WordPress Now Powers 25% of the Web 143
An anonymous reader writes: According to data from W3Techs one in four websites is now powered by WordPress. According to the report: "WordPress is used by 58.7% of all the websites whose content management system we know. This is 25.0% of all websites.” Venturebeat reports: "Today is a big day for the free and open-source content management system (CMS). To be perfectly clear, the milestone figure doesn't represent a fraction of all websites that have a CMS: WordPress now powers 25 percent of the Web.
In other news, the web is at least 24% unsecured (Score:5, Interesting)
About 95% of the WordPress sites I've run across have allowed user enumeration, exposed internal paths, or had old software that could be exploited. So...I'd probably say that "25% of all websites are WordPress" really means "at least 24% of all websites are insecure".
Re:In other news, the web is at least 24% unsecure (Score:5, Insightful)
Re:In other news, the web is at least 24% unsecure (Score:5, Informative)
>> Is this a problem of WordPress, or just a popular CMS?
User enumeration is ON by default in WordPress and it's baked into the design. (There are plug-ins to disable it but most people don't use them.) This is pretty unique among LMSs. WordPress's architecture (which allows the use of old plug-ins) also frequently seems to lead to the reintroduction of helper files that have old vulnerabilities, two of which happen to frequently be "directory browsing" or "internal path disclosure". As for keeping old software up-to-date, that's a problem that all LMS's have to deal with, but there's usually enough on these other WordPress-specific issues on a target site to give your average security person a place to dig in.
Re:In other news, the web is at least 24% unsecure (Score:5, Interesting)
Because other CMS are complete. Wordpress relies on everything to be a plugin. Upgrade your wordpress, break the plugins your site depends on. Even if they don't break right away, there are lots of small problems that can happen later, or only under certain circumstances. Been there, done that.
Wordpress isn't a CMS for actual people to use. It's a pre-hacked system for people who like tinkering with systems. You want an actual CMS, go elsewhere, and I'm not talking about rival free software platforms.
Re: (Score:2, Insightful)
Wordpress is incredibly easy to set up. I know someone who's computer skills extend to word, excel and a tiny bit of Photoshop who has a domain and wordpress based blog.
With that kind of low barrier to entry it stands to reason that people will have no idea about security. Some people will say the fault is with wordpress but the reality is wordpress can be setup securly and I'm willing to bet that if it were any other CMS we were talking about the results would be the same.
Re: (Score:3)
Is this a problem of WordPress, or just a popular CMS?
Drupal is also hugely popular, to the extent that it's actually a government favorite, and yet it doesn't have the same kind of holes as WordPress. That's not to say that it's wholly secure; there's advisories for Drupal all the time. But I think also that a different kind of user installs Drupal, one who actually knows their way around a line of code here and there, and one who will keep up with their updates. Even though WP has automatic updates and Drupal doesn't, WP gets exploited far more... even per c
Re: (Score:2)
Well, not to leave Drupal out too much, it did have https://www.drupal.org/SA-CORE [drupal.org]....
Oh yeah, it's deeply embarrassing when your framework intended to stop SQL injection has a SQL injection hole in it. But it's not quite as embarrassing as being a constant source of infection to the rest of the interwebs because you're so supremely easy to exploit as WP. It also got fixed quite promptly...
Re: (Score:2)
Yes, it is better that your plugins contain the sql-injection attacks so the core doesn't have to deal with them.
Re: (Score:2)
As someone who had to dig deep into WordPress codebase at some low point in life... there's little admins can do about it.
Besides, one of the strong selling points of WordPress is its engine for supporting plugins, which is itself a vast ecosystem. In other words, it allows you to run the most terrible pile of code you could ever encounter on the Internet.
Re: (Score:2)
Is this a problem of WordPress, or just a popular CMS? If the admins aren't doing their job for WordPress, why would they start doing it for some other package?
