem

again, i know someone can rationalize them all away; you are putting in a ton of work that you could have done otherwise with a better solution and not have the ongoing limitations and nightmare associated with it. If you run it, you should consider it to already be hacked and move accordingly.

Often times i hear the argument, well there's nothing i need on there so it's not a security risk...i think your customers would dissagree when they start getting infected with crypto miners, clicking affilitate links that aren't yours, linking to malware, viewing content you didn't add, downloading files that are dangerous, using your hacked system to attack others, and on and on.

edit: format