I feel this post is somewhat misguided. Any framework or bespoke code is only as good as the developer who made it, and installed it.

Recommending somebody use Ruby rather than PHP because you dislike one CMS is a bit extreme.

SFTP is completely fine. I doubt many if any are still using plain FTP. Most sites will be updated automatically with SVN or GIT though - no reason why updates to WordPress should be different from any other code base.

It's important to remember that a fresh install is designed to be easy for beginners. A professional obviously has to make some changes, such as pretty URLs. The reason why this defaults to ids is because some hosts don't allow changes to Apache with .htaccess - enabling it by default can lead to server errors.

It's completely normal for any Framework to have the basics and require plugins / components. Suggesting that this means WordPress alone is poor because of it is not constructive.

Yes you should install caching and security plugins. Yes hiding file extensions and server architecture is a good thing - by hiding these things you make it less likely to be a target for hacking. A good WordPress blog doesn't look like a WordPress blog at all when you look at the source code. Having these things exposed by default is standard, not incomplete.

I do want to remind everyone that web development is a professional career - if you're complaining about the tools not being good enough in their default state then who are you complaining to? Yes, WordPress is a good solution for blogs and simple CMSs. No, it's not brilliant at everything.

In response to " learn how to write a proper website instead " I wholeheartedly agree - learn how to make a full, accessible, responsive, optimised, secure website. From scratch. No frameworks. Regardless of whether or not you use frameworks in your day to day development, being technically able to write the framework yourself will make you a much, much better developer.

Learning the basics of Jekyll takes 1 hour, and it's a one way ticket!

Hosting a static website is free with Firebase (SSL included).

Adding an online editor on top of Jekyll (that will commit the changes in the repo) is also possible with a third-party SaaS.

And it's 100% secure... because it's static.

I have been using WordPress for past 4 years. I do agree you, lots of plugins come without test cases and that opens up security issues.

but I disagree about WordPress core didn't unit tested. they do also they encourage plugin / theme authors to follow the same

make.wordpress.org/core/handbook/testing/automate…

The plugins makes you life easier, we cannot write code each and every functionalities. there are 70k+ plugins from the 1 min staging to incremental backups.

there a plug-in called versionPress its a VCS for WP and also you can do continues deployment with app.buddy.

Most of the WP people use FTP agreed but that's a option, WordPress supports FTPS, and SFTP also.

There are lots people contributing for WP. make.wordpress.org/chat all security issues patches immediately and plugins/themes will be intimated about issues and if they don't release the patch then that will be removed from the repo.

And it doesn't require any coding knowledge to have your own blog, Need to backup, stage, clone, put maintenance mode, VCS, easy theme customization....? There are plugins for everything.

You take any software it has some disadvantages, that doesn't mean that we SHOULD NOT USE them.

27% sites are running on WordPress.

This might be a good opportunity to link to 10up's Engineering Best Practices, a collection of advice & tools for writing secure, performant code for WordPress. I think there's a WordPress hosting best practices doc in the works, which will probably be coming out later this year.

The teams I work with build highly scalable WordPress sites for some pretty big clients. Your last paragraph touches on the core of the issue: by adapting version control, CI/CD servers, and so on, a lot of what makes WordPress such a powerful tool for beginners goes out the door. But, the WordPress core team pays a lot of attention to user experience, and it provides a friendly back-end for managing content. If anyone's used WordPress to post pictures of their cat or run a mommy blog, they can post to their corporate site, too. That's pretty amazing.

I don't want to pick apart the individual points of your post. There's a lot I disagree with, but that's only because I have years of experience building & hosting enterprise WordPress sites. And I don't think the community does enough to spread this essential knowledge. Our documentation, our conferences…so many things are geared toward absolute beginners. I'm giving a talk on Functional Programming for WordPress developers at WordCamp Boston this month. I'm kind of curious how many people are going to show up.

But I do want to address two details:

If you're managing your own server(s), don't use something like W3TC. WordPress has built-in support for something called an Object Cache, which stores query results, "transients", and other data in an in-memory store. We prefer memcached because it's mature, using Zack Tollman & 10up's plugin. On some sites we use a Redis object cache plugin because a particular host might prefer it or have the daemon running because of another site. For full-page caching, you want Batcache which stores pages in memcached. These plugins are more lightweight and better maintained than the mainsteam caching plugins, plus they let you use a shared cache server so multiple web heads can take advantage of the work the rest of the servers have already done.

Likewise, if you have multiple servers…well, first all your code should be managed in a VCS like Git, and that includes plugins & themes. Add define('DISALLOW_FILE_EDIT', true); to your wp-config.php so nobody thinks they can just install a plugin when they want to. Second, either put your wp-content/uploads directory on a shared resource (NFS or S3) so files are available to all the servers, or synchronize the files across all the servers with Unison. There's no excuse for your WordPress install's files to be different between servers for more than a few seconds.

I don't agree with your statement that "if you are professional enough to do so, you will have run away from it long time ago". WordPress is the foundation of most of the things we build. I'm seeing more & more projects from our team and others using React with WordPress's REST API. And you could argue that bolting on things like memcached, Elasticsearch, nginx microcaching and so on is just covering up the platform's weaknesses. But it also allows us to leverage its strengths as we produce modern experiences.

You have very valid points. I use wordpress for my own blog just because I frankly don't care about most of that because I'm literally just trying to throw up my research which doesn't require much and I do like the plugin support and ease-of-use for what I do. This seems to be a common sentiment in the InfoSec community as most every other researcher I know has an equally ugly, POS website. But people still go there because it's the only way to get that info. In fact, to be honest, I think in the InfoSec world if you do have a hip, modern, flashy website like a lot of sites in other spaces, you're actually looked down upon.

I know what I just said is a web dev's nightmare but that's reality for me; I already spend far too much time screwing with x86-64 assembly, studying operating systems, writing Python scripts, and etc.... To sit down and really think out my site right now. Am I proud of that? No. But the site works for what I need it to and looks decent compared to some of the others out there in my space. Would I have this attitude if I were a web dev? Of course not. The critical aspects of what my job entails (not web dev at all), I don't have this attitude at all and in fact I am extremely careful about what I put out there both in terms of my code and my written works. I just thought I'd drop a line and explain an audience that WP may still be decent for... Those who only want "decent!"

That all said, you make fantastic points and generally universal ones as well. No "one-size-fits-all" solution is ever the best-in-class in any area and I also realize that many folks that this article is geared towards are unlike me and probably trying to use Wordpress to run stores, full-blown websites, and other non-blog things. They also probably have products and rely on their website to sell them, unlike I do. So therefore, I would recommend your suggestions to those people and businesses.

Thanks for the Ghost rec, though I have not seen it in action yet. Frankly, I think I'm going to go with jekyllrb.com if I ever leave Wordpress.