Because for most websites, I've got to pentest from tens of IP addresses to find your vulnerabilities. There is a minimum bar for cracking your site. But if you're running Wordpress I can look at your meta tags and know wxactly which exploits will work and what I will get out of them. Even better, I can use DuckDuckGo to find your site and tens of thousands like it, all with doors wide open.
The difference between Wordpress and a well-built site is the difference between the corner prostitute and Melinda G
Re: (Score:2)
So how was she? All the time and patience worth it?
Ask Bill. He always gets the girl!
Re: (Score:2)
If your CMS requires a competent admin to be secure, it has no business marketing itself as a turnkey solution.
User enumeration, seriously? (Score:3)
What is the actual risk from user enumeration, especially on a site not about a medical condition?
And how can it be prevented? Do you really want to allow two users to have the same username? If a user sends a private message to a nonexistent user, what error message strikes the best balance between security and usability?
Re:User enumeration, seriously? (Score:5, Informative)
>> What is the actual risk from user enumeration, especially on a site not about a medical condition?
It can tell you whether or not the default admin user is still present. It can also suggest what some of the other admin accounts are, since they are often the lowest numbered accounts on WordPress. (e.g., if you delete default admin - user #1 - your new admin is often the name of user #2). It's also a lot of fun for social engineering, particularly if you can crack or create a "mere contributor account" and then convince one of the admins (ferreted out through user enumeration) to promote you to an editor.
(Remember that WordPress user enumeration isn't classic user enumeration, where you can simply tell if a username is in user or not - it's literally the ability to say "give me user #1, 2, 3....100".)
>> And how can it be prevented? Do you really want to allow two users to have the same username?
On a system like WordPress, you always tell the user "yep, I just created that account" during user registration but you use the email address already on file for the existing to send an alert to the first registered user saying "hey, someone just tried to recreate your account - was that you"?
>> If a user sends a private message to a nonexistent user, what error message strikes the best balance between security and usability?
Most WordPress systems I've seen don't use comments or PMs or any of that overhead - they're mostly single-user (or all admin) systems for "read only" content. In those cases (most cases?) the dial should be set to "no one needs to know the list of usernames on these systems."
Same username, different e-mails (Score:2)
give me user #1
Then we've found the real WTF: sequential assignment of user IDs. Instead of relying on MySQL AUTO_INCREMENT, it should be using random_int(0, 999999999) or the like.
On a system like WordPress, you always tell the user "yep, I just created that account" during user registration but you use the email address already on file for the existing to send an alert to the first registered user saying "hey, someone just tried to recreate your account - was that you"?
Consider the following cases:
Re: (Score:2)
Then we've found the real WTF: sequential assignment of user IDs. Instead of relying on MySQL AUTO_INCREMENT, it should be using random_int(0, 999999999) or the like.
Right, security through obscurity is the obvious solution. If you fix the symptom then it's like the problem isn't even there.
A million hits to get one user (Score:2)
If you have a billion possible user IDs, but only a thousand correspond to users with commenting privileges and only ten correspond to accounts with anything near administrator-level access, an automated online process will have a heck of a time getting through whatever throttling you've already put in place.
Re: (Score:1)
the problem lies in wordpress having a default page built in called /author/usernumber/
for instance, if I try loading /author/1/, wordpress will redirect to /author/username/. An attacker can then issue brute force attacks on said username.
I put a stop to this in apache with the following (note: I don't run any sites that need to make use of /author/, which displays posts written by an author)
RewriteEngine On
RewriteCond %{REQUEST_URI} !/wp-admin.*
RewriteCond %{QUERY_STRING} ^author=.*$
RewriteRule
Re: (Score:2)
WP needs a builtin feature that lets us change the wp-login an wp-admin paths so that bots can't just randomly attack our sites.
Admin I can understand. But if a WP site has a comment section, wouldn't members of the public need to hit the login page in order to list past comments that they have posted?
Re: (Score:2)
*Not exclusive....a good portion of the other 75% of websites likely have problems, too.
The End of Days (Score:3)
We're Number Two! We're Number Two! (Score:2)
According to the linked report, 57.4% of websites aren't using a CMS at all. So Wordpress is a distant second to "None".
