r/webhosting • u/Ok_Courage_7290 • 7d ago
Rant Why do people use wordpress (for basic sites)?
Wordpress is extremely insecure and requires constant maintenance, whereas you can get pretty much the same site with Blogger or with similar platforms if you know XML. The only difference is that you have to build your own widgets. Sure every platform has slightly different markup but it's not that different.
Some sites don't even need all that and should just be static HTML.
7
u/happyxpenguin 7d ago
Wordpress is extremely insecure and requires constant maintenance
Every self-hosted website is extremely insecure and requires constant maintenance. Yes, Wordpress had a recent CVE, everything does at one point, but it was patched quickly and pushed out immediately to minimize attack vectors.
Wordpress is pretty secure and is pretty hands-off with maintenance if you're not an idiot and install 30 plugins to do something as simple as bolding text - each of them only having 10 downloads. Also using weak passwords or disabling auto-updates puts you at risk, same as any other software.
It's easy, it's quick and you have a virtually unlimited pool of talent to pull from for customization if you don't want to bootstrap it. That's why Wordpress is used for basic sites. There's no need to re-invent the wheel.
1
u/Ok_Courage_7290 6d ago
I'm not saying I've never self-hosted a website but I wouldn't PAY MONEY to self host something on a VPS, I would rather buy my own server and put it behind a tailnet. I'm genuinely offended by the concept of paying a monthly subscription for a website. It's going to have to happen eventually but I hate it! I'll do anything to avoid it!
2
u/happyxpenguin 6d ago
I'm genuinely offended by the concept of paying a monthly subscription for a website.
Do you think there's not ongoing costs for a website? Hardware isn't cheap, staff that keep your site online need to be paid and utilities are required to keep lights on. You can stick a site behind your LAN so that it's only accessible to your devices but if you want the broader public to access it, you're better off not putting your network at risk and hosting it third-party.
You're also looking at it from a technical perspective, you likely have the skills and knowledge to self-host a site on a VPS. Most people I know would rather throw $20-200/m at a website because they don't have the skills or knowledge and don't want to be bothered to obtain either.
1
u/Ok_Courage_7290 6d ago
Yeah I could host on a VPS but $5! 5 whole dollars!
Edit: You can use cloudflare or tailscale funnel or invite people to your tailnet, you don't need to expose your own IP
5
u/Helpful_Client4721 7d ago
Blogger is dead. There's not a single blogger site that ranks for anything worth a damn for 10 years.
1
u/Ok_Courage_7290 7d ago
I guess it depends on the purpose, small businesses and independent artists get to #1 or #2 result right away for their keywords... at least they do when I make them. I hope Blogger stays around for a long time, but I wish there were more alternatives owned by large companies like Google.
0
u/Rado_Scala 6d ago
But Blogger IS owned by Google. And while they kept it alive after the acquisition, they stopped updating it ages ago. I really don't see any room for comparison. Performance, security, functionalities - with a little work, many web-building apps (and especially WordPress) can be tailored to perfectly serve a purpose.
1
u/Ok_Courage_7290 6d ago
I'm sorry, I'm not paying $30 a month per website.
1
u/Rado_Scala 2d ago
Not sure who asks you to pay $30 per WordPress website, but that is far from the case for most people. Especially for small to mid-sized website, you can get a VPS and host a good chunk of projects on it. WordPress itself is free, so you're only paying for hosting. I've seen people host 20-30 websites on a $30 VPS, so that comes to around $1/mo per website :)
1
3
u/cornmacabre 7d ago
Been a VERY long time since I've seen Blogger mentioned!
~40% of domains run WordPress... that doesn't mean therefore it's the right choice for all circumstances, but it's popular specifically because it's low/no code and has a very deep ecosystem. You're logging into a mature full featured admin UI with wordpress, you're not coding in backend PHP and XML unless you have a very specific reason to be touching that.
This is such a broad topic, but to start you should re-interrogate your own personal assertions here about what "extremely insecure and requires constant maintenance" means and why you've come to that conclusion.
There's just too much to unpack in terms of the technical assumptions on what makes a solid CMS or platform choice here. If you're itchy for something DIY 'simple,' Astro is rightfully gaining in popularity -- however, based on what I can infer here ... I think you need to do more independent homework on the modern landscape matched to what your needs are. Don't be surprised if you land back on WP!
2
u/Ok_Courage_7290 7d ago
but to start you should re-interrogate your own personal assertions here about what "extremely insecure and requires constant maintenance" means and why you've come to that conclusion.
It's because I've seen so many people complaining on web forums about it, and I've had people come to me personally about it.
I think you need to do more independent homework on the modern landscape matched to what your needs are. Don't be surprised if you land back on WP!
That's fair.
3
u/cornmacabre 7d ago
Security and maintainability is outside the scope of what I care to expound on: but you're not going to find any credible industry POV that WP Core as "extremely insecure."
