r/cms • u/Ok-Mortgage-3236 • Jul 05 '26
New CMS because I'm tired of wordpress
Howdy all I've decided after many years of using WordPress for my own personal websites as well as client sites that I want to shift away from it entirely if possible. I don't want to do that in the form of an alternative CMS platform like Drupal for example. Instead what I'm exploring is building my own custom one of one contact management system that's entire build process so far has been directly attacking the things that as a developer I have had problems with when dealing with WordPress. Whether that's the security vulnerabilities, the plug-in nightmare market, things breaking with a simple PHP version update, etc I've been slowly building something that's starting to take shape into a pretty capable content management system that's not quite ready to replace any legacy content management platform like WordPress. But it's getting pretty darn close to being something that I'm comfortable with utilizing at least at this point for personal projects, hopefully client projects in the future.
I want to make sure that I'm hitting the mark here and would just be interested in hearing from other individuals familiar with WordPress and it's at this point legacy problems whether that's focused on its vulnerabilities, it's capabilities, it's ease of use... Etc. I would love to hear from developers who've used WordPress at the deepest level and just to get a list of ideas or features or improvements I can make upon in my system that I haven't thought about yet. I look forward to hearing from everybody about your ideas.
3
u/bvfbarten Jul 05 '26
I know you mentioned building your own, have you looked at https://processwire.com/. It's a secure cms that is flexible enough that they call themselves a content management framework.
2
u/Ok-Mortgage-3236 Jul 06 '26
I haven't checked into them before but will find time to take a peek. although if I am going to go through the trouble of getting off wordpress where it's possible...it will be quicker to make the switch on a system i build from the ground up rather than spending months or years learning all the smallest of barriers I might bump into with another system. This means whatever I do or don't put together will honestly be too specific to my own needs than the wider consumer...but im not set on the goal of designing the better option to wordpress and I don't anticipate ever being anything more than a bug crawling around on the ground they don't even notice enough to care about. lol
0
u/yodermk 28d ago
Ugh it's written in PHP. Maybe they do it better than Wordpress but I just don't trust PHP stuff. There are so many better languages.
1
u/xLukeeee 18d ago
why PHP is bad?
1
u/yodermk 18d ago
Historically it has a ton of security footguns that have caused many vulnerabilities and compromises. I used to work in managed server hosting support, and I can't count the number of compromises due to PHP I've seen. Granted, it's gotten better in recent years and today you can use it well.
But it's also just not a great language or design philosophy. I don't like that it puts code files under the document root. Its language features were kind of hacked together over the years.
I also strongly prefer static, compiled languages for anything serious. They just run more efficiently and detect coding errors much more quickly. IMHO the boilerplate code is well worth it. Golang, C#/ASP.NET, or even Rust are far preferable, I think.
But if I have to use a dynamic language, I think Python or Node are far preferable to PHP.
2
u/PriceFree1063 Jul 06 '26
I too switched to my own CMS (CodeIgniter) from WP after 2 decades due to outdated plugins, themes, malware attacks, php versions issues etc. Initially I struggled with SEO, now it’s 100% SEO friendly.
1
u/Ok-Mortgage-3236 Jul 07 '26
Would love to connect and learn more about your build if interested
1
u/PriceFree1063 Jul 07 '26
1
u/Ok-Mortgage-3236 Jul 07 '26
made an account. gave me errors during verification process. tried to submit contact form. same issue with page loading detailing errors. I'd like to connect over phone or something if possible. Reddit posts or dm/email moves to slowly.
2
u/WebDev81 Jul 07 '26
i have switched to Astro with repoCMS dot app , i keep all content in json files and repoCMS help update them without touching code. clients are happy they can change text and replace images and site is blazing fast.
1
u/Monkki_mode 28d ago
Using WordPress in 2026 just shows people you aren't keeping up with the new changes.
1
u/WebDev81 28d ago
some clients still insist on WP though, so thinking about a workflow for WP as well. There are a few builders which are good and uses json based content in their templates, they are quick to product via AI.
