Not to mention Wordpress's history with security issues of the past.
Could I run my business website on a headless CMS and a build pipeline? Absolutely.
Why should I though? WordPress allows me to manage my content without having to deal with the technical details of doing so.
A headless CMS provides zero benefit to me while at the same time incurring additional infrastructure management and administration costs.
With WordPress there's a huge amount of plugins for every imaginable use case. For most headless CMSs that's probably not the case. So, I might run into a dead end later on should I realise that I need an additional feature the CMS I opted for doesn't support.
In terms of WordPress security issues, most of those are caused by dodgy plugins. Doing some research before installing a new plugin and selecting plugins carefully will get you a long way.
Additionally, there are services such as WordFence that alleviate many potential security issues.
1. WordPress works. It's worked for years and likely will work for years.
2. They don't know about or care about Markdown.
3. "JAMStack and headless CMSs" mean nothing to them. (Or to me for that matter. I use a static generator I coded myself. It's plain HTML and some python)
4. It takes minutes to set up and they don't have to care about anything other than their content.
2. Vast library of plugins
3. Lets you focus on content rather than twiddling bits.
4. Open source, php/mysql, you can host it anywhere.
5. Vast number of devs who know how to make changes to it.
6. Most of the functionality you need for a basic website, including: scheduling content, WYSIWYG editor, ecommerce (via plugins), integration with analytics, custom data types.
7. Did I mention it just works?
At least I haven't found one for Jekyll and 11ty, the two SSGs I have worked most with. It seems an architectural limitation of the SSG model.
All I want to do is to say "This blog post is ready to go on Jan 1, publish it without any action from me." Trivial in WP. People talk about cron, but really? I'm a dev, I can handle cron, but it seems a bit much to use to schedule a blog post.
But SSGs have a different set of design tradeoffs (the lack of a WYSIWYG editor being another piece of functionality that seems to me to be core to a CMS), so maybe I just need to accept that.
I don't think SSGs are all bad, either. I wrote a blog post a few months ago talking about the tradeoffs: https://www.mooreds.com/wordpress/archives/3369
I’m still dubious about installing plugins willy-nilly, and I usually keep to the default themes for a bit of added security, and I’ve had some issues in the past with unauthorised access but my site is pretty resilient to attacks now thanks to some custom coding.
[1] - https://hackaday.com/2020/09/23/displaying-incoming-server-a...
Unfortunately it looks very "loose" and much worse than Twenty Sixteen, but it's still a breath of fresh air.
What developers consider "simple" often bears no relation to reality.
Furthermore, it's often the case in my experience that developers miss out the whole point of these products: someone wants to make money and the CMS is merely an instrument that they don't care too much about as long as it helps them achieve their business goals.
I can use static site generators (and have used several in the past: Jekyll, Middleman, nanoc), but now I can simply open the web site and start writing. I don't need to be at home in front of my personal computer. I don't need to fiddle with themes and templates.
WRT to JAMstack and headless CMS: I cannot use those. I don't understand them. I certainly won't learn JavaScript and install huge development platforms and tool chains, just to write a few words (and sometimes even a photo).
Security is mostly a non-issue: Keep the number of plugins small, use WP Super Cache, and most of your pages are static anyway (and nginx will serve them without even running any PHP if you so wish).
You can find a pre-made website for any niche you can think of, you pay like $59 for a theme and you have a high-quality niche-specific website.
For example, I had to make a website for a physiotherapist, I just got this theme https://demos.qreativethemes.com/physio/ and changed the text/images.
The best part is that you know you are not stuck with a specific theme/solution/provider, at any point you can change any part and it will probably work without many issues.
I say this everytime a "but but WP is shit" post comes up, there is no better CMS for users that WP even in 2021 which is easy to setup, has a huge ecosystem and community, simple hosting options and many plugins that can enable a new functionality in no time. The tradeoffs it brings is much lower than the benefits.
You have non technical people managing the content? There are tons of tutorials you can refer to when they need to do something.
But yes, there are other great and simple products coming up that will overtake - but they remove the techie nonsense even more. Carrd, Webflow, and about a million others.