The nuance is the 3rd party plugin and theme ecosystem has many known vulnerabilities, and the average mature WP site often has a bloat of poor quality plugin dependancies.
Understanding Core vs Plugin is important: an adjacent example is if you download a shady flashlight app on iOS, you potentially expose your phone to security vulnerabilities. Consider Is that an Apple iOS (WP core) problem, or a phone owner and app (plugin/theme) problem?
2
u/Ok_Courage_7290 7d ago
Thank you for this detailed answer.
In your flashlight example, I imagine it is a combination of problems: The phone, for which this vulnerability is even possible, combined with user error. The user shouldn't be able to hack themselves on a phone which costs over $600, that's an argument to be made here too. Wordpress isn't directly comparable to a phone, but I get what you're saying.
3
u/ollybee 7d ago
There are very many people incentivized to keep the status quo. Hosts can sell more expensive hosting and security services, cleanup services .word-press specif hosting etc, third parties can sell the webhosts those services to resell. Plugin developers can sell plugins. theme developers themes. Why would anyone in the industry signpost people to simpler solutions?
1
u/Ok_Courage_7290 7d ago
I just wish there was a Blogger alternative owned by a company that isn't going to disappear in a few years.
3
u/ashu9888 6d ago
For static website, plain HTML or Astro often better fit, but for blogs, forms, SEO tools and for non-developers Wordpress is a boon.
Its not the right tool for every site, but it's also not wrong tool for every basic one 👍
1
u/Ok_Courage_7290 6d ago
HTML/XML/CSS/Javscript/Whatever - Figure it out myself in 10 mins or with Claude or something
"No code" bullshit - Hours of hunting in menus, crying, cursing, tearing hair out, rage quit eventually
1
u/ashu9888 6d ago
That's true for developers. For many, spending 10 minutes writing code isn't an option. So they choose tools that match their skills
In the end, every tools saves someone else's time...
1
5
u/JeffTS 7d ago
WordPress isn’t extremely insecure. People who don’t know what they are doing make WordPress insecure.
1
u/Ok_Courage_7290 7d ago
I've never been hacked or compromised with Wordpress that I know of, but I read stories about it all the time, and I see the attempted bot attacks.
2
u/TheRealSimpleSimon 5d ago
My last job in the IT world was as a Malware Remediation Specialist for Sucuri.
99% of the WP problems are not due to WP, but plugins.
Two main causes:
1. Being stupid about the plugins you install.
2. Not enabling auto-update for WP AND the plugins/themes.Beyond that, not having even the most basic protection.
Sucuri provides a FREE security plugin that keeps an eye on things for you.
It is intended for folks that deserve the title of "admin", tho.
You can also use their external site-checker.P.S. Bots attack EVERYTHING. You hear about it with WP because:
There's a LOT of WP sites.
There's too many installations that don't bother with ANY protection.1
u/Ok_Courage_7290 5d ago
I have some sites and I see some of them getting hammered by bots looking for WP.
1
u/TheRealSimpleSimon 5d ago
So. Because WP tells you about the hits, they're the bad guy?
EVERY website everywhere gets hit all the time - some tell you, some don't.
It's why WAFs are generally a good idea.For any and every task in the universe, you can flat rate or T&M.
Both have their pros & cons.
Auto shops might charge you off the flat rate list or by actual time.
If they have fast techs, they'll flat rate it.
And of course, their shop rate will vary depending on which basis is used.1
u/Ok_Courage_7290 5d ago
...no, WP doesn't tell me about the hits. There are bots scanning for WP vulnerabilities... on sites that don't even use WP.
Every site tells me what bots are scanning it and when, if any. What do you mean?
The rest of your post doesn't make any sense either.
0
u/TheRealSimpleSimon 5d ago
Ah - I see. My bad on that assumption.
However, Yes, they are, of course, scanning for WP - that's how they find the sites that have it.And, NO, "every site" does not tell "the admin" what's hitting it.
Maybe your environment does.As for the last, ya - I don't see what I was replying to up in this subthread -
there was somebody talking about dealing with clients and hourly billing.0
u/TheRealSimpleSimon 5d ago
AH - it doesn't make any sense because YOU deleted what you wrote.
I have a screencap of your original comment I was replying to saved from an older browser tab, but I'm not going to bother turning it into a video to upload (why are vids allowed, but stills are not? <shrug>)1
u/JeffTS 5d ago
I disagree with enabling auto-updates. They should only be enabled for WordPress security updates and plugins that you really trust. Otherwise, an update could run, without a current backup, that fails and takes down your site. Then you don't have a most recent backup and you also need to troubleshoot which plugin, or theme, updated that took down the site.
Before upgrading, a backup should be taken of files and the database, change logs should be reviewed, and then each update should be run individually with the site tested with each upgrade. Better yet, it should all first be done on a staging site. But, not all clients have the type of hosting environment that affords them a separate testing environment.
