News for hackers. Stuff that matters.
Re:Static web – back to the roots? by neya on Saturday May 25, 2019 @02:27AM (#20007441)
I'm at present working with a client who is on Wordpress. It's a huge company with 100s of employees in just one of their locations and they don't actually have dedicated manpower to maintain their homepage. This is where I got in.

Once I audited their site, I found a ton of issues, particularly - their stale Wordpress version, themes and plugins. I updated them all one by one and migrated them to Wordpress.com which doesn't suffer this upgrading pain.

Then, I found out the theme provider had actually stopped supporting the theme and there were a bunch of security flaws in it. But, the client wanted something like push and forget.

So, I painstakingly migrated them off of Wordpress and made a custom Jekyll site with Jekyll admin running on Netlify. They're immensely happy now knowing that their site is virtually unhackable (it's just a static site).

Static site builders are more powerful than we think. I have a travel platform running on it right now actually and none of the end users know its a static site they're on top of. There's no plugins to manage, no software versions or security loopholes to keep track of. The only way someone can hack into your site if they hacked your identity provider (Eg. Netlify). Otherwise, it's simply just a boon.

Re:Static web – back to the roots? by hombre_fatal on Saturday May 25, 2019 @11:21AM (#20009515)
Can they figure out and are they comfortable maintaining their site with Jekyll now, like including images into their posts? Are they in for a surprise when you leave and they need to make an edit?

You usually can't just replace Wordpress with Jekyll and call it a day since non-technical people need to maintain the site. Though it's super nice when you can.

Re:Static web – back to the roots? by peteradio on Saturday May 25, 2019 @01:26PM (#20010165)
They couldn't maintain a WordPress site without him either.
Re:Static web – back to the roots? by neya on Saturday May 25, 2019 @02:49PM (#20010554)
The full story though is they had their Wordpress site done by a company from Singapore who charged them 1000's of dollars for what seemed to be a $50 template from Themeforest. And the worst part was it was hosted on top of a third grade shared hosting provider, with really low memory and RAM and the site would take about 15-20 seconds just to render the page. It didn't even include a year's worth of support which they would've easily gotten if they directly purchased from themeforest. This company then stopped answering their calls one fine day and abandoned them after taking their money.

The site itself was fine, until one day it broke and was completely inaccessible.

So, they were stuck in a limbo and the CEO happens to be my good friend, so while working on another project for him, he asked me if I could help. So, that's how I got incharge of maintaining it for them.

Re:Static web – back to the roots? by neya on Saturday May 25, 2019 @02:40PM (#20010519)
Sorry if my original post wasn't clear. I'm running with Jekyll + Jekyll admin for one of them and I use Netlify Admin for another. So, they can still use a WYSIWYG interface to edit their content without having to deal with code.
Re:Static web – back to the roots? by HatchedLake721 on Saturday May 25, 2019 @03:14AM (#20007564)
What about keeping Wordpress under the hood to manage and update the pages, but then generate static pages off that?
Re:Static web – back to the roots? by cmdr2 on Saturday May 25, 2019 @05:18AM (#20007924)
I tried this last year for a Wordpress blog with ~1000 articles, and the time to generate the static pages was too long (several minutes) even for routine tasks like adding a new article. Simple things like a "New Articles" list in the sidebar can cause all pages to regenerate. I tried many different approaches (recursive wget, wordpress plugins, intercept wordpress output in PHP with ob_start() etc).

Ultimately, putting a Varnish cache seemed like the only logical answer to speed things a bit more, but that didn't avoid Wordpress security attacks.

For fun though, I built an experimental wordpress-clone dashboard that saved Hugo-compatible files instead, so I wouldn't miss Wordpress' editing features. The result was superb (<5 seconds to regenerate the ~1000 articles blog), but I missed the Wordpress plugins too much to switch to Hugo entirely.

But I still agree with you: "keep wordpress' editing experience, but generate static sites" is a pretty promising direction IMO.

Re:Static web – back to the roots? by ScottFree on Saturday May 25, 2019 @02:44PM (#20010530)
> I missed the Wordpress plugins too much to switch to Hugo entirely.

Do you mind if I ask which plugins?

Also, if you're missing plugins, it sounds like keeping the wordpress editing experience alone isn't going to be enough. The question then becomes, are you missing plugins themselves or what those specific plugins do for you that doesn't appear to be available in hugo.

