7 ms·

Wordpress is awful on DO and many things can and do break. Trust me, I've been developing with Wordpress for over a decade, and WP on a VPS is a whole different

Wordpress is awful on DO and many things can and do break. Trust me, I've been developing with Wordpress for over a decade, and WP on a VPS is a whole different kettle of fish. Whether it's hardening the VPS to avoid a DDOS, or auto-patching Ubuntu when OpenSSL gets another vulnerability. It's quite mightmarish. DO is good for things like Gitlab and VPNs and things like that, but good luck trying to get something bulletproof and high availability. It's a devops nightmare. It can be achieved, but it takes some time...

TheHippo 11y ago
Wordpress is awful on a self-managed VPS, this has nothing to do with DO.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- bpicolo 11y ago
  You mean wordpress is totally fine on a self-managed VPS assuming you know how to manage it. Same as literally every other application?
  - derefr 11y ago
    I think the actual meaning being lost in translation here is "self-managing things is awful"—which it is, if you are a dev and don't want to be burdened with ops.
- moron4hire 11y ago
  This is why I'm ditching it and going back to static HTML for my corporate site. As a small consulting shop, we just don't have the time or resources to worry about "WTF is wrong now?"
  - tracker1 11y ago
    Static site generators are definitely making a comeback... With the number of vulnerabilities and automated attacks on older versions of WP, and other frameworks, it's not an entirely bad idea... Generate the site, push to S3 or Azure, then put CloudFlare (or another CDN/Cache) in front of it... Easy peasy.
- nly 11y ago
  Indeed. First thing that blew my mind is that it checks to see if its files are owned by the uid of the php process. Why? Why can't we just +w on uploads, themes, plugins etc using group permissions?
blfr 11y ago
Why is Wordpress on a VPS a nightmare? You install nginx, php-fpm, mysql, enable unattended upgrades in Ubuntu, create a new user for Wordpress, run it, enable automatic updates, done. It's a blog. It doesn't need to be bulletproof or run on a cluster. (Of course, the hip choice is Ghost.)
- buckbova 11y ago
  I tried to install wordpress from apt-get and it wasn't trivial. File permissions were out of whack, plugins and upgrades weren't working. I eventually scrapped it and installed from source. Took a little longer to configure but worked out. I also added some extra firewall and server monitoring tools.
  - steeples 11y ago
    Yeah the list goes on. Even for the pros, there are an insane amount of steps to get the install perfect. And it has to be perfect, as one overlooked thing can mean the box can be taken offline by net-hooligans. Things like Commando are handy for this and I frequently use recipes when I spin up a new server: https://commando.io/ https://commando.io/
- steeples 11y ago
  I say this because so many peeps think using these pre-installed WP bundles is all kittens and unicorns; it is not. I am not singling out DO specifically, but any VPS provider that has pre-installed soft that does not respond to threat landscapes and it not hardened correctly. Users install without a care in the world for having their VPS naked and like a sitting duck. (Yes I monitor inbound traffic on VPSes and there are people who are interested in flooding if you don't practice throttling and load balancing, or PTR records which resolve the raw IP to other domains).
  - deleted 11y ago
    [deleted]
  - prydonius 11y ago
xux 11y ago
I'm curious why you think it's awful? I used the one-click Wordpress install on DO and put up a custom-coded theme. The site gets around .5m visits a month and I've never run into any problems.
- aikah 11y ago
  WP was not designed for modern deployment for a number or reasons. Wordpress is definitely not a 12 factor app. And there is nothing that can be really fixed by plugins. to fix this, one has to break WP core apis. WP is "a deploy once with ftp/sftp" cms.
  - chipotle_coyote 11y ago
    > WP is "a deploy once with ftp/sftp" cms. I think a lot of developers--myself included, for a long time--don't really appreciate why this is the reason WordPress is as popular as it is. The vast majority of the criticisms people make of WP are valid, but good luck finding something else as easy for a non-developer to not just install and configure, but to actually maintain in a relatively secure fashion. (I also don't think developers appreciate how good modern WordPress is as this -- not to say that it's perfect, by any stretch, but once it's set up correctly the damn thing is self-updating. As long as you stick to popular, actively-developed plugins and put effort into keeping them updated -- which is frankly a pretty low bar, since it's about three clicks on the dashboard -- WordPress isn't likely to be a serious security concern. I don't see how WordPress's general audience would be in the least concerned about its failure to be a "twelve-factor app," do you?
    - aikah 11y ago
      > I don't see how WordPress's general audience would be in the least concerned about its failure to be a "twelve-factor app," do you? well , it's all about context. I don't see the general audience using digital audience to deploy applications. So I have nothing against wordpress really , it's not just adapted for modern deployment techniques.
- icpmacdo 11y ago
philtar 11y ago
I don't what this says about people who frequent HN. Bitnami has dozens of different applications, and the discussion is about WP.
bliti 11y ago
You have to run your own install script. It is more involved than deploying other things. I usually run a script to prepare the server first (for a generic secure setup, including LAMP) and then run the WP installing script (which is mostly Python working through sftp). It has taken a bit of time to figure this one out, because the generic secure setup requires constant upkeep. Its not something that you set and forget.
- x5n1 11y ago
  apt-get update && apt-get -y upgrade works to upgrade the server. i have moved all my installs into docker containers. so you upgrade the image and then roll that out site by site. Wrote about it here: http://www.dockerwordpress.com/ http://www.dockerwordpress.com/ and how I handle my upgrades http://www.dockerwordpress.com/docker/upgrading-wordpress-docker http://www.dockerwordpress.com/docker/upgrading-wordpress-do...
  - bliti 11y ago
    aptitude update sure is part of maintaining things up to date. One cannot rely on it exclusively due to how those updates sometimes require other changes. Plus it doesn't cover all packages. Using docker just adds another layer of complexity and possible vector of attack. For standalone wordpress installs docker is not required. Wordpress security is more of a continuous process rather than a set and forget thing due to how it's a constant target.
joeguilmette 11y ago
I think WordPress is great on DigitalOcean. With EasyEngine you can be up and running - cached - and seconds with a handful of CLI commands. I've had great luck with running WP on DO.
- rahul286 11y ago
  Thanks Joe for posting about EasyEngine. @All if anyone have any questions about EasyEngine, I will be happy to answer. I am from EasyEngine team. :-)
sandGorgon 11y ago
I actually run a few wordpress blogs on Cloudways - which sets up a managed host on top of DO or AWS. It's pretty good - I think there is value for managed "applications" on top of VPS. Think of it as Cloudformation for the rest of the world !
xxdesmus 11y ago
Uh. I think you need a managed service instead of a VPS then.

