I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
You can make the most intricate drag and drop admin interfaces to allow the editor to customize everything, and they will still call you to put up every post, so might as well go static
This! My customers love that they can call and email me to update their websites, not having to remember usernames, passwords and how the publish interface works. Wordpess or static does not really matter in many cases.
I have full control over the inputs for hugo and the output is pure static HTML. It's better if there are no CVEs but I really don't sweat these. My Hugo template runs 100% pure CSS and no JS.
This seems like a really good example of Base CVSS scores not telling us much on their own.
For the Wordpress RCE (nominally CVSS 9.2), it looks like many standard deployments of WordPress would be affected, barring extra mitigations. But in the case of these Hugo ones (9.3), it looks like very specific circumstances (anti-mitigations, if you will) are needed. E.g. running arbitrary builds of untrusted user content without a sandbox; running it in a GitHub workflow against PRs from untrusted contributors, etc.
When I finally got approval to rewrite the company blog from Wordpress into something that was mostly static, it was the best week. I used PHP to do mobile/desktop and language selection, because PHP is pretty useful, and it can be pretty fast and secure if you only do simple things.
Never had to worry again about sequencing updates where the update changed the database schema and I had a cluster of 6 web servers. Never had to worry anymore about long ass load times because the web servers were in 3 colos and wordpress wouldn't play nice with local read only mysql replicas. No more worries about why pingbacks and comments keep showing up in the database even those those features were turned off; at least they weren't showing up in a moderation queue, but still.
We are in a big migration project at work and one of the goals is to rewrite all 30 or so WordPress sites into Astro. It’s so much fun to cut out all the blackbox plugins with paid features and cruft, and just have something work as I intended. I’m stoked.
I had the same itch when I ported my personal blog from WordPress to Astro. I built a fully customisable self-hosted comment system called Discuss. It's got a dashboard and tokenized UI customisation. Pretty light weight too. It's available here - https://github.com/karthikeyankc/discuss . Do give it a spin or fork it. Would love to hear your feedback.
My website is hosted on 1and1 via PHP. I am guessing that this would not work for me as installation needs server access. Moving to VPS, along with transferring domain, would require more time than I would like to spend. Thanks.
Ah okay, yeah, you'd need server access. Perhaps a one click install to cloudflare or vercel could've helped you. They offer generous free tiers and for personal blogs that should be good enough. But if your website has high traffic, free tiers might not work thou. Either way, this flexibility should help others like you. I'll see if I can work on one-click setups for cf and vercel this weekend. Thanks for checking it out.
May I know how much token costs came out to be for this? Also, how did it handle Wordpress plugins? If you have comments on the website, how did you handle those and spam detection? Thanks.
