My foray into WordPress for personal blogging

I’ve installed WordPress for others. It’s an easy-to-use content management system with functionality that can be extended by a wide range of pre-made plugins. You can use the free, basic version at WordPress.com to make a personal blog, or pay a bit for premium services, or install the open-source version available from WordPress.org. Now I’ve installed WordPress for me, because the best way to learn a system is to use it.

There are points for and against each approach.

Why use the free, basic version?

Make your personal blog at WordPress.com and instantly be part of a very large community. You won’t have to stress about keeping the underlying WordPress engine updated: they do that for you. You won’t have to search and search to find just the right template: they provide a limited number of choices for you.

The free features provided by WordPress.com are compelling.

Upgrade to get premium features

But…ads, limited template control, and a blog URL that looks like <yourname>.wordpress.com are a bit limiting. Premium features will allow you to use your own domain name, customize your template style sheets, get extra storage, and more.

There is a cost. If you avail yourself of all their premium features, your annual cost will be $100 or more. This is still pretty reasonable if you intend to do some sophisticated blogging but don’t want to worry about keeping WordPress updated and secured.

Try the open source version

I’m using the open source version of WordPress, made available under version 2 of the GPL.

Running my own instance of WordPress is a more gritty, hands-on experience than using the WordPress.com offerings. For security purposes, I need to stay on top of updates to WordPress code, and that means following some upgrade procedures with each new release.

If plugins are not well coded, they can provide pathways for folks to post inappropriate material without authorization, or even compromise the server where my WordPress instance resides.

On the plus side, I can install and modify templates, modify CSS, create custom templates, add any plugin I want, and present what I like to my website visitors. For example, I like fonts that are easy to read, so I have increased the size of the default font in this template, and added a tiny bit of extra space between letters.

How am I managing risks?

Hands-on management and maintenance of a package like WordPress requires time and attention. It’s a great way to learn what is really happening with the code, and to explore new ways of using the product. To manage risk appropriately, I have to invest some time and thought into what I’m doing.

So what do I do?

1. I update core code as it is released by pulling new code from the Subversion repository and installing it on my server account. This is command line stuff, so if you’re not comfortable running server commands, this is not going to be in your comfort zone. The newest released code can be found at http://svn.automattic.com/wordpress/tags/
2. I run a customized .htaccess file to block common exploits.
3. I check folder and file permissions to make sure they are not so open as to allow unauthorized users to upload bad content and even execute some files.
4. I use a host that is very attentive to security: NearlyFreeSpeech.net. Their business model is unique, and for low-draw sites like mine, the cost of hosting can be unbelievably low. I’ve blogged about NearlyFreeSpeech before.

What’s next?

The jury is still out for me. I find WordPress to be easy to manage for a limited site like this. Other content management systems like  Joomla and Drupal are more complex, take up more server space, and are the equivalent of swatting a fly with a hammer. I have a lot more experience with Joomla and Drupal. While they make great blogging engines, they can also require more time to manage the greater capability and complexity embedded in such capable products.

Print PDF