For years I fought against WordPress, thinking I could use a framework to make a better product. (Codeiginter, laravel, drupal)
Anybody trying to push headless CMSs or what ever is probably a developer.
To start a blog and change the world... 1. A resentment 2. Internet connection 3. 5 minutes to build your word press site. (or you could just rant on twitter/facebook)
Sure there’s security issues, but how do we know the CMSs you describe don’t also have issues? Wordpress is just pummeled much more so we’ll find more security issues. Plus now there’s a cottage industry of Wordpress security expertise that can mitigate these issues.
Something taking the place of Wordpress is akin to something taking Pythons place in data science. It’s possible, not insurmountable, but the tooling and mindshare have so much momentum it’s probably on a decade or so timescale for mass adoption outside of some niches.
The whole security issues piece is a misnomer IMO. Wordpress has had security vulnerabilities, but the reputation of “Wordpress is easy to hack” is down to poor quality admins, rather than poor quality WP code a lot of the time.
I wrote about this topic a while back - https://kevq.uk/the-case-for-wordpress/
Because I've never heard of "JAMStack and headless CMSs"? (Nothing anyone wrote on this page so far has made me feel like finding out what they are either. Self-hosted WP has worked great.)
For development: different reasons, depending on your use case. You have to always keep in mind who is using the solution in the end. If it's a client, it often means that the executive or marketing team will use it. "Headless CMS" or "regular CMS" means nothing to them and it shouldn't either.
(1) I've worked with a variety of open source CMSs (mostly PHP based), some are overly complicated to learn for someone without serious coding knowledge, some have been abandoned, leaving clients and users in the air, and some have changed their business model, forcing adjustments on my side. Wordpress was easy to learn (I've never had formal training, so it was all self-taught), it had very good documentation for a newbie, a huge community, it remained free and open source and it kept maturing. Installing and configuring WP is notoriously easy and the server requirements are almost never an issue. WP has been reliable all these years and I can't say I trust many of the emerging platforms to match it: the last thing I want is to go full in with a new tool which will be dropped in a few years because the creators couldn't monetise it or find the time to maintain it.
An easy choice for me and others like me.
(2) I've had to build websites for clients both alone as part of a team. Apart from the extremely rare case where a headless CMS was explicitly needed or requested by a client, regular WP was perfectly fine to do what they needed a CMS to do. Furthermore, many explicitly requested WP or a similarily popular open source CMS, in case they needed to work with a different Dev. A sensible business decision, in my view.
(3) Huge pool of developers, very large community, generous amount of tutorials on various aspects of customisation, incredible number of extensions and themes.
For content writing & management: different reasons again, depending on your use case.
(1) For my own projects, I see little reason to mess about with shiny new CMSs which force me to learn new unnecessary things or change the way I already do things after I've used a platform that simply works for about 11 years. This thing does the job well, it's as simple as that.
(2) It's genuinely easy to use for most people. Now I know this is a subjective appreciation to a good degree, but while I'm not saying that it can't be improved, I want to stress the fact that most clients who've use it for a while learn its logic rather fast and become independent users (in terms of publishing content) in a short amount of time, compared to other CMSs.
(3) 90% of our clients are not technical people, and even some of those that are technical don't know much about CMSs or don't care beyond some specific needs. Speaking to them about JAMStack and headless CMSs is like a car salesman who goes so deep into engineering and materials composition that scares the clients away. Instead, we ask what is it they're trying to achieve with their websites and what they think it's best way to do it; Wordpress almost invariably passes the test when we present it to them.
People who write & manage content are generally marketing people and execs. They care more about design and SEO than the technology itself, which makes sense.
2. It's not Drupal (Drupal 7 to 8 PTSD)
3. I love Open Source
4. It's familiar (10+ yrs WP development)
5. The Block Editor
These days there's a lot more than just trotting out static pages although mine does that through caching. Publishing pages on a schedule, having both posts and pages. Popularity measuring, and archives. I doubt theres any alternatives that has the range of plugins, themes and widgets that self-hosted Wordpress offers.
How do you evaluate this?