Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Wordpress?

johnmaeda.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: Why Wordpress?

#51

Post by rmccue »

jedimastert wrote: post #31
gravypod wrote: post #12

Earlier quoted context omitted.

Another not-WordPress alternative is a software called NibbleBlog [0] which is nice because it's also written in PHP and will likely be easy for existing wordpress admins to deploy. No change in tooling. This also doesn't require a DB, it can run from flatfiles. [0] - http://www.nibbleblog.com/

>This also doesn't require a DB, it can run from flatfiles. How difficult would it be to get WP to run off of sqlite? I'm not familiar with the code base to know.

> How difficult would it be to get WP to run off of sqlite?

Hard, but not impossible. WP has a pluggable database connection class that you can override, but it doesn't have a DBAL. You'd have to modify queries to remove MySQL-specific things.

It is possible though: https://wordpress.org/plugins/sqlite-integration/

Re: Why Wordpress?

#52

Post by rmccue »

partiallypro wrote: post #42
at-fates-hands wrote: post #22

Earlier quoted context omitted.

I would also look into the myriad of static site generators that are probably much faster than the WP static site plugin and use modern tools and libraries. https://www.netlify.com/blog/2016/05/02/top-ten-static-websi... Roots is mentioned, but the team has since developed Spike which is built on a more modern stack: https://github.com/static-dev/spike https://www.spike.cf/

This all defeats the purpose of using Wordpress and making it user friendly for clients. Wordpress could solve a lot of security issues by using a newer version of PHP, but they are scared of breaking legacy items. Also using things like Wordfence and Cloudflare solve most of the basic Wordpress security issues.

> Wordpress could solve a lot of security issues by using a newer version of PHP, but they are scared of breaking legacy items.

There's nothing stopping you from running it on PHP 7.1 (and we are on our client sites). There's not a great amount that could be gained by WordPress (the project) by dropping support for the older versions; the main gains would be namespacing and closures.

That said, I do think it's time to drop 5.2 support. 5.2 is down to single digit percentages: https://wordpress.org/about/stats/

Re: Why Wordpress?

#53

Post by [deleted] »

woah wrote: post #49
mgkimsal wrote: post #17

I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the c…

You can build whatever you want in your theme and build admin for it using custom post types. If you just trawl the bottom of the barrel for any plugin that does kind of what you need, you're going to end up with a nightmare like what you describe.

[deleted]

Re: Why Wordpress?

#54

Post by [deleted] »

woah wrote: post #49
mgkimsal wrote: post #17

I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the c…

You can build whatever you want in your theme and build admin for it using custom post types. If you just trawl the bottom of the barrel for any plugin that does kind of what you need, you're going to end up with a nightmare like what you describe.

[deleted]

Re: Why Wordpress?

#55

Post by mgkimsal »

woah wrote: post #49
mgkimsal wrote: post #17

I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the c…

You can build whatever you want in your theme and build admin for it using custom post types. If you just trawl the bottom of the barrel for any plugin that does kind of what you need, you're going to end up with a nightmare like what you describe.

"the bottom of the barrel for any plugin that does kind of what you need,"

Many of those "bottom of the barrel" solutions are someone else's attempt at building "whatever they wanted" with custom post types, theme options, etc.

Re: Why Wordpress?

#56

Post by Andrenid »

partiallypro wrote: post #46

Wordpress is a great platform if you use well rounded plugins, actively manage it, have it behind a Firewall, and run a security suite (like Wordfence.) But really, you should have any CMS install behind a Firewall. I really like Wordpress, it gets a lot of hate; but it's easy to develop on allowing for fast turn around, has the best editor of any CMS around for client happiness, and has a robust ecosystem. I'm in ch…

Do you have a good guide for setting up a bunch of WP sites securely/properly? The ones I've found all just have a few tips here/there and many conflict each other. Haven't found anything "complete".

Re: Why Wordpress?

#57

Post by rmccue »

lkrubner wrote: post #3

I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point: WordPress has historically been a security nightmare. Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPre…

WordPress out-of-the-box is pretty secure, and there's a team who actively work on security, including a specific security lead. The main issues most people run into are with security of plugins and themes.

This is basically a result of plugins and themes being run as part of the main process (they're just regular PHP code), which is practically-speaking unavoidable.

That's not to say that WP is 100% impenetrable, and any large and mature software is going to have bugs, some of which may turn out to be security-related. The best defence against that is regular updates (inc. auto-updates, which are built in).

(I work at an enterprise WordPress agency where we build large sites for large clients (media orgs, banks, etc). I'm also a committer to WP core, and hence on the WP security team. I'm also one of the leads on the WP REST API project, and was running the HackerOne project until the API was merged into WP.)

Re: Why Wordpress?

#58

Post by kaishiro »

g00gler wrote: post #50
mgkimsal wrote: post #17

I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the c…

What do they use so many plugins for? I took over supporting/developing a WordPress site and one of the first things I did was delete a bunch of pointless plugins. I wound up writing quite a few of my own for different tools and left some third party plugins so there are still probably 10 active between 3 sites on a multisite install. I installed Google analytics directly in the header of the custom themes on each of…

I think you're missing two things: (1) there are clients who demand administrative access, and since they pay the bills, they get it (2) maintainability. As much as I detest WordPress, and as garbage as many of the public plugins are, what would be even worse is having my team take over support for one of your sites with your custom plugins. Ramp up cost is a very real thing.

Re: Why Wordpress?

#60

Post by notlisted »

Dismissed Wordpress for many years, then I found WPEngine (I know, mentioned below, but I have some points to make). Edit: Not affiliated with them in any way. Just a really big fan.

My number one reason for WPEngine is their excellent support, both in terms of response times and general knowledge. They have never let me or a client down.

My time is money (or the client's money). Yes it's much more expensive than self-hosting, but my hourly rates are much more than their professional plan costs each month. One unfortunate issue and they'll spend more on paying me than they'll save on hosting elsewhere for a year. This is also how I "sell" WPEngine to new leads. It's not a hard sell.

I now have 12+ client sites there. Some several years and none have suffered a single issue of a compromised site. I've actually used WPE's (free) service to migrate compromised sites to their platform and get them cleaned as a feature to garner new clients.

The WPE interface allows me to switch between them in an instant. Add to that general performance/caching, security/firewall, automatic updates, daily snapshots and reverting to a previous version with one click, on-demand backups, the staging site functionality, free automated SSL certs, CDN (pro plans), etc etc

It has come to the point that I don't accept any projects that don't agree on hosting there.

PS Fought battles with many different CMSs --e.g. don't even get me started on Joomla or even Drupal-- and don't believe that wordpress is any more vulnerable than other CMS sites. Moreover, there are so many WordPress developers out there, that I can safely promise that me getting hit by a truck is really not a problem.

Edit 2: I limit plugins to the absolute minimum. I avoid free plugins whenever possible. Buying highly rated plugins with support from places like ThemeForest is really really useful and well worth the money.

Post reply on HN