If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…
I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
And inherent insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
What are alternatives of WordPress if I wanted to add something to my website?
If you want a mostly straightforward WordPress-alike that’s not WordPress, you probably should at least consider Ghost. I’m using it for my blog and it’s got a slightly weird focus on “paid blog members”, but it’s super solid and doesn’t have a multi-decade history of endless security problems.
And, soon, it’ll be a happy member of the Fediverse.
What are you trying to achieve?
- static site like a blog? - Hugo
- add comments? - Commento paid, or you can self-host
- cloud stuff (e.g. Google Drive replacement) - NextCloud
There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.
I’ve used https://getgrav.org for a while and it’s been pretty solid.
Just a side note, Commento is kinda dead on the self-hosting front at least as it’s been years since an update, which is probably not great for a public service.
However, Comentario is a updated fork that’s being maintained.
If you want to add something to your website then you’re already running WordPress, no?
People still use Wordpress? lol
Over the past 4 years WordPress usage has grown from 35% to 43.4% ~ [W3 Techs](https://w3techs.com/technologies/details/cm-wordpress](https://w3techs.com/technologies/history_overview/content_management/all/y)
As much as I hate so much about WordPress, yes it is the most used CMS. Period. Your comment is just ignorant.
Laziest common response to things like this. People still use Windows? People still use cars? WordPress is insanely popular and there’s no indication that’s going to change. Not even after you’ve chosem to signal to all of us here that you don’t use it. Good for you, though!
Wordpress does a lot of things. You need to specify which things you want to do in order to narrow down a replacement. For example:
- static site? - Hugo, Jekyll, etc - just generates regular HTML
- personal cloud? - NextCloud/OwnCloud
- ecommerce? - consider nopCommerce or OpenCard
The more you can narrow your requirements, the easier it will be to find a secure solution.
static site? - Hugo, Jekyll, etc - just generates regular HTML
These are either vastly more limited, or they require you to be able to code.
ecommerce? - consider nopCommerce or OpenCard
I’ve never heard of these, but I have seen people say that if you want to do ecommerce you should only use Shopify, because even small differences can result in people not purchasing your products.
Something that gets built on my machine and pushed up to the site and doesn’t allow third party code to execute on the backend.
It really depends on what the website is.
If you have a use case, I can be more detailed.
How about a basic Squarespace business website?
I looked at a bunch of options before and Wordpress seemed like one of the most promising: https://lemmy.world/post/12989654
Its convenient. Not everyone wants to waste their life centering divs you know
Right, because the only alternative to using spaghetti old code is making your own, not using one of the many actively maintained free software.
Among many others you’d easily find if you give up on the hivemind of taking the most popular approach.
You can try it, but I switched from Ghost to WordPress because of auto updates. Default ghost docker image doesn’t pin the correct DB version which causes errors, and watchtower updates break your website. Also, very little in the way of existing plugins or themes. Typing a new article doesn’t give much in the way for formatting.
Way more documentation on the WordPress side of things and just general QoL stuff. Plus, free templates. Spaghetti it is, but spaghetti works and I don’t feel like using Hugo.
first one isn’t free
second one you have to migrate posts using ctrl+c ctrl+v and then hand type the publish date
third one you have to already have built your own SQL database
Ghost runs on NodeJS which isn’t available at most cheap webhosters. Also it doesn’t do traditional blog things like pingbacks, trackbacks or webmentions.
BearBlog can’t be self-hosted at all - it says so right on their GitHub’s README.
WriteFreely is a Go binary that - again - isn’t supported on most cheap hosters. Also I can’t seem to find anything about it supporting pingbacks, trackbacks or webmentions. It seems to be more like a one-user Mastodon instance.
It’s the only CMS that runs on a classic AMP stack which is still the standard with cheap web hosters. And since everyone and their dog is using it, you can easily find support and ready-to-use plugins for almost anything.
In the car world, WordPress is your plain old petrol car that just runs, can easily be refuelled and you can get anything repaired at every other street corner. That’s why it is still so widespread.
Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
You’re asking for trouble if you’re using such random plugins on production sites.
oh boy, the average wordpress site has like 30 plugins and the top bar is getting cluttered with so many plugin upsells that it fills the whole screen. There’s a huge industry of people making wordpress sites who shouldn’t.
It’s quite frustrating to be asked as a dev to “fix” people’s site as my usual response is “shut it off and redo it well”.
There’s a huge industry of people making wordpress sites who shouldn’t.
And this is why I hate the state of the whole hacking scene and that now nation states are also carrying out en masse attacks. Everyone should be free to make a site on Wordpress or whatever. If they can’t, that’s how we get everyone on like 3 corporate platforms like Facebook.
It’s really a shame because by now WordPress itself actually works quite well. Sure, it’s fueled by unspeakably ugly spaghetti code. But at least it’s unspeakably ugly spaghetti code that works and receives regular automatic updates.
And other than putting up a verification program I don’t see what they could do to improve the plugin situation.
Regular automatic updates on ugly spaghetti code feels like it’s just asking for trouble.
I agree. I don’t hate wordpress. It seems a bit dated by today’s standards and bloated in some aspects but you can definitely make a solid, fast website with it. It’s getting a bad reputation for its toxic plugin dev scene and crappy sites built using Elementor.
Funnily enough, I was hearing this from developers in the early 2010s when I was just starting my career (IT adjacent, but not a developer).
Seriously, people have been saying this stuff about WordPress as long as it’s been around, and I’m always surprised that it still exists. This was definitely one of those technologies that sounded bad enough that it could never last. Joke is on me.
Of course I thought the same with JavaScript but was forced to learn it last year
