Why do I use WordPress if it sucks?. Great question. Right now, WordPress is the most popular blogging/cms platform. It has all the eyeballs, all the developers building cool things for it in the plugin ecosystem, etc. That also means it’s a very big target for hackers. Small blogs like mine are not a very exciting target, but in the age of using search engines to discover lists of vulnerable sites, I may get hacked someday anyway. Not because I’m doing anything wrong, just because I’m running WordPress and that makes it nearly impossible to protect my site.
If you know what you’re doing, you can use search engines to show you all the sites running a particular (vulnerable) version of WordPress, sites using a particular plugin with known vulnerabilities, sites using a plugin that has been abandoned by its developer, etc. It’s not as simple as just updating the vulnerable plugin. Sometimes there isn’t a fix yet. Sometimes the fix requires something incompatible with some other plugin. The more plugins you run, the more likely you are to get caught in a situation where you are forced to remain vulnerable.
Sometimes it’s not even safe to upgrade WordPress core. Upgrading anything can break everything. I often find myself between a rock and hard place when it comes to upgrading. If I don’t upgrade WordPress core to the latest version, I remain vulnerable, but if I do upgrade WordPress core to the latest version, I may break my site due to incompatible plugins. Neither choice is very appealing. Sometimes it gets really complicated, where one plugin requires a newer version of PHP, but another plugin won’t work with that version. Sometimes the version of MySQL needs to be upgraded (and also can’t be upgraded for some other reason). It’s never pretty.
So you setup a staging site where you can test to make sure any upgrades don’t bring your site down. Most of the time, you’re fine. Nothing breaks. Or at least you don’t notice anything broken. Other times you find out that updating something breaks something. Then what? Wait for a plugin developer to fix the plugin? How long will that take? What if the plugin has been abandoned (and you don’t know it yet)?
Is the solution to use fewer plugins? Sure, but if you have to remove all the fun and interesting things, then you have to ask yourself why you’re running WordPress. Those plugins and the “ecosystem” are a big part of the reason you chose WordPress in the first place. And sometimes they play a big role in keeping you locked into the platform.
Running WordPress sucks. I look forward to leaving it behind someday.