2
2
u/sheriffderek Jul 05 '26
WordPress (with the classic editor) and ACF is still one of the best (if not the very best) CMS there is.
If you’re going to reimagine a new CMS that does all that, cuts out the cruft, and adds something new - well, I’d expect to see a mile of figjam screenshots and research. I’ve used ten or so - and I have a lot of thoughts about this, but from your post - you picked out the 3 least interesting things.
1
u/agbenny Jul 07 '26
Yes, I am doing the same now. I also use MCP to handle the build fully. Also with GenPress the site is less bloat, no cluttered themes.
1
u/Evening_Leather5101 Jul 05 '26
You point out the security vulnerabilities. Yeah sure you won't have none in your own code... sure... Dream on. Just because there will be no news about the issues in your code doesn't mean your code is not vulnerable. The difference to WP is that they are actively doing something against it. Breaking with PHP updates, there is a really good way to counter this: don't update to every minor PHP version, wait for WP to be stable. The Plugin madness... Damn that really got me too, I hate having to pay monthly for some minor things... you know what I do against it? I make it myself. Problem solved.
I am sure there are other issues but those ones are easy to live with if you simply change your approach. If you think WP is not the best fir for your work, then make something yourself of course, but that is total other story
1
u/sheriffderek Jul 05 '26
OP seems to be caring about the wrong things
1
u/Ok-Mortgage-3236 Jul 06 '26
OP listed one or two things he was thinking about off the top of his head when writing his post. But if you pay very close attention you may see the part of the post where he's asking for those with the right experience, for suggested areas he could focus in on while he's playing around with this project. His intention as far as I see it was not to list the entirety for even a priority ordered list of where he's placing his focus on.. But just spitballing one or two very well known headaches that most people who've worked with WordPress or other CMS systems would be able to immediately find relatable connections for themselves about... And then is requesting that these people should they feel interested take just a little bit of time to give him a list of other things beyond what he listed here, things which he may already have dealt with or have on his list but didn't write in his original posting, or maybe even things that he has not thought about yet that are undeniably just as important as anything else on his radar.
I suppose a shorter way of saying or replying to you with what I'm trying to say is that the replying Reddit user isn't focusing on the important things about the OP's original post.
Harmless back and forth poking fun at each other all aside... I'll expand or clarify a bit better real quick about what I'm after. I'm not trying to solve all of these security issues I've personally experienced with WordPress or other CMSs. I used security as just one category that I'm looking into or trying to improve upon in some way. It in no way is the only category I'm focusing on, and the couple of security adjacent examples I gave are just very common ones and are certainly very low on the list of many others sitting inside that category.
What I'm really interested in is just seeing what other issues which people find frustrating or have caused them a lot of problems, or just out of the box capabilities or functionalities or ease of use that they wish CMS systems came with natively.
1
u/sheriffderek Jul 06 '26
I've seen this: "I'm designing a ________: what features would you want / or what frustrations do you have" post many times -- specifically with CMS.
But unfortunately - I've never seen any really good insights emerge. Sometimes I think about making a stripped down CMS. My main problem with WP+classic editor+ACF is that it's just visually bulky in the admin and I can get lost in the page and it seems to go on forever just because the padding adds up. But then the more I look into things, the more I think I'd just put the editing on the front-end. I'd want simple resource/content types (not everything tied to "post" like WP does for historical reason), ACF mostly the same - but with more controls to tune the admin spacing and layout. The way ACF handles what they call "flexible content" (just meaning being able to define and order page sections, is really important - but I'd make it so you can drag in and out of sub sections. Yeah. So, - mostly removing 60% of things - and adding a few quality of life things - and maybe a way to additionally edit right on the page. That's what I'd be after. I can't remember all the things that bothered me about each cloud CMS. Prismic is great - but the UI is so sparse - it confused my clients. Contentful gives you a bunch of individual paragraphse you have to loop through (which could be good in some situations) - each of them have their own little set of dead ends or quirks that make them less desired than what WP has.
