Self hosting: real game starts today
So, it’s done: my main domain has finally got its transfer to Hostinger, new provider where I have the VPS I’m experimenting in.
Real game with WordPress multisite/multilingual and self-hosted Fediverse starts TODAY!
With WordPress (or any CMS) keep in mind that if you don’t really need visitor-facing dynamic features (like comments), then you can self-host the admin and content editing completely privately, and only export a static “dump” of the finished website pages as plain HTML/CSS/JS and images.
You can serve these static files fairly efficiently yourself with a small HTTP server, or upload to a CDN service which will take care of things like redundancy, availability, replicated content for faster access from certain geographic areas, you won’t care about denial of service or bots etc.
Meanwhile your CMS software is completely isolated from break-ins or drive-by bot attacks. As a perk, you can experiment with different CMS freely without fundamentally changing your approach, because they all produce static files one way or another. You can try for example Hugo, or a fediverse-enabled microblogging app like Pleroma, Misskey or even Mastodon.
Yeah, WordPress is an extremely common vector for automated attacks. It’s highly expandable, but those plugins often aren’t secure. Even my tiny site (it isn’t running WordPress, and doesn’t even have a landing page because I only use it for my own stuff) sees a ton of attempted Wordpress attacks.
I’ve spent a few years at the height of the blog trend doing WordPress work. It’s a very poorly designed app that has always put reliability/performance/security last and prioritized extensibility and low barrier of entry. Which is why they absolutely dominated the blog world but also why it’s such a big fat juicy target.
Great advice.