TheHippo 11y ago

Wordpress is awful on a self-managed VPS, this has nothing to do with DO.

deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
bpicolo 11y ago
You mean wordpress is totally fine on a self-managed VPS assuming you know how to manage it. Same as literally every other application?
- derefr 11y ago
  I think the actual meaning being lost in translation here is "self-managing things is awful"—which it is, if you are a dev and don't want to be burdened with ops.
moron4hire 11y ago
This is why I'm ditching it and going back to static HTML for my corporate site. As a small consulting shop, we just don't have the time or resources to worry about "WTF is wrong now?"
- tracker1 11y ago
  Static site generators are definitely making a comeback... With the number of vulnerabilities and automated attacks on older versions of WP, and other frameworks, it's not an entirely bad idea... Generate the site, push to S3 or Azure, then put CloudFlare (or another CDN/Cache) in front of it... Easy peasy.
nly 11y ago
Indeed. First thing that blew my mind is that it checks to see if its files are owned by the uid of the php process. Why? Why can't we just +w on uploads, themes, plugins etc using group permissions?

blfr 11y ago

Why is Wordpress on a VPS a nightmare? You install nginx, php-fpm, mysql, enable unattended upgrades in Ubuntu, create a new user for Wordpress, run it, enable automatic updates, done. It's a blog. It doesn't need to be bulletproof or run on a cluster. (Of course, the hip choice is Ghost.)