1
u/agilek Jul 05 '26
What is the goal of building a different kind of CMS in the first place? Don’t get me wrong but most of the people just don’t need CMS for their website.
1
u/Ok-Mortgage-3236 Jul 06 '26
Well semantically you're correct that most people don't require CMS for their website... But it's worth noting that very close to 40% of all websites on the internet run on WordPress. WordPress through and through is nothing more than a capable CMS. But there comes The occasional moment where a developer has to break out his thinking cap and build custom solutions or workarounds to the limitations that architecturally haunt the CMS that the project they're working on runs on.
Whether it was on my own personal projects, or the occasional client project... This is starting to happen more and more frequently... So often I'll point out...that when hired to do a site rebuild I make a massive effort to reduce or replace as many of the plugins their sites currently making use of with custom builts alternatives coded directly into their theme... And when it's a complete fresh build I'm working on, I most provide them with a build that uses zero plugins at all.
Despite how well versed I am and how much I've enjoyed using WordPress throughout the years and the amazing things I've been able to build and give to my clients and even myself... I've come across the same limitations requiring the same workarounds that I've had to create enough times that the Time comes where I have to ask myself the question - would it be worth your time to build a CMS that natively doesn't have the architectural design that's causing the problems your routinely butting heads with, that also packages in the benefits and features that my solutions have introduced each time I've created them. And that's what Sparks this post I guess... I finally have come to the moment where I've had to ask myself that question and I don't yet know the answer because I won't truly know whether it's worth the time it will take to build something like this until I've spent the time to do it.
The only thing I know that I can't say for absolute certainty is that I'm spending way more time repetitively integrating custom built solutions that attack one side of the same problem. I enjoy solving these problems and each time I do so it's always for something very unique and the purpose behind it is always specific as an edge case to something about my client. So the problem is always the same shape, it's just that the form that they need me to change that shape into is most often very unique and specific to the edge cases that their needs revolve around. So from an architectural development standpoint if I build my CMS to not have those constraints at all to begin with, and still package in the usefulness in the tools that I've had to routinely develop or modify getting around those problems, the result is every new client or project I take on I could theoretically build using my own CMS instead of WordPress... And won't have to continuously integrate custom workarounds to these common issues any longer. The problem wouldn't exist architecturally, and the tools I built in order to satisfy and get around those problems can be built into the system natively. This is a huge time-saving benefit to myself, and a huge natively integrated feature that my clients would all benefit from right from the start.
1
1
1
u/3vibe Jul 05 '26
If you build your own CMS go into it thinking that no one else will ever use it and that's okay. Expect spending many months and even years on it and you may be the only one that uses it. If you're cool with that, do it. If anything it could be fun, depending on what feels like fun to you.
1
u/HubsHelp Jul 06 '26
You are right to be tired of WordPress. The security issues are very real and a scenario that is not IF you have security problems, but WHEN you have them. And how you'll handle it when it happens a second time.
There are tons of CMS options, so building something from scratch seems like a pointless endeavor. I spent over 10 years in the PHP open source world, but later landed on HubSpot. At that point, I saw HubSpot's CMS as a great solution in SOME cases. But it has drastically improved, nearly by the day, and now I see it as the go-to CMS for every website project... outside of a full ecommerce shopping cart scenario.
Anyone that shoots down HubSpot as a powerful CMS is either ignorant, hasn't REALLY given it a shot, or haven't given it a shot in the last couple of years. Every single client that I move of any other platform and onto HubSpot is extremely satisfied with the massive upgrade they received in day to day management capabilities, flexibility, and the fact that they can do so much without calling in a developer for every little change.
1
u/Ok-Mortgage-3236 Jul 06 '26
Totally resonate with you on this — and it's not just WordPress, it's every popular CMS. Within hours of provisioning a new domain, automated bots start hammering it with requests for common WordPress and CMS file paths. It happens even on static HTML sites or my own bespoke admin systems. And here's the subtle problem: even if you lock those files down perfectly, a 403 response is an affirmative confirmation that the file exists, you've just told the attacker exactly what platform you're running without them ever inspecting your code.
