“Can’t bill a minute of it” is the crux of the problem.
There are all sorts of ways you can improve the management of customer WP sites. You can put each site in its own small VM, with caching, with FrankenPHP, set that up with cloud-init, manage the entire fleet remotely with WP-CLI, etc.
You can have your own themes, lock down your plugin choices, only use your own code in functionality plugins, all that.
But if your customers can administer the sites, something is going to burn you nonetheless, and when it happens nobody is paying.
Part of it is just that WordPress exists in the middle of the continuum between content and functionality, part of it is the odd mix of users: you can have technically unaware users who you inadvertently empower to make bad decisions. It’s not their fault: it’s an over-permissive architecture.
WordPress, in your own careful hands, can run brilliantly for years. In all the time I have run it (18 years now) my own sites have been fast, busy, stable, reliable: I have even run WP brochure sites for finance industry clients, and I have had full confidence in them.
But if you’re not going to be in charge of it, don’t run it. Because really no amount of monitoring and security mechanisms can stop this eventually happening.
Ultimately I have also decided I am not going to roll out any new WP sites that I have to maintain. But then (despite my admiration for Laravel) I am going to get out of using scripting languages for server side code at all. AI is going to make all internet-facing interpreters dangerous. It’s too large a surface and I don’t have the energy for php2shell Groundhog Day.
trollbridge 1 days ago [-]
I simply bill full rate for it. The handful of people who rely on it for their business are happy to pay.
snowwrestler 18 hours ago [-]
> In my experience that takes hours, and you can't bill a minute of it.
In my experience—paying agencies to build and support Wordpress sites for over 15 years—I absolutely get billed for security related work, as well as bug fix work. And I should.
This seems more like a business model issue, or bad customers.
Look at it this way: if your customers had an in-house engineering team building and running their Wordpress sites, do you think they could get away with not paying those people for the time spent installing patches and mitigating side effects? So why should they be able to not pay their agency for that work?
That work is Part Of The Deal with running websites, in general, regardless of the framework or CMS. For sure your hosting providers are making sure their revenue covers those costs across their infrastructure. So why aren’t you?
gnabgib 1 days ago [-]
Yesterday it was a Show HN[0] about how you've built a CMS.. today it's a blog post about the incumbent. Of course you don't recommend your competitor, you probably never did.
You are entitled to your opinions. That doesn't make them right. You clearly did not read the post. It begins by saying we have built over 1500 sites in wordpress.
walth 1 days ago [-]
Just kinda weird to pivot into promoting your vibe coded alternative that has been on GitHub for less than 24 hours.
prepend 19 hours ago [-]
And now you make money by selling something that’s not WordPress. It biases your whole argument.
“I used to sell Coke. Coke is terrible now. Buy PrependCola, it’s amazing.”
See how that would make all the blarg I write less trustworthy?
andOlga 18 hours ago [-]
Developing an alternative to a thing because you're fed up with the thing (and have specific painpoints you want adressed) is a perfectly reasonable course of action. But I'll agree that the whole "recommend to customers" angle is weird and probably shouldn't be in the post.
euroderf 19 hours ago [-]
Disclaimers and "markup" like <plug> ... </plug> serve a purpose.
Lord_Zero 16 hours ago [-]
He makes money on Hatamoto? How?
Lord_Zero 16 hours ago [-]
Bro is shocked that someone is making sensational blog posts to advertise their new project. Were you born yesterday?
chrisvenum 20 hours ago [-]
For those of you who have no choice but to use WordPress (marketing team/customer requirements), I strongly recommend you look at the roots.io stack.
It allows you to bring modern PHP development practices and sanity to WP while keeping the CMS the same for end users.
Bedrock introduces the ability to manage WP core and plugins using PHPs composer package manager meaning that plugins are tracked in git.
Sage is their theme which allows you to develop templates using blade and vite.
They also have radicle/acorn bring pretty much a Laravel setup with WP bolted on.
I will mention them anytime I see WP, the team are doing great work.
prepend 19 hours ago [-]
> There's no shortage of alternatives. Webflow, Wix, Squarespace, Ghost, Craft, Statamic
That I like about wordpress is that it is free and has no subscription costs. I run it on my cheap host and pay $0/month (patching myself, etc etc).
