I've done quite a few non - trivial projects in WordPress. To get this out of the way: Yes, like many CMS projects, WordPress was built by people who couldn't program and it shows. The architecture is a historically grown hodgepodge with some very strange things going on in it. Hardwired URLs and Shit. Totally bizarre.
However, this, strangely enough, comes with some counterintuitive advantages. For instance, because just about everything is procedural in WordPress, one error breaks your entire callstack which in turn has new bugs your project often show up immediately. That actually has turned out to be an advantage I didn't expect.
Advantages of WordPress
Here I'll give you a few advantages of using WordPress for your projects, even if they are larger.
Child Templates
Templating done right. No bullshit inner platform like blade or twig or smarty or whatnot. Existing templates (themes) get piped through child templates, and aside from some small boilerplate, you just put your changes into the child folder, all the rest gets fetched out of the parent folder. You can take a super sophisticated commercial theme and modify it just the way you like it without even touching the original. WordPress rules here.
Plugins
WordPress press may be shit, but you can work around that in 20 minutes or less. Writing a Plugin that integrates into WordPress is trivial. As is integrating your own dashboard pages. Auth/Auth, DB access, Rest Api with auth tokens and such is there and ready to use, the rest you can to yourself.
Time to market
Unbeatable. I'll have WP staging up and running including the custom post types that resemble the custom object types we need within the hour. The editors can start doing their thing before I write the first line of code.
Dashboard isn't scary for regular people
This is a big one. Getting a regular user familiar with WordPress dashboard goes very easy. Onboarding someone into you workflow can be done on the side.
Good security
Stop laughing. 200 million active installs make for very good security. All bugs and severe exploits are shallow and fixed within days. There is a huge market for third party security services and cdns for WordPress. Makes things very easy.
Existing plugins
An abundance of 3rd party plugins for all problems you can think of. Including some you wouldn't think of. WordPress orchestration with a Plugin for instance. Cluster management at app level if you will. Very strange, but it works.
Lots of FOSS tools and libraries
WP CLI, WP model, etc. All finished and ready to use. For every WordPress problem there is people have already made a solution.
I appreciate your response. You make many valid points!
Security for the core is great, however I've heard that there are issues with some plugins
and that this would be the main source of a security issue? This is just what I've read however.
At what stage would you not consider Wordpress for a project? Do you feel that Wordpress is the best tool for websites full stop? Would you be able to provide an example of a larger non-trivial site using Wordpress ( not using the REST api )?
Security for the core is great, however I've heard that there are issues with some plugins and that this would be the main source of a security issue?
Your computer operating system is secure, but the software that you have installed isn’t. The operating system might have it’s own secure and closed API, but the external softwares that depend on the operating system may still be able to use the parent language that is more raw.
WordPress has their own secure and closed API, but every plugin can still be able to use the parent “language” of WordPress, that is PHP.
At what stage would you not consider Wordpress for a project?
IMO, any project that does not contain blog posts.
Correct me if I'm wrong, as I haven't created a plugin for wordpress. But plugins can be created and submitted quickly and easily judging by the comments below. They can then be installed easily and without thought, by users that don't know the implications. Perhaps giving plugins unregulated access to server-side code isn't ideal?
The list of vulnerabilities and exploits is pretty extensive for wordpress plugins - surely there must be a better way?
They can then be installed easily and without thought, by users that don't know the implications.
You can install a plugin with syntax error in it and then just get a blank screen.
Perhaps giving plugins unregulated access to server-side code isn't ideal?
It’s your web hosting provider duty.
Surely there must be a better way?
Just keep it up to date, and follow the support forums related to the plugin. Security holes sometimes come from old plugins that are no longer updated (but you don’t know and just install it anyway).
Using official plugins or paid plugins must be better (since you could easily complain about things).
If you know you're application is going to be microservices from the get-go and there is a clean app-model in place and the core technology will not be PHP then not using WP is pretty much a no-brainer.
If you're going to have applications and APIs as a first class citizen in your project and it must scale along multiple dimenions, WP is a bad choice. Especially if you have a team of experts and the PO/Customer knows what he wants and the architecture is properly designed. Using WP in such a scenario would be silly.
However, if time to market is your constraint and you're dealing with a customer who doesn't know what he/she wants, then WP is a very good choice. Prototyping a larger app in WP can be hackish, but time to market is next to none.
WordPress can also make sense as a pure CMS with the application streched out behind it with tons of microservices and some gluecode to handle editing and content distribution. If you have caching and search and all the tiny tidbits seperated out, WP is small enough to still service as a neat editing environment.