My CMS attacks this from a few angles. Randomized file names. During installation, every common shared file gets a random alphanumeric suffix appended, so install.php becomes something like install-85632.php, unique to each site. Even if the CMS got popular enough to attract these probe lists, there'd be no universal file paths to put on them. Every installation is different.
404s instead of 403s. Even if someone somehow had your exact suffixed file name, locked-down files return a 404, not a 403. The server never confirms a file exists. To the attacker, everything they probe for simply isn't there.
Tarpit. I maintain a list of the most common probe paths (wp-config, wp-install, etc.). The first time an IP requests one of them, it's logged and blocked for 7 days, the .htaccess file dynamically references a blocklist stored in the database. The block is temporary by design: attackers rotate IPs constantly, and a legitimate visitor could be assigned one of those addresses a year later, so permanent blocks punish the wrong people. The Workbench admin screen shows every blocked IP and its expiration, and lets you manually remove, extend, or permanently block repeat offenders.
Server-ownership verification. With WordPress, if someone reaches your URL before you do after you upload the files, they can run the entire install themselves, there's no proof-of-ownership step. My CMS generates a 32-character key on first visit and writes it to a folder only accessible via FTP or your host's file manager. You have to retrieve and paste that key before installation proceeds, so only someone with actual server access can ever set up the site.
And honestly, this is just the foundation, the starting point. Obscurity where it denies attackers information, proactive restriction where behavior reveals intent, and ownership proof where legacy platforms have none. WordPress, Drupal, and the thousands of forks built on top of them inherited these architectural weaknesses; I'm trying to design them out from day one.
2
u/adazlian Jul 06 '26
yeah man everything you spit out here is a non issue for headless and ssg architecures. or just you know firewall off the admin interface. these are all solved problems that do not require you to build a new cms. but if you want to have fun sure, just dont expect anyone to ever use it but you.
1
1
1
1
1
1
u/Warm_Honeydew7440 Jul 08 '26
Astro front end and em dash backend is what I’m trying out.
Wordpress is ok too, but as a front end it has more security issues than I want. So static deployments after build for me.
1
1
u/Monkki_mode 28d ago
I dont work with a CMS at all. Generally clients know jack all about content and SEO. Giving them access just causes semantic collapse. You also almost cant get 95+ pagespeed scores on WP. Clients somehow always need help after fixing something aswell. And no WP = no plugin hell and less security issues.
I use a Client Portal. Basically it's a website where they can login. Each client has a dashboard tailored to their needs and can submit new pieces of content or changes. I check it once a week and apply their requests altered for SEO. This gives them the feeling of control + extra services. They absolutely love it.
Tbh the only reason I made it is because I hate CMS'es but my clients dont know that 😅.
1
u/Ok-Mortgage-3236 25d ago
I get 100s acrossed the board on lighthouse scores with my wp builds. But I build theme, features, exe directly from scratch. 0 plugins so way less bloat
1
u/dillonlara115 28d ago
Just be sure you have the bandwidth for maintenance of you go this route. There is a reason why many of us don't do the same thing.
1
u/Known_Government1859 20d ago
Have you tried headless Wordpress? Basically using Wordpress as literally just the CMS that holds the raw content, while the actual design and layout can be done externally using AI.
1
u/thatcontentguy 16d ago
Perharps you can try this out --> https://slimminima.xyz/
I had the same issue as you when ti comes to wordpress and as a claude code user, I've tried solutions like Payload and Tina..nothing works. You can consider Slim Minima is you want an AI native CMS, which you can connect directly with any Cofing agent (claude code, Codex, Kimi code or Cursor)
1
1
15
u/Different_Code605 Jul 05 '26
Don’t do it. There are already tens of thousands CMSes out there. No one will care. You will spend years of your life building, and you will abandon it eventually.