I don’t think stuff like Wix and SquareSpace are valid competitors as I don’t want to pay a monthly fee.
robtherobber 14 hours ago [-]
That was a weird list, save for one or two suggestions. Should someone suggest a list of alternatives in this context, they would very likely go with Drupal, Joomla, October CMS etc. WP is a PHP-based free, self-hosted and open source CMS, there is absolutely no reason to suggest a closed SaaS version as an alternative. A Java-based self-hosted open source alternative? Maybe. A .NET one? I guess so.
2001zhaozhao 9 hours ago [-]
Wordpress is quite unnecessary now, but so are other CMS's as you can just use AI to make a CMS with exactly the features you need from scratch. AI can also point you to existing frameworks that completely replace Wordpress functionality like page builders and then help you deploy them to the cloud, often as static sites that cost literally zero money to host.
I still have a WP site that I've used for the last ~7-8 years and I am planning to migrate off it in the near future.
StephenTynan789 1 days ago [-]
seems like these days ai can create a better design layout and backend than WordPress in significantly less time. It's lost its edge in spinning up semi-complicated websites quickly. Any site I can create on wordpress I could have Ai replicate or recreate in a matter of hours.
nicman23 1 minutes ago [-]
the issue is that people are not using wordpress for blog style things but for e-shops
marcus_holmes 1 days ago [-]
This. I now get Claude to spin up sites as needed, with dynamic functionality using vanilla JS and CSS. No frameworks, no CMS, nothing. If it needs a server and database then there's a ton to choose from, I'm currently using Cloudflare Workers and D1 but that could change in an instant to any similar service. Posting a new page is a matter of editing the text and images and then asking Claude to upload it and format it properly. 2 minutes' work.
bemtevi 1 days ago [-]
The number one criticism against Wordpress seems to be the plugin architecture. But if you only use a small set of plugins, maybe Akismet, and Loginizer, you can do a lot of things already. Plenty of people don't need many plugins. So maybe this alternative CMS is good too, but I think for a basic blog/website Wordpress is still a good choice. Of course, the author has a point if you have to use hundreds of plugins....
robtherobber 14 hours ago [-]
> Plenty of people don't need many plugins.
And they can also build or order bespoke ones, reducing the risks.
atoav 24 hours ago [-]
Let me tell you a story. A friend of mine earns a living creating WordPress sites for other people. Whenever there is a bigger problem I will get hired as the cavalry to fix it. That guy literally installs a plugin for everything. By that I mean every aspect of the original Wordpress is replaced by a set of plugins that were never intended to work together. Including layout. The content of posts is no longer stored in posts. There are multiple SEO plugins. There are plugins for simple things like image carousels that display ads in the admin interface, the code to display those ads is probably more complex than the plugin itself. There are paid themes, where the update would cost money that the customer usually is not willing to pay, since the website just works fine, until it does not. Needless to say if I wanted to build a ball of mud that is guaranteed to fail, I would probably call this guy the greatest of all time at that particular goal.
Needless to say, every now and then a plugin is not or cannot be updated and then a PHP update comes around and boom the house of card collapses. Or it is simply just a plugin that gets uninstalled and leaves the database vandalized. These are usually incredibly complex fixes and I am not cheap.
I have told the guy multiple times very precisely how to avoid these issues, but hey YOLO.
When he had a very important customer that demanded a low maintenance, high reliability website, he brought me on board from the start for once. Since I could not manage to steer him away from Wordpress, I at least told him every single plugin has to be vetted, and no fancy theme/layout builders. I still had to stop his urge to install plugins for some things and showed him how to fix them with simple CSS overrides, for the one thing we couldn't manage I wrote the plugin in extremely defensive PHP myself.
The site is going fine, but I didn't check in a while and he has admin rights.
pluc 22 hours ago [-]
Good analogy for AI.
dgiorgaras 17 hours ago [-]
[flagged]
mdrzn 22 hours ago [-]
"Every Hatamoto install gets its own private admin address."
