I feel like WordPress sort of "wraps around" (quality horse-shoe, it was so bad but popular that now it's good). Core WordPress is one of the most audited codebases on the planet, it has a ton of duct tape and scar tissue.
Any new relevant bug classes, people will tend to look for it and fix it in WordPress first, because practically every bounty program has one or more instances somewhere.
People aren't doing these kinds of attacks against WordPress plugin distribution because it's uniquely vulnerable. They're doing it because WordPress is incredibly popular.
If you need the stuff WordPress can do and can't get away with a static site, IMHO it's usually still the best choice.
Main caveats being, plugin quality varies very widely (including at supply chain level), and you can quickly run into issues if you get an agency to customise and they do a bad job.
From a technical sense there are plenty of alternatives, even similarly disliked platforms like medium or wix.
The problem is none of them are interested in turning a basic CMS into a wasteland of kitchen sink functionality that aims to turn blogging software into the ultimate web swiss army knife.
People are happy to build blog software, but that's not what WordPress' customer base wants. They want professional services in the form of a grab bag of sketchy plugins. Nobody's going down that path again.
If the goal were simply "let's build a better blogging platform" or "let's build a better storefront platform" or "let's build a better music venue website platform" there might be a receptive audience. But the goal is "let's build all three in one and also 500 other use cases." Who would see that as a compelling goal in 2022.
I concur, many of my clients are 'rescues' from Wix and Wordpress and the only thing more hated than Wordpress is Wix.
More often than not it comes down to the horrifyingly confusing documentation, inconsistent UX, hilarious over-promising the world + dog on landing pages, etc.
Also, exfiltrating a website from Wix (changing the nameservers, which should take two seconds, like it does with any other hoster) is a huge ordeal. They make it very difficult.
To be fair, I referred to it as "similarly disliked." From a technical sense I'm less afraid of malicious plugins destroying my business like I might be with WP.
My stance is if I'm doing X, my preference is to find software or a platform that does X but not X, Y and Z.
landing on a Wix page is noticeably worse for someone who tries to limit ads and scripting. Everything has to pretty much be off for a Wix page to work, it is very heavy.
I can see how the lack of plugins may make it more secure though. I haven’t tried Wix, but squarespace is pretty good for getting something out the door quickly. It’s quite limited otherwise and the customization of wordpress makes it a very appealing CMS for most.
If WP provides security screens for add-ons and integrates it into their hosting business it would protect their ecosystem moat.
Storefront... you have Shopify. The most valuable use case, people are building those. The problem is people want a million different things for lots of other stuff. Shopify now has its own ecosystem too. It's the nature of creating popular platforms that businesses rely on.
Exactly, as much as I dislike dealing with it, it does allow our sales and marketing people to do things like publish content, fiddle with SEO, deploy custom redesigns of the website, etc. Without much support from me. That's important for me because I have more important things to do.
We've had multiple people do work on this setup. When we get new people in, they already know how to work with it because it is so widely used. We had a sales person with some Wordpress experience setting up things like CMS integrations, do some basic SEO, etc. Then recently we had a new designer that got busy redesigning our website. All that stuff happened without support from my side. That happened multiple times actually since we have been working with student trainees a bit. It's great. These people come in and they know how this stuff works already and get things done without me having to spend a lot of time on it.
That's it's main redeeming feature. It's horrible for technical people to deal with but it's main feature is that non technical people are able to use it without requiring assistance from technical people. All I do is makes sure it stays up to date, is configured properly, and make sure backups happen.
Other CMS solutions are available of course and I would recommend anyone in a position to choose to use some hosted and managed solution. Something like Squarespace or whatever rather than setting up their own wordpress server. But there's nothing that comes close in terms of non technical people actually knowing how to work with it. It's been the go-to solution for this stuff for a very long time now.
> That's it's main redeeming feature. It's horrible for technical people to deal with but it's main feature is that non technical people are able to use it without requiring assistance from technical people.
Which also makes it kind of a Black Swan risk: it's fine for the majority of times. Preferable, because it leaves you to do other work. But when sh*t hits fans, it hits it bad. If you cannot afford your tech-staff to spend two hours a week supporting the website, you certainly cannot afford them to spend days cleaning out some backdoor, infected servers, acquiring untainted IPs, getting off spam-lists and so on. Or afford the ransom if hit by a crypt-locker.
> All I do is makes sure it stays up to date, is configured properly, and make sure backups happen.
And that is more than most do. But, unfortunately not enough. Given the amount, frequency and severety of holes and exploits in the larger WP ecosystem. All you might be doing, is backup that ransomware, spamscript or backdoor for months. Encrypted, offsite and incremental, probably.
Honestly, if you use wordpress for the basic functionality and don't install plugins, it's pretty nice. You got a fully functional blog, you can give non-technical users a login and they know how to use it too.
You do have to be really careful about what plugins you install, but there are useful ones out there.
Wordpress is similar to forum software in that the modern landscape have diversified and depending on what you are trying to accomplish there are a ton of alternatives. Almost none of them are a reimplementation of what Wordpress does though since it comes from a time where you would purchase shared hosting that came with Apache, PHP and MySQL built in. It’s a giant monolith that is as widespread as it is because 90% of everyone who started a website in the 2000s used Wordpress.
WP is way past being a blogging platform. Try: replacement for online multi-role portal editor with knowledgebase, shop, forum, stock management, image gallery, document converter, .... elements installable in 2 clicks.
I see Wordpress as a kitchen knife that is being sold to all ages - I did have more to say in reply to your question, but the more I think about it, the more I think that analogy speaks for itself
None of those have a plugin ecosystem that remotely approaches WordPress's, let alone the bevy of WP-specific consultants. It is not much of an exaggeration to say that companies can make WordPress do anything without any real programming on their part; this is just not true for the developer-focused alternatives, no matter how much better they are on a technical level.
Publii doesn't work well when you want to edit your one blog from multiple computers. Hugo or whatever is not much of a stretch and you can edit from your laptop and desktop w/ git.