Re: (Score:1)
If you sell a few products or services that don't change very often, you don't really need a CMS. It's cheaper to pay somebody to change static HTML pages every few months than to rent a CMS and pay to keep it patched.
Re: (Score:2)
No, that's 57.4% where they don't know what the site is using. It could be none, or it could just be something they don't recognise.
Dreamweaver isn't a CMS, and neither is Frontpage (Score:2)
Re: (Score:1)
One could arguably call Dreamweaver a "static CMS". It has templates and other do-dads for formatting reuse, and has FTP sync-up management.
Re: Dreamweaver isn't a CMS, and neither is Frontp (Score:1)
You could call Dreamweaver a polished turd and you'd also be correct.
Re: (Score:1)
Well, being a PT and being a static-file CMS are not necessarily mutually exclusive, especially since the CMS field is full of PT's, and Un-PT's.
Re: (Score:1)
sure they are content management systems. they're used to manage content for millions of websites, even for the governments. the content is created, edited and generated from them and in some cases automatically uploaded.. just because they suck doesn't mean that they're not content management systems.
\\"A content management system (CMS)[1][2][3] is a computer application that allows publishing, editing and modifying content, organizing, deleting as well as maintenance from a central interface.[4] Such sys
Re: (Score:3)
sure they are content management systems. they're used to manage content for millions of websites, even for the governments. the content is created, edited and generated from them and in some cases automatically uploaded.. just because they suck doesn't mean that they're not content management systems.
\\"A content management system (CMS)[1][2][3] is a computer application that allows publishing, editing and modifying content, organizing, deleting as well as maintenance from a central interface.[4] Such systems of content management provide procedures to manage workflow in a collaborative environment.[5] These procedures can be manual steps or an automated cascade. CMSs have been available since the late 1990s."
I'd call them CMMS's. Content Mis-Management Systems.
They lack the fundamental feature of the subject matter though, a database back end with a front end script letting the editors or others make changes with a browser. Regardless of whatever website's definition of it, the core of what people mean by "CMS" is a database and a scripting language running things, and a browser to edit.
In that sense, only SharePoint counts and that's a many generations later offshoot used with FrontPage sometimes. DreamW
Re: (Score:2)
It'd be like buying salesforce.com to use as a shared calendar. It's not bad as a shared calendar. But it's too hard to set up and too expensive for that, so most people who bother to get it would also use the (assumed) CRM functions. But if someone didn't use a single CRM in a CRM, is it still a CRM?
The same thing applies to WP. The smaller company sites I see using it use it because
Shame (Score:2)
It's a shame that ignorant designers and pseudo-developers have tricked so many hapless clients into running WordPress because it's easy. "Easy" here actually means that through a celestial confluence of bad architecture, poor development practice, and sly marketing, a third party market for themes sprang into being, with an horde of add-ons written by neophytes who aspire to writing code only as bad as the WP core, their sole source of PHP practices.
But that's not all. The majority of that monumental-see
Re: (Score:1)
What's the alternative? Our org tried roll-your-own CMS's, and there's just too many features to re-invent to do it well.
I'd like to see a roll-your-own-cms kit with API's and sample templates to deal with common web needs, but leave the data structuring to the org.
In other words, we need ready-made features like auto-image scaling (actual, not width=x), non-screwy browser based text editors (like CKEditor done right), user login UI kit, file upload manager, search/index engine, etc. but don't want a certai
Re: (Score:2)
Check out Silverstripe [silverstripe.org]. It's literally exactly what you just described.
You define your data structures in nice OOP classes using simple arrays [silverstripe.org] (like $db for simple fields, $has_many, $many_many for relationships, etc), then just hit the URL /dev/build and Silverstripe will make the database reflect the code. (Talk about a deployment/staging dream)
Then you define your CMS editing widgets by overriding a getCMSFields() function, and away you go.