This might be more inconvenient than a feature, since if I deploy websites for customers I'd have to write down what's the equivalent of wp-admin for each website.
zenincognito 22 hours ago [-]
The number one hit on most wordpress install and all other static site logs I have had has been /wp-admin and /wp-admin/install.php .. Infact, right not one of the hatamoto instances is reporting top hit as /wp-admin/install.php
prepend 19 hours ago [-]
Right, me too. I assume everyone running PHP had tons of hits to that. Been that way for like 20 years, but that doesn’t mean probers get past that.
nbajka 22 hours ago [-]
I once copied the wordpress files onto a new domain and a few minutes later a bot had already accessed /wp-admin/install.php and it helpfully installed the site for me using a database of their own to get RCE.
LoganDark 1 days ago [-]
`text-wrap: balance` looks terrible on these headings. At least use `pretty`.
There are all sorts of ways you can improve the management of customer WP sites. You can put each site in its own small VM, with caching, with FrankenPHP, set that up with cloud-init, manage the entire fleet remotely with WP-CLI, etc.
You can have your own themes, lock down your plugin choices, only use your own code in functionality plugins, all that.
But if your customers can administer the sites, something is going to burn you nonetheless, and when it happens nobody is paying.
Part of it is just that WordPress exists in the middle of the continuum between content and functionality, part of it is the odd mix of users: you can have technically unaware users who you inadvertently empower to make bad decisions. It’s not their fault: it’s an over-permissive architecture.
WordPress, in your own careful hands, can run brilliantly for years. In all the time I have run it (18 years now) my own sites have been fast, busy, stable, reliable: I have even run WP brochure sites for finance industry clients, and I have had full confidence in them.
But if you’re not going to be in charge of it, don’t run it. Because really no amount of monitoring and security mechanisms can stop this eventually happening.
Ultimately I have also decided I am not going to roll out any new WP sites that I have to maintain. But then (despite my admiration for Laravel) I am going to get out of using scripting languages for server side code at all. AI is going to make all internet-facing interpreters dangerous. It’s too large a surface and I don’t have the energy for php2shell Groundhog Day.
In my experience—paying agencies to build and support Wordpress sites for over 15 years—I absolutely get billed for security related work, as well as bug fix work. And I should.
This seems more like a business model issue, or bad customers.
Look at it this way: if your customers had an in-house engineering team building and running their Wordpress sites, do you think they could get away with not paying those people for the time spent installing patches and mitigating side effects? So why should they be able to not pay their agency for that work?
That work is Part Of The Deal with running websites, in general, regardless of the framework or CMS. For sure your hosting providers are making sure their revenue covers those costs across their infrastructure. So why aren’t you?
[0] https://news.ycombinator.com/item?id=50256725
“I used to sell Coke. Coke is terrible now. Buy PrependCola, it’s amazing.”
See how that would make all the blarg I write less trustworthy?
Bedrock introduces the ability to manage WP core and plugins using PHPs composer package manager meaning that plugins are tracked in git.
Sage is their theme which allows you to develop templates using blade and vite.
They also have radicle/acorn bring pretty much a Laravel setup with WP bolted on.
I will mention them anytime I see WP, the team are doing great work.
That I like about wordpress is that it is free and has no subscription costs. I run it on my cheap host and pay $0/month (patching myself, etc etc).
I don’t think stuff like Wix and SquareSpace are valid competitors as I don’t want to pay a monthly fee.
I still have a WP site that I've used for the last ~7-8 years and I am planning to migrate off it in the near future.
And they can also build or order bespoke ones, reducing the risks.
Needless to say, every now and then a plugin is not or cannot be updated and then a PHP update comes around and boom the house of card collapses. Or it is simply just a plugin that gets uninstalled and leaves the database vandalized. These are usually incredibly complex fixes and I am not cheap.
I have told the guy multiple times very precisely how to avoid these issues, but hey YOLO.
When he had a very important customer that demanded a low maintenance, high reliability website, he brought me on board from the start for once. Since I could not manage to steer him away from Wordpress, I at least told him every single plugin has to be vetted, and no fancy theme/layout builders. I still had to stop his urge to install plugins for some things and showed him how to fix them with simple CSS overrides, for the one thing we couldn't manage I wrote the plugin in extremely defensive PHP myself.
The site is going fine, but I didn't check in a while and he has admin rights.
This might be more inconvenient than a feature, since if I deploy websites for customers I'd have to write down what's the equivalent of wp-admin for each website.
Imagine the backwards compatibility.