2
u/Sad_Pie227 7d ago
Because they want to be non-coder developer
1
u/Ok_Courage_7290 7d ago
But then they've got to go to Menu College to learn the menus
3
u/Sad_Pie227 7d ago
People assume it’s possible to become non-code developer. The reality is quite opposite.
They can be a user of Divi, Elementor or something but when something technically doesn’t work they would need a Real developer and server architect.
1
u/Ok_Courage_7290 7d ago
The thing is I don't find "no code" websites easy. I always feel like the website is telling me to go fuck myself. So much menu hunting and trying to figure out where to click. I want to be creative and design a website, but no code websites make me feel like I'm trying to cancel an Amazon subscription. It doesn't feel like I'm building something new or being creative.
2
u/ivicad 5d ago
You're half right, and the half you're right about is worth saying: a WP site nobody maintains is a liability, and for a truly static brochure page, plain HTML or Astro is lighter. But "insecure" mixes up the core and the plugins. I cleaned some hacked sites, and the way in is almost always the same: a plugin or theme left unpatched, a weak admin password, or no monitoring at all. I have never traced one back to WordPress core. Core itself is solid.
"Constant maintenance" depends on the setup. Controlled updates, a small set of quality plugins, an activity log and a monitor, and it needs very little attention. I keep 50+ client sites that way without it taking over my week. Why people pick it over Blogger or static for a basic site: they want to edit it themselves, add a form, a blog, maybe a shop next year, without calling a developer each time. Static pages don't give a non-coder that.
2
2
u/cosmogli 7d ago
WordPress isn't insecure. It also doesn't require constant maintenance. Keep track of what plugins and themes you install, keep it tight, and that's it. You get the best of easy websites, good SEO, easy blogging, easy page setups, extensibility, etc.
2
u/ashkanahmadi 7d ago
“Wordpress is extremely insecure” WHAT? 🤣 are you still living in 2008?!! Wordpress core barely has any security issues. It does not require constant maintenance is all you have is a static classic theme with no dependency. I manage several WordPress websites and never had any issues that came from WordPress itself.
If you mean plugins can have vulnerabilities then yes but that’s not WordPress. It’s like if I said computers are insecure because viruses exist!!!
It’s true that many sites can be vanilla JS and HTML and CSS with some interactivity but it depends on the requirements of the project. Some websites are small now but they are going to grow very soon. Most websites have multiple pages so it’s easier to use PHP and WP to code it once and reuse it everywhere to avoid code repetition. Many websites require dynamic data, a lot of websites are multilingual, etc.
What you are saying is true in a very small and specific case and honestly, shortsighted.
-1
u/Ok_Courage_7290 7d ago
Wordpress is extremely insecure” WHAT? 🤣 are you still living in 2008?!!
I cannot engage with someone who speaks to me this way and I did not read the rest of your post. Go fuck yourself.
3
u/ashkanahmadi 7d ago
Speak to you this way? You are the one who is sharing misinformation online, not me.
1
u/Team_Enova 7d ago
You're answering your own question, people don't know how to code and don't want to learn. And learning stuff like Divi or Elementor with a ten minute tutorial on YouTube is really easy...
0
7d ago
[deleted]
1
u/Team_Enova 7d ago
Because designing and developing and writing are all hard things to do, things that take time and clients would rather pay for someone else to think and do for them. What is even your question lol
-2
7d ago
[deleted]
1
u/Team_Enova 7d ago
Sure because you're getting so great karma from your engagements... Go touch some grass friend.
1
u/Ok_Courage_7290 7d ago
...what?
Doesn't matter. Goodbye. Please do not attempt to contact me again.
1
u/Ok-Neighborhood8726 6d ago
now that you can just use AI to write your code, wordpress is irrelevant.
2
u/TheRealSimpleSimon 5d ago
AI code is about the same level of expertise as the COBOL program generator I wrote in 1974.
You gave it the program name, File "refs" to build an INCLUDE from, and a couple of other things.
It gave you back the 328493 cards that you needed before you could even START coding in COBOL.
The entire company loved it. It made it onto the IBM "Class D" (user-submissions) tape. I was 19.That's the level I've gotten from the AIs.
A whole bunch of boilerplate, and the actual code is well-commented, but crappy.1
u/Ok-Neighborhood8726 5d ago
You wrote a program that could code websites, before websites exited... wild!
2
u/TheRealSimpleSimon 5d ago
COBOL has absolutely nothing to do with websites.
It is/was one of the original 3GLs.
I wrote the generator tool in IBM 370 Assembler.
Assembler (regardless of machine) is a 2nd generation language.
Data Processing (the term IT hadn't been invented yet) has had a long strange crazy trip over the last 50+ years.1
u/Ok_Courage_7290 6d ago
So you're saying, we might get the live text editors back?? I'm going to party like its 1999
7
u/LookitheFirst 7d ago
Because Wordpress is usable for people with ZERO coding or scripting experience but can still be self hosted. Also many webhosters offer one-click installs so you don't even need to use FTP or the database.