Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
You’re asking for trouble if you’re using such random plugins on production sites.
oh boy, the average wordpress site has like 30 plugins and the top bar is getting cluttered with so many plugin upsells that it fills the whole screen. There’s a huge industry of people making wordpress sites who shouldn’t.
It’s quite frustrating to be asked as a dev to “fix” people’s site as my usual response is “shut it off and redo it well”.
It’s really a shame because by now WordPress itself actually works quite well. Sure, it’s fueled by unspeakably ugly spaghetti code. But at least it’s unspeakably ugly spaghetti code that works and receives regular automatic updates.
And other than putting up a verification program I don’t see what they could do to improve the plugin situation.
I agree. I don’t hate wordpress. It seems a bit dated by today’s standards and bloated in some aspects but you can definitely make a solid, fast website with it. It’s getting a bad reputation for its toxic plugin dev scene and crappy sites built using Elementor.
Elementor shudders
What an absolute nightmare that was
Regular automatic updates on ugly spaghetti code feels like it’s just asking for trouble.
Theoretically, someone could untangle the spaghetti. Nobody will, but automatic updates at least opens up the possibility.
Funnily enough, I was hearing this from developers in the early 2010s when I was just starting my career (IT adjacent, but not a developer).
Seriously, people have been saying this stuff about WordPress as long as it’s been around, and I’m always surprised that it still exists. This was definitely one of those technologies that sounded bad enough that it could never last. Joke is on me.
Of course I thought the same with JavaScript but was forced to learn it last year
Of course I thought the same with JavaScript but was forced to learn it last year
Use TypeScript. It’s still built on a giant steaming pile of shit but at least if you’re careful most of your own code can be reasonably correct.
It’s not my choice. I’m only here to help others fix their code, not to actually do the coding. I have to someone know best practices and how to fix common bugs
That’s a shame. If you can convince them to use TypeScript that would be for the best, otherwise good luck, you’re going to need it. I can’t say you couldn’t pay me to write JavaScript, but I can say what I would demand to do it is way more than anyone would be willing to pay.
There’s a huge industry of people making wordpress sites who shouldn’t.
And this is why I hate the state of the whole hacking scene and that now nation states are also carrying out en masse attacks. Everyone should be free to make a site on Wordpress or whatever. If they can’t, that’s how we get everyone on like 3 corporate platforms like Facebook.
If i were to take a shot every time vulnerabilities are found in the WordPress ecosystem i’d be comatose by now…
I’d guess it’s not because of the inherent insecurity of WordPress, but the sheer size of the ecosystem and the fact that like 40% of the Internet is WordPress sites.
And inherent insecurity. It wasn’t designed to be secure, it was designed to be full-featured, so it has a pretty big attack surface.
That’s the ecosystem. WordPress itself is pretty basic, these things attack plugins, and their often not-very-experienced creators and users. The thing with WordPress is that this kind of vulnerability comes with the problem space, not the particular solution. If there was a different product in the same space, it would not fare better by default.
Also, I’d bet that a ton of CVEs are filed for C++ libraries, yet nobody is harping on about how insecure C++ is.
Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.
What are alternatives of WordPress if I wanted to add something to my website?
Drupal, but you are getting into a different type of complex symfony code built on years and years of drupalism’s. It’s powerful and pretty well maintained though.
What are you trying to achieve?
- static site like a blog? - Hugo
- add comments? - Commento paid, or you can self-host
- cloud stuff (e.g. Google Drive replacement) - NextCloud
There’s a ton you can do, you don’t need WordPress just because you want a website. Figure out what you want your website to do, then look for tools to do that.
Just a side note, Commento is kinda dead on the self-hosting front at least as it’s been years since an update, which is probably not great for a public service.
However, Comentario is a updated fork that’s being maintained.
I’ve used https://getgrav.org for a while and it’s been pretty solid.
If you want to add something to your website then you’re already running WordPress, no?
No, I haven’t added nothing. I was going code a basic html 5 page but I wanted a blog like atmosphere, since the website is all about my writing.
If you want a mostly straightforward WordPress-alike that’s not WordPress, you probably should at least consider Ghost. I’m using it for my blog and it’s got a slightly weird focus on “paid blog members”, but it’s super solid and doesn’t have a multi-decade history of endless security problems.
And, soon, it’ll be a happy member of the Fediverse.
People still use Wordpress? lol
Its convenient. Not everyone wants to waste their life centering divs you know
As if wordpress would be the only CMS out there.
It’s the only CMS that runs on a classic AMP stack which is still the standard with cheap web hosters. And since everyone and their dog is using it, you can easily find support and ready-to-use plugins for almost anything.
In the car world, WordPress is your plain old petrol car that just runs, can easily be refuelled and you can get anything repaired at every other street corner. That’s why it is still so widespread.
Drupal is out there. It’s not perfect but it’s well maintained and quite powerful with good community support.
Right, because the only alternative to using spaghetti old code is making your own, not using one of the many actively maintained free software.
Among many others you’d easily find if you give up on the hivemind of taking the most popular approach.
Ghost runs on NodeJS which isn’t available at most cheap webhosters. Also it doesn’t do traditional blog things like pingbacks, trackbacks or webmentions.
BearBlog can’t be self-hosted at all - it says so right on their GitHub’s README.
WriteFreely is a Go binary that - again - isn’t supported on most cheap hosters. Also I can’t seem to find anything about it supporting pingbacks, trackbacks or webmentions. It seems to be more like a one-user Mastodon instance.
first one isn’t free
second one you have to migrate posts using ctrl+c ctrl+v and then hand type the publish date
third one you have to already have built your own SQL database
Ghost is open source. You can selfhost. It’s just that aggressively advertising their (paid) hosting services on the official website
What would you use instead?
Something that gets built on my machine and pushed up to the site and doesn’t allow third party code to execute on the backend.
It really depends on what the website is.
If you have a use case, I can be more detailed.
Laziest common response to things like this. People still use Windows? People still use cars? WordPress is insanely popular and there’s no indication that’s going to change. Not even after you’ve chosem to signal to all of us here that you don’t use it. Good for you, though!