Re:Static web – back to the roots? by yurishimo on Saturday May 25, 2019 @07:32PM (#20012160)
As someone who does a lot of WP at their day job and has looked into other platforms, plugins like Gravity Forms are indispensable. It is nearly feature complete at this point and I have full access to the underlying code for any customizations in logic or design.

Some hosted form solutions offer features like basic e-commerce which is useful, but then doing something after a submission is almost impossible or everything is in an iframe so customization is limited.

If someone could port gravity forms to Craft, I would likely switch all new projects before the end of this year.

Re:Static web – back to the roots? by folkhack on Saturday May 25, 2019 @09:07AM (#20008806)
I've been thinking about doing the same myself but with a direct tie-in from Node.js to MySQL to grab the post objects via mysql2... did you ping the WP JSON API for generating posts? I'm just confused as to how that would break things unless there's a serious bottleneck somewhere.
Re:Static web – back to the roots? by ivanhoe on Sunday May 26, 2019 @06:27PM (#20017966)
I imagine New Articles list would trigger all pages regeneration in any static setup, WP or not?
Re:Static web – back to the roots? by cmdr2 on Tuesday May 28, 2019 @02:06AM (#20027600)
Yes it would. But pure static generation tools like Hugo are really fast. In my case, it was regenerating ~1000 articles in about a second, while doing it with wordpress was nearly 25 minutes.
Re:Static web – back to the roots? by styfle on Saturday May 25, 2019 @11:55AM (#20009672)
Another similar approach is using “Serverless Pre-rendering” which is a fancy way to say serve stale and update in the background.

There is a demo using Notion as the “backend” which is kind of like Google Docs. I could see this being a great solution for less technical authors who only want to deal with content.

In the end, it’s like a static site but you don’t wait for a build step.

https://zeit.co/blog/serverless-pre-rendering

Re:Static web – back to the roots? by alfonsodev on Saturday May 25, 2019 @03:58AM (#20007670)
Yes, If you are fine with static pages it probably means that you would be fine using something like Varnish http cache.[1]

There might other options like caching at the DNS level with something like CloudFlare[2]

I don't work with Wordpress but generate static pages sounds like generating a cache, so these two option might be useful if you need to keep Wordpress but want the benefit of static pages.

[1] https://www.varnish-software.com/wiki/content/tutorials/word...

[2] https://wordpress.org/plugins/cloudflare-page-cache/

Re:Static web – back to the roots? by chriswarbo on Saturday May 25, 2019 @07:28AM (#20008385)
Varnish passes requests through to the underlying site (in this case Wordpress), which doesn't make it any more secure.

If the cache were fully populated (e.g. by spidering the site) and never became stale, then it would be roughly equivalent. Still, I'd rather disconnect Wordpress after spidering, so there's no chance of requests leaking through.

Re:Static web – back to the roots? by neya on Saturday May 25, 2019 @03:28AM (#20007596)
At some point your Wordpress installation version will be so far ahead that it may break your unmaintained theme eventually. Which is why I avoid this route if I can. It's hard to make promises to clients based off something so fragile.
Re:Static web – back to the roots? by mediascreen on Saturday May 25, 2019 @04:29AM (#20007760)
Well, you have just built a custom theme to support the data from Netlify. I guess you could just as well have built a custom theme for Wordpress to avoid being stuck with an unsupported theme.
Re:Static web – back to the roots? by neya on Saturday May 25, 2019 @05:51AM (#20008051)
The difference is for my use case, Netflfy isn't a full CMS per se, the theme I built is for Jekyll which runs on top of netlify. It's just compiled static HTML files. There's nothing you can hack.
Re:Static web – back to the roots? by icebraining on Saturday May 25, 2019 @04:48AM (#20007809)
Why would your WP installation version be ahead?
Re:Static web – back to the roots? by neya on Saturday May 25, 2019 @05:52AM (#20008054)
If you're on WP and you forget about your website for say a year, WP version would be way high compared to the unmaintained theme that was built for an older version which would eventually break your site.

This isn't the case with a static website.

Re:Static web – back to the roots? by Grangar on Saturday May 25, 2019 @07:41PM (#20012201)
Whenever I read the word unhackable my neck hairs stand right up.