I've used WordPress for 20 years, and I've stopped recommending it
hatamoto.dev
hatamoto.dev
There are all sorts of ways you can improve the management of customer WP sites. You can put each site in its own small VM, with caching, with FrankenPHP, set that up with cloud-init, manage the entire fleet remotely with WP-CLI, etc.
You can have your own themes, lock down your plugin choices, only use your own code in functionality plugins, all that.
But if your customers can administer the sites, something is going to burn you nonetheless, and when it happens nobody is paying.
Part of it is just that WordPress exists in the middle of the continuum between content and functionality, part of it is the odd mix of users: you can have technically unaware users who you inadvertently empower to make bad decisions. It’s not their fault: it’s an over-permissive architecture.
WordPress, in your own careful hands, can run brilliantly for years. In all the time I have run it (18 years now) my own sites have been fast, busy, stable, reliable: I have even run WP brochure sites for finance industry clients, and I have had full confidence in them.
But if you’re not going to be in charge of it, don’t run it. Because really no amount of monitoring and security mechanisms can stop this eventually happening.
Ultimately I have also decided I am not going to roll out any new WP sites that I have to maintain. But then (despite my admiration for Laravel) I am going to get out of using scripting languages for server side code at all. AI is going to make all internet-facing interpreters dangerous. It’s too large a surface and I don’t have the energy for php2shell Groundhog Day.
“I used to sell Coke. Coke is terrible now. Buy PrependCola, it’s amazing.”
See how that would make all the blarg I write less trustworthy?
In my experience—paying agencies to build and support Wordpress sites for over 15 years—I absolutely get billed for security related work, as well as bug fix work. And I should.
This seems more like a business model issue, or bad customers.
Look at it this way: if your customers had an in-house engineering team building and running their Wordpress sites, do you think they could get away with not paying those people for the time spent installing patches and mitigating side effects? So why should they be able to not pay their agency for that work?
That work is Part Of The Deal with running websites, in general, regardless of the framework or CMS. For sure your hosting providers are making sure their revenue covers those costs across their infrastructure. So why aren’t you?
Bedrock introduces the ability to manage WP core and plugins using PHPs composer package manager meaning that plugins are tracked in git.
Sage is their theme which allows you to develop templates using blade and vite.
They also have radicle/acorn bring pretty much a Laravel setup with WP bolted on.
I will mention them anytime I see WP, the team are doing great work.
That I like about wordpress is that it is free and has no subscription costs. I run it on my cheap host and pay $0/month (patching myself, etc etc).
I don’t think stuff like Wix and SquareSpace are valid competitors as I don’t want to pay a monthly fee.
I think it's hard to compete on initial setup when someone is using Claude. Now for expensive projects where the client has the budget for a custom site and a real design team. I think WordPress is fine. But at that point, my question would be why? You have the resources to code by hand at that point.
Needless to say, every now and then a plugin is not or cannot be updated and then a PHP update comes around and boom the house of card collapses. Or it is simply just a plugin that gets uninstalled and leaves the database vandalized. These are usually incredibly complex fixes and I am not cheap.
I have told the guy multiple times very precisely how to avoid these issues, but hey YOLO.
When he had a very important customer that demanded a low maintenance, high reliability website, he brought me on board from the start for once. Since I could not manage to steer him away from Wordpress, I at least told him every single plugin has to be vetted, and no fancy theme/layout builders. I still had to stop his urge to install plugins for some things and showed him how to fix them with simple CSS overrides, for the one thing we couldn't manage I wrote the plugin in extremely defensive PHP myself.
The site is going fine, but I didn't check in a while and he has admin rights.
And they can also build or order bespoke ones, reducing the risks.
This might be more inconvenient than a feature, since if I deploy websites for customers I'd have to write down what's the equivalent of wp-admin for each website.
I still have a WP site that I've used for the last ~7-8 years and I am planning to migrate off it in the near future.
Imagine the backwards compatibility.
so the whole ecosystem should disappear.