New Website - wordpress, Joomla or something else?

[Roberto]

Thanks for all the replies - think standing back is probably the best thing on this occasion.

 

Yeah. Going back a long time now, I did my college's website once. The best lesson I learned from that was not to do it a second time. Also, as has been pointed out by FN-GN above, the website is a marketing task, not an IT task. Your job should begin and end with facilitating the platform if it's hosted in-house.

 

Oh and possibly steering them away from the idea that individual contributors throughout the org will be directly editing the website, because that'a a fair contender for lesson #2 from my past experience. That idea is bad and whoever is suggesting it should feel bad. At best no one will bother, and at worst you'll get a mix of fonts; badly taken, poorly cropped and improperly uplaoded photos; editorial mistakes; dead links; and typos that will make your website look like an absolute joke.

Edited November 7, 2022 by Roberto

[k-strider]

i agree with most of what has been said its a marketing thing... our web dev has just dropped us a we cant do basic hosting anymore we have to move you to one of our new wow packages bronze silver or gold.. but lots of wow... sounds like a lot of bs to me... but we are talking circa 800% increase in annual cost... Needless to say we are not happy and not sure what we will be doing going forward... id like a WordPress based site designed by proper web developers so it looks good and fulfils our requirements - that way if its WordPress we have some more flexibility of moving the hosting etc as we aren’t stuck with a proprietary CMS

[mavhc]

Never put data into a system you can't get it out of again

[Delgado]

Wordpress sucks so bad it blows. It is the most insecure web platform on the planet. So easily hacked. Practically a full time job to keep it patched. Rarely looks consistent on phone, tablet and PC.

I've seen a local academy school using a Google site recently. Very tidy and very secure. They must be paying all of £20 a year for the domain name. Custom CMS sites - dear me - talk about money for old rope.

[NokiX]

Wordpress sucks so bad it blows. It is the most insecure web platform on the planet. So easily hacked. Practically a full time job to keep it patched. Rarely looks consistent on phone, tablet and PC.

I've seen a local academy school using a Google site recently. Very tidy and very secure. They must be paying all of £20 a year for the domain name. Custom CMS sites - dear me - talk about money for old rope.

 

To be fair WordPress is made even more insecure by the thousands of themes and plugins people end up installing, some of which never get updated. You can absolutely improve things by having a decent mod security ruleset which most hosts include by default (either paid rulesets from places such as atomic or the rules included with Imunify as an example), there's also systems such as bitninja (and imunify) which are pretty good at detecting and blocking malicious activity. Honestly though, you are right that WordPress is easily hacked in most cases, that's always going to come with being a popular CMS as it ends up being heavily targeted. IMO something like Ghost offers a more secure "blog" style website although it is more complex to setup for most users given it uses node.js.

[mavhc]

Enable auto updates for plugins and wordpress, and don't install a load of plugins for fun.

 

2012 was the last serious WP vuln, and that was about Flash, have to go back to 2009 for something that affected everyone.

 

Of course you can always convert your non public wordpress site to a static site automatically, and just server html/js from a webserver, now it's unhackable

 

https://github.com/WP2Static/wp2static

[colly72]

I'd caution against auto-updates for Wordpress/plugins personally. I've seen too many updates break sites. if you're going to do it, be sure that you have a robust backup routine in place. Fully agree that updates should be applied ASAP but for me this should be a manual and ongoing process. Employ MFA for backend/admin login, complex password enforcement, disable/rename out of the box admin account, use a decent security plugin such as Wordfence etc and enable recommended options.

[mavhc]

Which updates broke which sites? And why were those sites badly coded?

[colly72]

Which updates broke which sites? And why were those sites badly coded?

 

I've had many a site break with plugin updates, PHP updates and sometimes Wordpress core itsself. It's not necessarily bad coding, it's the nature of updates.

[mavhc]

I've had no sites break with plugin updates, or wordpress, not done the major php upgrade yet, but minor ones no problem.

 

Which updates broke what, and why?

 

I'll test the major php update on my dev copy first though

[colly72]

I've had no sites break with plugin updates, or wordpress, not done the major php upgrade yet, but minor ones no problem.

 

Which updates broke what, and why?

 

I'll test the major php update on my dev copy first though

 

I can't give you a definitive list of what specific plugin update, or Wordpress version has broken the many sites that I have managed or developed over the 15 or so years I've actively used Wordpress but they have been numerous and varied, free and commercial plugins and/or themes. I prefer the control of backups, testing and manual updates over the auto-update process.

Edited December 12, 2022 by colly72

[DGardiner]

never had issues with any of ours and theyre all on auto update/cpanel managed updates.

[colly72]

https://updraftplus.com/the-risks-and-pitfalls-of-wordpress-auto-updates/

[DGardiner]

https://updraftplus.com/the-risks-and-pitfalls-of-wordpress-auto-updates/

 

i mean its hardly an unbiased place to get that info. Yo wordpress updates are scary, oh by the way we sell and upgrader thingamabob that gets rid of all your headaches.

 

Cpanel comes with a smart updater anyway, ive genuinely not had any issues in the last 3 years with 13 sites.

 

EXCEPT the ones that paid a web design company to make a custom theme, which doesnt work with php 7.3+ and its almost entirely not customisable and definately not updatable by anyone except the it team as its all html...

[colly72]

i mean its hardly an unbiased place to get that info. Yo wordpress updates are scary, oh by the way we sell and upgrader thingamabob that gets rid of all your headaches.

 

Cpanel comes with a smart updater anyway, ive genuinely not had any issues in the last 3 years with 13 sites.

 

EXCEPT the ones that paid a web design company to make a custom theme, which doesnt work with php 7.3+ and its almost entirely not customisable and definately not updatable by anyone except the it team as its all html...

 

The Updraft article is just one example. Many similar articles available.

 

You have kind of contradicted yourself too. Not had any problems, except for the sites where I've had problems.

 

If you're happy though, crack on.......

Edited December 12, 2022 by colly72

[mavhc]

That's the problem when you get someone to write code for you, you've no idea if it's good code.

 

"Can this guy I used for my personal website edit the school website to add some features?" he comes back with: never change any page name, nor ever add any more pages, nor update anything and it'll work great. I reverted the site to the vm snapshot before he logged in and did it myself.