Image scaling & manipulation API, check. Beautiful, focused
Re: (Score:2)
Make the database reflect the code? ORM and MVC? Hell no. Count me out. Those are discredited from last decade.
Re: (Score:2)
Um ok... stick with Wordpress then?
I thought you were asking for alternatives. I gave you one based on what you described. GIGO.
It would also be great if you gave reasons for your objections instead of just stating "discredited" like that actually explains anything at all. What's wrong with having the DB reflect the structures you define in code? Works great. Stages great. No downsides. Wonderful solution.
Re: Shame (Score:2)
Re: (Score:2)
The majority of the monumental-etc. wasn't set for e-commerces nor phisers.
It was set by people like me for very simple associative sites, for people only having access to simple servers with only php/mysql, and with just no plugin, only the baseline setup, sometimes with, oh, the second one of the standard appearence templates instead of the first.
And there is a simple, nonagressive, neutral reason for that: nothing else was available within this minimal requirements.
It makes sense to me (Score:2)
No way (Score:2, Interesting)
"WordPress Now Powers 25% of the Web"
Sorry, I ain't buying it. Yes, there are a lot of WordPress sites out there, but 1 in every 4 is a WordPress site?
I call bullshit.
Re:No way (Score:5, Informative)
If you parse the post closely you can see it's weasel worded
"WordPress is used by 58.7% of all the websites whose content management system we know. This is 25.0% of all websites.”
Re: (Score:3)
"WordPress is used by 58.7% of all the websites whose content management system we know. This is 25.0% of all websites.”
58.7% of the 25% the know the CMS on is 14.675% of all web sites.
Re: (Score:2)
You cannot assume that web sites which don't tell you what CMS they use are either not using one or that 25% of them are using WordPress. All you can conclude is that 25% of Web Sites reporting a CMS use WordPress.
Furthermore, the statistic is meaningless since it doesn't say how much web traffic reaches those sites. It wouldn't surprise me a bit to learn that the vast majority of them are one or two page vanity sites that don't get any traffic at all (other than the occasional bot)
Re: (Score:1)
The point about the traffic is valid.
But the actually path to the statistic is:
- 57.4% of sites reported no CMS
- 25% of sites reported WordPress
- From the first, 42.6% of sites reported some CMS
- WordPress is 25/42.6 = ~58% of all sites that did report
Re: (Score:2)
of the first 10 million websites. Their source uses alexa data.
Re: (Score:2)
What that sentence means is that 41.3% of all website are not using a content management system or they have one that the bot couldn't recognize as a CMS.
This doesn't change the point of WordPress being used on 25% of all websites.
Re: (Score:2)
This doesn't change the point of WordPress being used on 25% of all websites.
WordPress is used on 25% of the 59% of sites that the bot could detect. You cannot extrapolate anything beyond that.
Re: (Score:2)
The Wordpress codebase is an absolute steaming pile of dingos kidneys. It maintains it's popularity by virtue of the huge library of plugins and themes available for it. A fair proportion of those are steaming piles as well, but even those that are well written are still a problem because all those plugins rely on the WP core not changing significantly
And this is why Drupal is better than WordPress. Drupal is not afraid to break modules with every major revision. Yes, that is a PITA in its own way; it leads to people waiting a long time to upgrade because they have to wait for some modules to get updated for the new core, or to having to redesign parts of their website in order to transition to using a different module for the same functionality. But it's also an obvious benefit; security releases still come out for the prior major version, so you can li
Re: (Score:1)
60% of the time, it works every time
Re: (Score:2)
It's really obvious it's misleading. 25% of the web? Wrodpress? Umm...no. No way in hell. That doesn't even sound marginally accurate, or even a good estimate.
Re: (Score:1)
it appears to be a reasonable reaction
No, it isn't.
First, it is redundant with GP.
Second, commenters who feel the need to use "fucking" in every post mark themselves as annoying brats who should be down modded and ignored.
Re: (Score:2)
Then do your own study and show your own data, no one cares about your personal opinion.