I'm a JS Subject Matter Expert (SME) that has spent the past few years spearheading curricula and teaching initiatives at colleges and bootcamps, in person and virtually.
WordPress is worthwhile for larger projects too.
I've done quite a few non - trivial projects in WordPress. To get this out of the way: Yes, like many CMS projects, WordPress was built by people who couldn't program and it shows. The architecture is a historically grown hodgepodge with some very strange things going on in it. Hardwired URLs and Shit. Totally bizarre.
However, this, strangely enough, comes with some counterintuitive advantages. For instance, because just about everything is procedural in WordPress, one error breaks your entire callstack which in turn has new bugs your project often show up immediately. That actually has turned out to be an advantage I didn't expect.
Advantages of WordPress
Here I'll give you a few advantages of using WordPress for your projects, even if they are larger.
Child Templates
Templating done right. No bullshit inner platform like blade or twig or smarty or whatnot. Existing templates (themes) get piped through child templates, and aside from some small boilerplate, you just put your changes into the child folder, all the rest gets fetched out of the parent folder. You can take a super sophisticated commercial theme and modify it just the way you like it without even touching the original. WordPress rules here.
Plugins
WordPress press may be shit, but you can work around that in 20 minutes or less. Writing a Plugin that integrates into WordPress is trivial. As is integrating your own dashboard pages. Auth/Auth, DB access, Rest Api with auth tokens and such is there and ready to use, the rest you can to yourself.
Time to market
Unbeatable. I'll have WP staging up and running including the custom post types that resemble the custom object types we need within the hour. The editors can start doing their thing before I write the first line of code.
Dashboard isn't scary for regular people
This is a big one. Getting a regular user familiar with WordPress dashboard goes very easy. Onboarding someone into you workflow can be done on the side.
Good security
Stop laughing. 200 million active installs make for very good security. All bugs and severe exploits are shallow and fixed within days. There is a huge market for third party security services and cdns for WordPress. Makes things very easy.
Existing plugins
An abundance of 3rd party plugins for all problems you can think of. Including some you wouldn't think of. WordPress orchestration with a Plugin for instance. Cluster management at app level if you will. Very strange, but it works.
Lots of FOSS tools and libraries
WP CLI, WP model, etc. All finished and ready to use. For every WordPress problem there is people have already made a solution.
That's a shortlist from the top of my head. Further reading and details here: richdale.de/into-the-abyss/
My 2 cents.
I appreciate your response. You make many valid points!
Security for the core is great, however I've heard that there are issues with some plugins
and that this would be the main source of a security issue? This is just what I've read however.
At what stage would you not consider Wordpress for a project? Do you feel that Wordpress is the best tool for websites full stop? Would you be able to provide an example of a larger non-trivial site using Wordpress ( not using the REST api )?
Your computer operating system is secure, but the software that you have installed isn’t. The operating system might have it’s own secure and closed API, but the external softwares that depend on the operating system may still be able to use the parent language that is more raw.
WordPress has their own secure and closed API, but every plugin can still be able to use the parent “language” of WordPress, that is PHP.
IMO, any project that does not contain blog posts.
Correct me if I'm wrong, as I haven't created a plugin for wordpress. But plugins can be created and submitted quickly and easily judging by the comments below. They can then be installed easily and without thought, by users that don't know the implications. Perhaps giving plugins unregulated access to server-side code isn't ideal?
The list of vulnerabilities and exploits is pretty extensive for wordpress plugins - surely there must be a better way?
You can install a plugin with syntax error in it and then just get a blank screen.
It’s your web hosting provider duty.
Just keep it up to date, and follow the support forums related to the plugin. Security holes sometimes come from old plugins that are no longer updated (but you don’t know and just install it anyway).
Using official plugins or paid plugins must be better (since you could easily complain about things).
If you know you're application is going to be microservices from the get-go and there is a clean app-model in place and the core technology will not be PHP then not using WP is pretty much a no-brainer.
If you're going to have applications and APIs as a first class citizen in your project and it must scale along multiple dimenions, WP is a bad choice. Especially if you have a team of experts and the PO/Customer knows what he wants and the architecture is properly designed. Using WP in such a scenario would be silly.
However, if time to market is your constraint and you're dealing with a customer who doesn't know what he/she wants, then WP is a very good choice. Prototyping a larger app in WP can be hackish, but time to market is next to none.
WordPress can also make sense as a pure CMS with the application streched out behind it with tons of microservices and some gluecode to handle editing and content distribution. If you have caching and search and all the tiny tidbits seperated out, WP is small enough to still service as a neat editing environment.
That's more than 2 cents! 😼