For better of for worse, wordpress can at this point be considered critical infrastructure.
More confusing still, they were all on .net and .com-domains. I just couldn't figure out what was going on, .com-domains are expensive, typically link farms are on .xyz, .icu or something similarly cheap.
I don't have the number, but I'm certain I identified tens of thousands of them, if not a hundred thousand. That's close to a million dollars in domain fees. The numbers didn't add up, who would spend that sort of money on link farms? They were also hosted all over, not just on Chinese clouds like most spam offenders are.
It finally dawned upon me: What I was looking at was hacked wordpress instances. Holy crap there's a lot of them floating around.
The owner was totally unaware, as this never happens to them - they are logged into the site the whole time, so it deliberately never triggers/fires itself as they make updates, etc.
It was also somewhat random for users of the site, but when users see it, they probably just close it / ignore it.
Nobody told them this happened when browsing their website so they were totally unaware they had been comprised.
Moral of the story, always occasionally browse your own web properties from other devices and incognito windows, etc. to see what other people see.
But TL;DR: It's a form of search engine manipulation. The theory is that if you put a bunch of links to your low-ranking domain on a high ranking domain, search engines will think your content is more valuable and be more likely to crop up as top results. You set up a lot of these so they promote each other, making it look like your shady website is popular when it is not. It used to be more effective than it is today, but it's still relatively common.
Search engine manipulation doesn't need to be on these link farms, it's also relatively common to for example have a shady online casino raise their ranking by sponsoring open source projects, which reward them by linking to the online casino. That way the popularity of those projects will "rub off" on the online casino.
For worse.
> wordpress can at this point be considered critical infrastructure.
True, sadly, though I'm thankful that after yet another security incident the mid-size company I work for has decided to officially end WordPress use across all our domains. Hopefully, others will begin to do the same.
That can't be said about critical infrastructure.
"critical" means something. If the water system or the power grid goes down for a few hours, the world has a major problem.
If everything widely used is "critical infrastructure", then nothing is.
i think i agree with you but then started to think that huge whole parts of the Internet may not qualify by your definition.
WordPress has always been an absolute mess. The basic architecture was insane even in the early 2000s. There is no effective sandbox for plugins or themes, and you can't really make serious use of WordPress without those.
Nowadays, there are so many better applications that accomplish the same thing, and they aren't stuck on a half-baked database schema from 2003, they can be version-controlled, multiple people can work on them at the same time...
WordPress is one of the worst widely used pieces of software on the web. It is a catastrophe.
I mean, literally thousands of sites do make serious use of WordPress. Quite surprised that in your use of WordPress since 2006 you haven't heard about any of them.
For more custom projects, I prefer the headless variety[1] because it makes sense to separate the data and presentation layers. That means you have the full ecosystem and flexibility of HTML/CSS/JS.
Ghost[2] was the first serious competitor I saw years ago. Gatsby is among the most popular these days[3].
But honestly, information sites should just use SquareSpace or something like it. There's no reason to maintain static site infrastructure at this point.
People spin up a WordPress instance for their blog that they're totally going to use every day, install a bunch of plugins and a fancy theme, then within a few months have completely forgotten about it. Meanwhile, vulnerabilities are discovered in the plugins they installed. Maybe they're patched and maybe they're not, but either way their server doesn't get updated.
Within a few months it's hacked, and the ex-blogger probably doesn't know until they get an email from their hosting service complaining about malware being served from their blog.
This is made worse by the fact that, since WordPress is everywhere, it's worth the time for bad actors to write scripts to exploit vulnerabilities in outdated versions of popular plugins. It doesn't matter how obscure your site is, if it's written in WordPress and not up-to-date, it's as good as hacked.
Unless hosting the product is your core business model, let someone else do it, because then there will be one or more people dedicated to making sure it works perfect and is regularly updated.
They all seem to charge $90 for a year of updates. Gets steep quickly- theme, backups, layout builder etc. Fine for the first year but probably don’t get renewed and then the plug-ins don’t get updated.
I’d love to see a list of fully featured open source plug-ins.