Here's something fun to do: block all requests to wordpress.com and wordpress.org and then go around to news sites and wherever you can think of and notice how many things are broken - images won't load, CSS won't load, etc. A lot more sites are running on Wordpress than you think, regardless of what your "gut" is telling you. It's hard to see it because of how the sites look, but a lot of sites host a lot of resources
Re: (Score:2)
Then do your own study and show your own data
Errr, no. Thanks for the suggestion, but I have much better ways to spend my time. :)
And no, I don't buy that "study".
Sorry if that offends your deeply held beliefs that are mostly based on slashdot posts. lol
Re: (Score:2)
It doesn't offend me, I just notice when some armchair statistician throws out his heavy opinion of some study being "bullshit" based on literally nothing other than the feeling in his gut. Why even bother to post your opinion if you're just going to discount a study and show literally no evidence to the contrary?
Re: (Score:2)
Why even bother to post your opinion if you're just going to discount a study and show literally no evidence to the contrary?
Because I feel like it, that's why.
good news or really bad news? (Score:2)
Re: (Score:1)
I have scraped my knuckles badly on drupal versions 6 and 7. I won't ever go near it again, ever. I basically agree with every (comprehensible) thing in your post. Fanboys, facades, false promises and vapourware along wih a bunch of seriously obnoxious contributors and deluded neophytes.
Yeah, it will run a web site. No, it will not run your website.
Wordpress on the other hand is a great money maker for a dev and can be hollowed out and used in any way you like. Highly flexible once understood, just roll you
Re: (Score:2)
Yeah, it will run a web site. No, it will not run your website.
Having seen all manner of site implemented with Drupal, from 100% flash interfaces for bands and albums and the like backed by its excellent XML-RPC functionality to government websites handling more hits than your mom, I suspect the problem is that it will not run your website. If you're involved, you'll fuck it up.
Wow... (Score:2)
I had no idea there were that many blogs that nobody reads.
So big and yet... (Score:4, Informative)
So popular, and yet they still haven't fixed the hugely annoying core issue of emulating magic quotes [wikipedia.org], even years after PHP itself completely threw out the feature.
Re: (Score:2)
So popular, and yet they still haven't fixed the hugely annoying core issue of emulating magic quotes, even years after PHP itself completely threw out the feature.
Well, if you think about it, probably there's no contradiction here - in fact, there may be correlation.
There's probably tonnes of weird Wordpress PHP out there made by people who aren't expert programmers.
no celebration (Score:2)
Every time something becomes too dominant, we should not celebrate, we should worry. Doesn't matter if it's Windows, or IE or Oracle or the iPhone or Apache - we need competition to move and innovate.
In the CMS world, there is fierce competition, fortunately, but there are also high barriers already. A new CMS system will not be used in many commercial projects, no matter the merits, because the customers know a few big ones and if you don't drop their names, your pitch is out.
Almost 60% is quite terrible,
WordPress is good. (I am not joking) (Score:5, Interesting)
WordPress is good.
Ok, stop laughing and hear me out.
We all know that with all the shitty web-cmses out there, the ones built on LAMP (PHP) are the oldest that actually have a finished and working feature set.
Show me one non-PHP CMS with the featureset of WP, Joomla, Drupal, EZ Publish or Typo 3, closed source or FOSS. You won't find any.
PHP and the CMSes built with it are at least ten years ahead of the game in the market they were built for - that's a simple fact that no one can deny.
And of those, the mess called WP is actually the best that fits every mold.
- It's primarly a blogging engine - which is what most people want and need anyway. ... and so forth ...
- It takes about 3 clicks and ten seconds to move it away from the blogging perspective to a regular web CMS.
- It's dead simple to install.
- It uses the hook model (also found in Drupal) to implement features that can be applied flexibly. And while that principle is questionable at best - especially from a performance standpoint - there is no doubt that it is *very* easy to use to implement custom features and setups.
- The documentation actually exisits and is pretty good.
- The community is massive. It's basically an army of tinkerers fiddling away at extensions and plugins.
