What it is
WordPress is an open source content management system written in PHP and backed by MySQL or MariaDB. It began as a blogging tool and grew into the most widely used way to build websites, with an editor for pages and posts, and a large ecosystem of themes and plugins. It is maintained by a large open source community.
WordPress.org is the self-hosted software. WordPress.com is a hosted service run by Automattic. Self-hosting gives full control, but it also means keeping core, themes and plugins updated, since plugins are a common route for attacks. A managed host can take some of that work off a business owner. A self-hosted site also needs backups, TLS and monitoring, the same as any other server. Choosing well-maintained plugins, and as few of them as possible, does more for security than any single setting.
How I use it
- supersonicstucco.ca and supersonicrentals.ca run on WordPress on EC2, sharing the Rental Pilot server under separate Apache sites.
- Both sites use MySQL, and each has a Claude assistant through Amazon Bedrock.
- Let's Encrypt provides TLS for every host, with security headers and no directory listings or version banners.
- CloudWatch alarms caught a WordPress login flood, and EBS snapshots back the sites up on a schedule.
WordPress is the right tool when a site already runs on it or non-technical staff need to edit content often. I keep the company sites on it for that reason. For a new small business site I usually recommend a hand-built static site, which loads faster, has no plugins to attack and costs almost nothing to host.
Questions
Does Shawn Mervin build websites in WordPress?
I run two company WordPress sites on AWS. For a new small business site I usually recommend a hand-built static site instead, because it is faster and has no plugins to attack.
Can you host and secure an existing WordPress site?
Yes. The sites I run have TLS on every host, security headers, scheduled backups and CloudWatch alarms that have already caught a login flood.