buckbova 11y ago
I tried to install wordpress from apt-get and it wasn't trivial. File permissions were out of whack, plugins and upgrades weren't working. I eventually scrapped it and installed from source. Took a little longer to configure but worked out. I also added some extra firewall and server monitoring tools.
- steeples 11y ago
  Yeah the list goes on. Even for the pros, there are an insane amount of steps to get the install perfect. And it has to be perfect, as one overlooked thing can mean the box can be taken offline by net-hooligans. Things like Commando are handy for this and I frequently use recipes when I spin up a new server: https://commando.io/ https://commando.io/
steeples 11y ago
I say this because so many peeps think using these pre-installed WP bundles is all kittens and unicorns; it is not. I am not singling out DO specifically, but any VPS provider that has pre-installed soft that does not respond to threat landscapes and it not hardened correctly. Users install without a care in the world for having their VPS naked and like a sitting duck. (Yes I monitor inbound traffic on VPSes and there are people who are interested in flooding if you don't practice throttling and load balancing, or PTR records which resolve the raw IP to other domains).
- deleted 11y ago
  [deleted]
- prydonius 11y ago

xux 11y ago

I'm curious why you think it's awful? I used the one-click Wordpress install on DO and put up a custom-coded theme. The site gets around .5m visits a month and I've never run into any problems.

aikah 11y ago
WP was not designed for modern deployment for a number or reasons. Wordpress is definitely not a 12 factor app. And there is nothing that can be really fixed by plugins. to fix this, one has to break WP core apis. WP is "a deploy once with ftp/sftp" cms.
- chipotle_coyote 11y ago
  > WP is "a deploy once with ftp/sftp" cms. I think a lot of developers--myself included, for a long time--don't really appreciate why this is the reason WordPress is as popular as it is. The vast majority of the criticisms people make of WP are valid, but good luck finding something else as easy for a non-developer to not just install and configure, but to actually maintain in a relatively secure fashion. (I also don't think developers appreciate how good modern WordPress is as this -- not to say that it's perfect, by any stretch, but once it's set up correctly the damn thing is self-updating. As long as you stick to popular, actively-developed plugins and put effort into keeping them updated -- which is frankly a pretty low bar, since it's about three clicks on the dashboard -- WordPress isn't likely to be a serious security concern. I don't see how WordPress's general audience would be in the least concerned about its failure to be a "twelve-factor app," do you?
  - aikah 11y ago
    > I don't see how WordPress's general audience would be in the least concerned about its failure to be a "twelve-factor app," do you? well , it's all about context. I don't see the general audience using digital audience to deploy applications. So I have nothing against wordpress really , it's not just adapted for modern deployment techniques.
icpmacdo 11y ago

philtar 11y ago

I don't what this says about people who frequent HN. Bitnami has dozens of different applications, and the discussion is about WP.

bliti 11y ago

You have to run your own install script. It is more involved than deploying other things. I usually run a script to prepare the server first (for a generic secure setup, including LAMP) and then run the WP installing script (which is mostly Python working through sftp). It has taken a bit of time to figure this one out, because the generic secure setup requires constant upkeep. Its not something that you set and forget.

x5n1 11y ago
apt-get update && apt-get -y upgrade works to upgrade the server. i have moved all my installs into docker containers. so you upgrade the image and then roll that out site by site. Wrote about it here: http://www.dockerwordpress.com/ http://www.dockerwordpress.com/ and how I handle my upgrades http://www.dockerwordpress.com/docker/upgrading-wordpress-docker http://www.dockerwordpress.com/docker/upgrading-wordpress-do...
- bliti 11y ago
  aptitude update sure is part of maintaining things up to date. One cannot rely on it exclusively due to how those updates sometimes require other changes. Plus it doesn't cover all packages. Using docker just adds another layer of complexity and possible vector of attack. For standalone wordpress installs docker is not required. Wordpress security is more of a continuous process rather than a set and forget thing due to how it's a constant target.

joeguilmette 11y ago

I think WordPress is great on DigitalOcean. With EasyEngine you can be up and running - cached - and seconds with a handful of CLI commands. I've had great luck with running WP on DO.

rahul286 11y ago
Thanks Joe for posting about EasyEngine. @All if anyone have any questions about EasyEngine, I will be happy to answer. I am from EasyEngine team. :-)

sandGorgon 11y ago

I actually run a few wordpress blogs on Cloudways - which sets up a managed host on top of DO or AWS. It's pretty good - I think there is value for managed "applications" on top of VPS. Think of it as Cloudformation for the rest of the world !

xxdesmus 11y ago

Uh. I think you need a managed service instead of a VPS then.