- It has an official full blown mobile management app downloadable for free [wordpress.org].
- It has a large, semi-post-capitalistic hip company baking it and it's development [automattic.com]. (They all work remote, from around the planet and put their money where their mouths are.)
- There are popular WP plugins built by people who can't programm - but they work (sort of) and are installed/activated/deactivated/uninstalled within seconds.
- The architecture is a bizar convoluted shoddy mess. But you can start tinkering with it within minutes and won't feel bad about it - because, hey, guess what, it's a mess already.
- Modifying templates and themes in a non-destuctive update-safe manner is dead simple.
In an nutshell:
WordPress is PHPs philosophy [slashdot.org] carried 1on1 into the application/CMS layer.
That is why it's so successful.
And rightfully so.
Re: (Score:1)
Ok, stop laughing and hear me out.
When I was able to stop laughing, I started to wonder why you suggested WP over Drupal, since nearly all the same stuff applies to it. It doesn't have a management app, but if you need one with WP, then WP is even more pathetic than I thought. I could give a shit what kind of company develops WP, because they do such a very bad job. They are known for their lack of security.
Re: (Score:2)
Show me one non-PHP CMS with the featureset of WP, Joomla, Drupal, EZ Publish or Typo 3, closed source or FOSS. You won't find any.
Plone.
Re: (Score:1)
C- tools are the enemy of D tools. Almost all non-trivial software sucks. Quality software is a lucky rare accident. Idealists never get anything done.
The world changes too fast for up-front requirements to get everything right and still be relevant 15 years down the road. For example, nobody anticipated mobile versions of pages/content when CMS's were being designed, but now they have to deal with them. The future will continue to surprise such than an organic mindset is a better fi
Bollocks (Score:2)
Mobile friendly (Score:3)
dont tell the black hats or the NSA (Score:2)
The problem is that black hats and the NSA also know this and will be concentrating on wordpress vulnerabilities. Any 0-day vulnerability in wordpress would be devastating.
In Related News (Score:2)
Re: (Score:1)
Plus, it's a better love story than Twilight!
Re: (Score:1)
Yes, but then you won't get all the "cool" hipsters to work on it. NodeJS has a rocket science mystique about it that attracts pioneers and fools alike. I won't comment on what I really think of the technology, but rather address it as a social phenomenon. Getting work done and being "where it's at" may not be the same thing.
Re: (Score:3)
Yes, but then you won't get all the "cool" hipsters to work on it. NodeJS has a rocket science mystique about it that attracts pioneers and fools alike. I won't comment on what I really think of the technology, but rather address it as a social phenomenon
Web programming (maybe more than any other area of programming?) goes through trends where one technology then another is hip and cool. It's like butterflies on crack [jwz.org] or something.
I think the reason it happens in web programming especially is because there is no good answer. If you want to do embedded programming, then C/C++ are a good answers. If you want to do corporate software, then Java and C# work decently. But for the web, there's not really a good way to build web pages. HTML/CSS are kind of a pa
Re: (Score:2)
I am an experienced web developer who has worked with both PHP, ASP, ASP.NET and ASP.NET MVC.
In my opinion PHP is very powerful and I enjoy working with it because of how flexible it is but it has a lot of legacy baggage it must carry for the forseeable future but I don't believe PHP in itself is bad as people paint it but rather it's the inexperienced and the incompetent that give PHP its bad name because they don't write or setup their scripts with security in mind so you end up with all these PHP sites w
Re: (Score:2)
Re: (Score:1)
Node.js is about one thing, getting cheap front end developers to do backend programming. It doesn't teach them about databases, algorithms, security or design though. JavaScript is a pain to debug so pushing it into the backend was utter stupidity.
If you look at the code quality of many node modules, you'll cry. JavaScript developers don't understand backward compatibility. Try using a yeoman install sometime and see what I mean.
Re: (Score:1)
Most people who view websites don't even know what Wordpress is.
I have created websites and did not even know what Wordpress is. I'd heard of it, and just assumed it was some Windows shit.