It’s not for you

Somebody asked me at a thing a couple weeks ago what I build client sites on, and I caught myself running a whole little preamble before I got to the word WordPress. Qualifying it. Establishing the kind of client and the kind of site first so the answer would land softer. Pre-apologizing, basically. Then I drove home and thought, hang on, why did I do that. The site is fine. They update it themselves, they get inquiries off it most weeks, and they have not needed me since launch. That’s a win on every axis that matters to them, and I’d just delivered it like a confession.

I think some version of that flinch is in a lot of us, and it’s worth poking at, because the thing we’re embarrassed about is usually not the thing the client is buying.

Who’s touching this on a Tuesday

For the modal small business site, the question that decides the stack isn’t which tool is nicest to work in. It’s who opens this thing on a Tuesday afternoon when I’m not around, and what happens to them next.

Usually it’s the owner, or whoever in the office got handed “the website” on top of their actual job. They need to change the hours before a holiday, swap out a staff photo, put up a notice that the parking lot is being resurfaced. Maybe once a quarter. Maybe twice a year, in a hurry, ten minutes before it matters. And on the other side there’s somebody trying to work out whether the place is open, and then send a message that arrives in an inbox a human being actually reads.

That’s the product. Genuinely, that’s the whole product. Everything else in the build is for us.

The handoff is the deliverable

Static site generators are lovely and I reach for them constantly. This site is Jekyll. But I’m not handing a dentist a git repo.

Static site generators are lovely. But I'm not handing a dentist a git repo.

There are git-backed editors that try to close that gap and some of them are good. Netlify CMS, Forestry, Contentful, whatever’s current this year. I’ve used a few and I don’t hate them. But each one is another vendor in the stack, another bill on the client’s card, another account to lose the password to, and another company that can get acquired and sunset its free tier 18 months from now. Headless also means two systems and a build step sitting between “I typed the new hours” and “the new hours are on the internet.” When that build fails on a Saturday, what the client sees is that their edit didn’t work, with no explanation. Then they call you. Then you’re the CMS.

Preview is the underrated piece too. Clients want to see the page, on the page, before it goes live, and they want the editing to happen roughly where the thing sits on screen. The block editor does that now. It took years and an enormous amount of shouting, but it does.

They can hire anyone next

This is the argument I’ve come around to hardest, and I think we underrate it precisely because it costs us nothing and benefits somebody who isn’t in the room.

Something like 40-odd percent of the web runs on WordPress depending on whose numbers you like, and what that buys the client is a fungible labor market. Their next developer already knows it. So does the freelancer they find when I’m booked, and the agency they move to in four years when they’ve outgrown me, and their nephew who does websites. It’s the Corolla. Not the most exciting thing in the lot, but every mechanic in every town has seen one and the parts are on the shelf.

Build them something bespoke and clever and you have quietly made yourself the sole supplier. And I was going on the other day about how good being indispensable feels, so I’m pretty suspicious of my own preferences here. It is very easy to dress up “the thing I enjoy maintaining” as “the correct architecture.”

The parts of the reputation that are earned

I’m not going to pretend it came from nowhere.

Security is what everybody leads with and it’s about half fair. WordPress is the biggest target on the web by an enormous margin, so it eats the most attempts. But look at how these sites actually get owned and it’s overwhelmingly abandoned plugins, installs nobody has logged into in three years, and an admin password that is the business name with a 1 on the end. Core has auto-updated for years. A managed host, two-factor on the admin accounts, and a plugin list you can count on one hand gets you most of the way. Not to zero, nothing is zero, but “it’s insecure” flattens a maintenance problem into a platform problem, and the maintenance problem exists everywhere. It’s just quieter elsewhere because nobody is scanning those.

The bloat is the more honest complaint and I’ll cop to it entirely. You know the site. Elementor or Divi, 30-something plugins, four of which overlap, a slider nobody has ever scrolled past, three analytics scripts, a cookie banner bolted on in a panic, and a hero image exported straight out of Canva at 4 MB. That site is miserable on a phone and it is extremely common 😬

I want to say that isn’t WordPress’s fault, and mostly it isn’t, that’s what happens when nobody in the process is making decisions. But you have to concede something: a tool whose most frequent outcome is that is at least somewhat implicated in the outcome. One-click installation is a real feature and it is also exactly how you get to 30-something plugins. Both things can be true.

Gutenberg is still divisive and I get why. I keep finding corners of it that feel unfinished, and the direction it’s heading is a bigger swallow than the editor itself. But the block editor for the purpose of writing a page is fine now, honestly, I’d take it over the old TinyMCE box without much thought, and “can a non-technical person change a paragraph without breaking the layout” is the axis I actually care about.

Where I wouldn’t reach for it

Anything where the interesting state lives in the client, obviously. Real ecommerce past a certain size, where you’re fighting the platform more than you’re using it. Developer docs, where the people writing are perfectly happy in Markdown and a repo. A site nobody is ever going to edit, where handing over a login they’ll never use is just giving them an unpatched thing to forget about, and you should ship HTML instead.

And sometimes, honestly, the answer is Squarespace. If it’s five pages, it will always be five pages, the budget is genuinely small, and the client does not want an ongoing relationship with a developer, then a hosted builder does the job and the updates and the backups and the certificate renewals are somebody else’s problem forever. That recommendation has cost me work more than once and I think it was the right call both times.

Doing it well is mostly subtraction

When I do build one, nearly the whole method is restraint:

The block editor, not a page builder. Page builders are a lock-in tax you pay in markup and never stop paying.
A light theme, or a small custom one, and nothing from a marketplace that arrives with its own bundled plugin economy.
Plugins you can count on one hand and justify out loud, each one checked for whether it’s seen an update this year.
Managed hosting with automatic core updates, staging, and backups you have personally restored at least once.
Test the damn contact form. Then test it again from an address that isn’t yours, because a solid half of the “our form is broken” calls are the notification quietly landing in spam. Send through a transactional service with SPF and DKIM set up properly, rather than mail() and optimism.
Half an hour of training with the client, screen-recorded so they can rewatch it in November when they’ve forgotten. Lowest effort item on this list, highest return by a mile, and the one that reliably gets cut.

None of that is clever, which is sort of the point. The measure of one of these jobs isn’t how the stack looked in the kickoff. It’s whether the site is still accurate three years later when I haven’t heard from them, and whether the person who found them at 9 pm managed to send a message that got read.

WordPress is not the only way to get there. It’s just a boring, well-lit, extremely well-staffed way to get there, and I’ve stopped doing the preamble.

My client work skews small businesses and nonprofits and people who will log in maybe four times a year, and all of that shapes everything above. If your clients have a content team, or a real product, or 5,000 pages and a translation workflow, your defaults should look nothing like mine. But if you’re about to talk somebody out of WordPress, it might be worth checking first whether you’re doing that for them or for you.

It's not for you