WordPress

What hackers pick instead

• DrupalRecommended for its mature, battle-tested architecture, large community and built-in features that avoid reinventing a CMS; critics cite frequent major-version rewrites and maintenance and security concerns.30recommend
• Sveltia CMSFree git-based CMS for static sites with a mobile-friendly editing interface, which some users prefer over Decap and Pages CMS.7recommend
• SparktypeRecommended as an easy, open, portable publishing platform that respects static site generator conventions. Common caveat: mobile support reportedly doesn't work.5recommend

Every quote

The 40 most detailed of 617 comments. Each links to the original.

1. A basic instance, set to auto-update, installed on a shared webhost where OS/web server updates are someone else's problem is pretty foolproof.

   Mixed · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

2. the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far

   Mixed · Jul 2026 · in “Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25”

3. Wordpress' security track record isn't great, but I'm worried whether it would be safer if everybody builds their own CMS using AI.

   Mixed · Sep 2026 · in “Matt Mullenweg tells Automattic staff in Slack he's back in control after ouster”

4. Wordpress with a WYSIWYG page builder solves that — it's not the only solution, but it works pretty close to right out of the box.

   Recommends · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

5. They like being able to edit their own blogs, add new job listings, and rearrange the leadership page when people are promoted.

   Recommends · Feb 2026 · in “Lines of Markdown, a Claude Code Sensation”

6. WordPress stays winning because of the user-friendliness of its publishing workflows (vs SSGs), and self-reinforcing ecosystem.

   Recommends · Sep 2026 · in “Matt Mullenweg tells Automattic staff in Slack he's back in control after ouster”

7. There are no shortage of hosting companies out there to which you can deploy WP. In fact, many make it so easy it is ridonc.

   Recommends · Sep 2026 · in “Automattic's board forces CEO Matt Mullenweg into leave of absence”

8. There are super cheap shared-hosting plans the allow you to just do a couple clicks to install WordPress with full control.

   Recommends · Mar 2026 · in “Have a Fucking Website”

9. There's no maintenance if you go with a hosted solution with custom domains like Squarespace, Wordpress.com and the like.

   Recommends · Jan 2026 · in “The Case for Blogging in the Ruins”

10. The code quality is genuinely terrible, but it doesn't matter because every SaaS tool on earth has a WordPress connector.

    Mixed · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

11. WordPress won precisely because you could start with a $5 blog and end up with a full e-commerce site without a rewrite

    Recommends · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

12. Majority of those sites are powered by WP and various site builders, which is far more complicated than what they need.

    Mixed · Apr 2026 · in “The CMS is dead. Long live the CMS”

13. I have not yet seen an alternative for Wordpress + woocommerce for a simple e-commerce site that is not more expensive

    Recommends · Jul 2026 · in “Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25”

14. there isn't a replacement that will meet their needs that also doesn't require a higher degree of technical knowledge

    Recommends · Sep 2026 · in “Automattic has a new board after failed attempt to put CEO on leave”

15. Wordpress is solidly in that middle ground where you can do a large amount of customization if someone'll pay for it

    Recommends · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

16. if you're more of a designer or hobbyist that wants a somewhat hacky extendable blog system it's pretty easy to use

    Mixed · Jul 2026 · in “Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25”

17. They got there first, then as a result, they have: a big ecosystem of themes and plugins (especially for SEO)

    Mixed · Dec 2025 · in ““You should never build a CMS””

18. there's a whole ecosystem behind WordPress that, while it's a security nightmare, is also pretty damn useful

    Mixed · Sep 2026 · in “Mullenweg has returned as CEO after attempted board ouster”

19. marketing can make updates safely with a couple clicks and zero day-to-day development oversight required

    Recommends · May 2026 · in “Today I've made the difficult decision to reduce the size of Coinbase by ~14%”

20. WordPress hosting remains the top choice for bloggers who want a smooth, secure, and scalable platform.

    Recommends · Dec 2025

21. Biggest downside I know of: Wordpress is too much learning curve & overhead for a simple personal blog.

    Mixed · Nov 2025 · in “Personal blogs are back, should niche blogs be next?”

