The Whole of WordPress Compiled to .NET Core and a NuGet Package with PeachPie (opens in new tab)

now if they only made gutenberg stick to wcag 2.1 or Section 508, it could change the world. Otherwise, it's not too different from the Frontpages or NetObjects Fusions of the past

I would like to see Beaver Builder do this, too.

Wagtail.

There's also a very nice library that can dump all the pages from Wagtail into a static site which you can then just copy to a CDN, giving you the best of both worlds: The ease of publishing of dynamic sites and the speed/ease of deployment of static sites.

Jekyll or Django, or a hybrid?

That's an awesome idea. Will do!

Saying Wordpress is a security nightmare is like saying Windows is a security nightmare. It has broad use, it has tons of people using it with outdated or unmanaged plugins on installs that haven't been updated in years...Some running near extinct PHP versions. If managed properly, put behind a firewall, etc it is quite safe. The hatred of Wordpress is laughable. It has its limits, but it meets most small-medium sized business needs when the project calls for minimal needs.

The bulk of WP security issues stem from the 'writable file system' defaults that many plugins (and, to some extent) core either expect or encourage.

I can't say all, but the huge bulk of security issues I've seen revolve around some exploit which ends up writing a new file, or overwriting an existing file, which is then publicly accessible. If your file system is not writable, the large majority of WP exploits go away. However, you lose the "press here to upgrade your entire site and all the plugins in one easy step!" functionality, and the "upload files via the browser" ease-of-use.

If you're truly modifying public media files on regular basis, a non-writeable file system kinda stinks (either make the FS writeable or use an external media host, which adds complexity and cost). MOST systems I run in to aren't doing this often - it's "put up the site and updates some pages every few months" (or, blogging, which is often just text). For these, I recommend turning off write permissions to the whole of the WP system, and periodically turning it back on to do updates, then turning it off again.

Yes, this doesn't cover 100% of exploit cases, but nothing does, and I've found this to go a moderately long way to reduce the impact of various exploit attempts.

So, to answer the question, I would say "it depends". If the .net hosted version also by default allows for writeable media that is also executable, then there would be problems. However, I don't expect a .net-based system would allow you to get a ".aspx" file in a publicly accessible URL and have it just execute when accessed (unless there's some deployment mode that would allow for that?)

This can only be solved by a rewrite.

Which nightmare? Maybe we can fix it. To answer your second question - yes, that's exactly what we're planning :)

Wordpress core has very secure coding practices, and if you can find an 0-day in it, then you've done very, very well.

The problems with Wordpress are mostly:

1. WP installations are often not properly configured or maintained.

2. The plugin ecosystem is a mess of vulnerable and/or malicious code, or simply dead code that isn't maintained yet still deployed in the wild.

PHP7 is faster than HHVM nowdays, and looking at the benchmarks for this .net version it's not a whole lot faster. It could even be that part of the win here comes from not needing to check all the php files on disk for changes.

You could take “C#” out of that sentence and still be accurate.

Wordpress is not and I imagine never will be anywhere close to “modern design patterns”.

It’s not even close to old design patterns, unless Heinz has a namesake software design pattern.

Wordpress uses practices that were considered a bad idea a decade or more ago, and still refuses to change.

The first step should to be to rewrite in PHP 7 using modern design patterns. I don't think C# would add much there.

One of the major selling points of WordPress is its huge array of 3rd party plugins. You'd need to port the most popular ones before the C# version got any traction.

How's Linux for .NET hosting? Because Linux hosts are generally cheaper than Windows hosts.

The avantage of php for a self hosted bloging website is that php is installed in almost every hosted server and that makes WordPress easy to install.

Decompile the resulting library and start refactoring and adding comments?

"If it is so awful, why is it on over 25% of sites?"

If McDonalds is so bad for you, why do they serve 550 million Big Macs every year?

WP is 'free', has a low barrier to entry, and for many years non-developers were able to relatively easily add custom functionality (sometimes done well, but often security and performance nightmares).

A lot of people make a lot of money from selling illegal drugs, or fatty foods, or bad investment/insurance products.

WP has its place, and in the right skilled hands, for the right projects, addresses many business needs decently well. Until it doesn't.

But this "right tool for the right job" argument has been beaten to death when it comes to WP. Biggest 'meta' issue I see with WP is that it doesn't do much to encourage most people "developing" on it to ever consider other tools; they just learn to fit more and more jobs in to the same ecosystem, whether it's a good fit or not. And due to the size of the ecosystem, it has enough gravity to keep attracting people to it.

Wordpress is the Microsoft Access of content-driven Websites: it is amazing because the lowers all of the barriers to entry (time, cost, expertise), but it has bad practices and a bad programming language built-in, so stuff built with it is born bad, and will get worse, partly because the folks using that tool are frequently untrained.

Think of any modern development best practice that you like (e.g. version control, or automated tests): Wordpress will make it harder, and if you take over an existing Wordpress site, there's a non-zero chance that the previous developer wasn't doing it, making the hairball of code underneath the shiny interface even harder to work with.

The problem's normally not Wordpress itself (when kept updated), it's the trash fire of plugins that float around it, leaving all sorts of security issues in their wake.

We were so preoccupied with whether or not we could, we didn't stop to think if we should.