Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack
Malicious updates available from WordPress.org create attacker-controlled admin account.
You're viewing a single thread.
People still use Wordpress? lol
Its convenient. Not everyone wants to waste their life centering divs you know
As if wordpress would be the only CMS out there.
It’s the only CMS that runs on a classic AMP stack which is still the standard with cheap web hosters. And since everyone and their dog is using it, you can easily find support and ready-to-use plugins for almost anything.
In the car world, WordPress is your plain old petrol car that just runs, can easily be refuelled and you can get anything repaired at every other street corner. That’s why it is still so widespread.
Drupal is out there. It's not perfect but it's well maintained and quite powerful with good community support.
Right, because the only alternative to using spaghetti old code is making your own, not using one of the many actively maintained free software.
Among many others you'd easily find if you give up on the hivemind of taking the most popular approach.
Ghost runs on NodeJS which isn’t available at most cheap webhosters. Also it doesn’t do traditional blog things like pingbacks, trackbacks or webmentions.
BearBlog can’t be self-hosted at all - it says so right on their GitHub’s README.
WriteFreely is a Go binary that - again - isn’t supported on most cheap hosters. Also I can’t seem to find anything about it supporting pingbacks, trackbacks or webmentions. It seems to be more like a one-user Mastodon instance.
first one isn't free
second one you have to migrate posts using ctrl+c ctrl+v and then hand type the publish date
third one you have to already have built your own SQL database
Ghost is open source. You can selfhost. It's just that aggressively advertising their (paid) hosting services on the official website
You can try it, but I switched from Ghost to WordPress because of auto updates. Default ghost docker image doesn't pin the correct DB version which causes errors, and watchtower updates break your website. Also, very little in the way of existing plugins or themes. Typing a new article doesn't give much in the way for formatting.
Way more documentation on the WordPress side of things and just general QoL stuff. Plus, free templates. Spaghetti it is, but spaghetti works and I don't feel like using Hugo.
Laziest common response to things like this. People still use Windows? People still use cars? WordPress is insanely popular and there's no indication that's going to change. Not even after you've chosem to signal to all of us here that you don't use it. Good for you, though!
Over the past 4 years WordPress usage has grown from 35% to 43.4% ~ W3 Techs
As much as I hate so much about WordPress, yes it is the most used CMS. Period. Your comment is just ignorant.
What would you use instead?
Something that gets built on my machine and pushed up to the site and doesn’t allow third party code to execute on the backend.
It really depends on what the website is.
If you have a use case, I can be more detailed.
How about a basic Squarespace business website?
I looked at a bunch of options before and Wordpress seemed like one of the most promising: https://lemmy.world/post/12989654
Cheap, easy, good.
Pick two. This is how most things in life are.
Personally, I’m a fan of static sites. But, being a web developer myself, setting up a simple form isn’t a big deal.
If dynamic content is required and you’re not a developer, you are at a crossroads. You can host your own Wordpress and get hacked eventually, or pay a cloud service like squarespace or wix, etc. but you’re at the mercy of price increases and a la carte features.
To be fair to Wordpress, they’ve come a long way. The core product isn’t horrible. However, they have no way to control 3rd party code, and that’s where all the malicious stuff comes from.
Wordpress does a lot of things. You need to specify which things you want to do in order to narrow down a replacement. For example:
The more you can narrow your requirements, the easier it will be to find a secure solution.
static site? - Hugo, Jekyll, etc - just generates regular HTML
These are either vastly more limited, or they require you to be able to code.
ecommerce? - consider nopCommerce or OpenCard
I've never heard of these, but I have seen people say that if you want to do ecommerce you should only use Shopify, because even small differences can result in people not purchasing your products.
Yes, Jekyll and Hugo are vastly more limited, that's the point. There's no dynamic content, you just write in Markdown (the same thing Lemmy uses), pick a theme, and you're good to go. No need to code anything, just a couple config files and Markdown.
Shopify is fine if you want something hosted. But since we were talking about WordPress, I assumed self-hosting was a desired quality. All of the platforms I mentioned are self-hosted, open source, and at least one from each category is compatible with PHP-only hosting providers, just like WordPress.
If we're optimizing for easy, Squarespace should be on the table for static websites as well. I assumed we were talking about direct replacements for WordPress, not hosted alternatives.
you just write in Markdown (the same thing Lemmy uses), pick a theme, and you’re good to go
That is far too basic for most websites. It's absurd to suggest that's a valid alternative for something like Wordpress + Elementor.
Squarespace should be on the table for static websites as well.
How so? It's not static that I'm aware of, unless you're exporting it to a file after using the UI to create it?
I assumed we were talking about direct replacements for WordPress, not hosted alternatives.
Well, as you said, Wordpress does a lot of things. Shopify, Wordpress, Squarespace, etc., are certainly interchangeable/competitors to a large degree. Wordpress has hosted options and is a default/main option for many hosting companies.
You can build a full website with every major function and design option with Wordpress. You can't with Jekyll and Hugo unless you can code.
That is far too basic for most websites
Well yes, but that's my point. WordPress does everything, and I'm offering tools that do one thing well.
If all you need is a static site, use a static site generator, not WordPress. If all you need is ecommerce, use an ecommerce tool, not WordPress. And so on.
unless you're exporting it to a file after using the UI to create it?
I'm saying that if all you need is a static site, but you want something simple and hosted, Squarespace would be a decent alternative. Whether it's actually static is beside the point, it's probably more secure than a self-hosted WordPress site since you can't just throw on a dozen plugins serverside, only use one or two, and then get hacked.
A swiss army knife can do everything, but it doesn't do everything well, and it's easy to use it insecurely, which opens you up to these sorts of attacks. I'm not going to suggest a drop-in replacement for WordPress (they do exist) because the problem is fundamental to the "one tool for everything" approach.