22. Wordpress has: the ability to schedule posts, a ton of plugins, a lot of people who know how to use it

    Recommends · Apr 2026 · in “The End of Eleventy”

23. all other services you'd ever want to integrate with offer some sort of plugin or integration with WP

    Recommends · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

24. wordpress is being absolutely obliterated by ai. work for commercial plugin authors and agencies has dried up while the platform and ecosystem see major security issues

    Criticizes · Sep 2026 · in “Automattic's board forces CEO Matt Mullenweg into leave of absence”

25. The plugin vulnerability issues in WordPress have become significantly worse, as low severity issues are now chained together that become a severe issue.

    Criticizes · Sep 2026 · in “Matt Mullenweg tells Automattic staff in Slack he's back in control after ouster”

26. our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc.

    Criticizes · Jul 2026 · in “Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25”

27. I tried setting Wordpress up for someone a couple weeks ago and the entire admin experience felt like someone designed it WHILE AT burning man.

    Criticizes · Sep 2026 · in “Automattic's board forces CEO Matt Mullenweg into leave of absence”

28. They seem to be interested mostly in adding more and more visual editing features that keep making the whole thing more unstable and messy.

    Criticizes · May 2026 · in “Breaking Up with WordPress After Two Decades”

29. So now instead of having plugins with security vulnerabilities we also have all kinds of escape scenarios within the main software package.

    Criticizes · May 2026 · in “WordPress 7.0”

30. takes away the maintenance hell from managing a WordPress installation or a similiar CMS with tons of plugins that break with every update

    Criticizes · Dec 2025 · in “Ask HN: What Are You Working On? (December 2025)”

31. a bot had already accessed /wp-admin/install.php and it helpfully installed the site for me using a database of their own to get RCE.

    Criticizes · Oct 2026 · in “I've used WordPress for 20 years, and I've stopped recommending it”

32. I realized that I don't want the security surface area, and the features it offers are more or less things I don't even want anymore

    Criticizes · Jul 2026 · in “Your 'App' Could Have Been a Webpage (so I fixed it for you)”

33. Wordpress is awful. The only thing it's got going is its moat, but that's not an engineering problem, but a people problem instead.

    Criticizes · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

34. Add to that predictable flat pricing. If most Wordpress sites became famous overnight I guarantee 90% of users would rather the site go down than figure out what to do with 15 minutes of fame and a 50k hosting bill

    Recommends · Sep 2026 · in “Automattic has a new board after failed attempt to put CEO on leave”

35. It could hardly be easier to cache the html output from wordpress at either the webserver or CDN level, and it will perform just the same as any "static site"

    Recommends · Apr 2026 · in “The CMS is dead. Long live the CMS”

36. I've been working with and managing thousands of WP sites for over a decade and the only issues I've had have been with sites acquired from 3rd parties

    Recommends · Apr 2026 · in “EmDash – a spiritual successor to WordPress that solves plugin security”

37. WordPress has a lot of resources out there, and going from bare metal to WordPress introduces a lot of staples of Linux systems administration

    Recommends · Nov 2025 · in “Ask HN: How would you set up a child’s first Linux computer?”

38. I wouldn't put Drupal or Wordpress near the top of the pile for good ones anyway, but I'd still put them above any bespoke CMS I've ever seen.

    Mixed · Oct 2026 · in “Drupal is now light-years ahead of its reputation”

39. WordPress has become so successful in large part because of his formal and informal commitments to the open source community

    Mixed · Sep 2026 · in “Automattic has a new board after failed attempt to put CEO on leave”

40. something like 25% of the web runs on software which this lunatic has this much control over, is problematic in itself

    Mixed · Sep 2026 · in “Mullenweg has returned as CEO after attempted board ouster”