Because a wordpress[1] site with a $20 template is all most small businesses need for their brochureware site.
The average small business needs a website with their hours, phone number, some pictures, and maybe a blog that they'll never actually update, but they don't really know the difference between paying someone to set up wordpress and paying someone to build a bespoke web application.
The only reason the majority of small businesses think they need custom functionality is because they don't know enough to know what they're really trying to do.
Try to listen to what the client wants to accomplish, not how they want to accomplish it, and see if you can come up with an off the shelf solution to their problems (or refer them to someone else who can).
Think about all those times someone on stackoverflow asks how to do something in a really roundabout way that seems wrong. The first question you ask is "what are you trying to accomplish?" Most of the time there is a simpler way to do it.
Edit:
[1] When I say wordpress, I mean wordpress/drupal/cushycms not just wordpress. Basically anything where you're not charging the client to build a custom blog/CMS engine, or charging $2k for a custom design.
Until they insist on using the email service that is packaged with the shared hosting plan.
And they, or an unwitting employee, start using it to communicate information they shouldn't.
And their account gets owned. (Keep in mind, the content is no longer just public web pages...)
And... Even if the web site hosting should have been done this way, they still needed help/advice/pressure to be more clueful about their IT deployment and use.
A lot of small businesses look for the minimum and think things should just work.
Separately, as a favor, I spent a weekend cleaning such a business's systems after an employee clicked on a malicious attachment.
When I told them what that service was worth (particularly on short notice and over a weekend) -- mind you, I wasn't charging them anything, just trying to put the fear of God into them to prevent a repeat and to motivate some better policy and behavior -- they completely balked. One partner "called someone" and claimed a simple sub $100 scan with a packaged product would have taken care of the problem. (Never mind that they had multiple infections on multiple machines and a raft of outdated products presenting serious security implications.)
They were in a cash flow crisis. If I hadn't had billing up by Monday morning, they would have been severely screwed. Yet, they were unwilling to assign any significant dollar amount to what I'd done.
The other side of businesses that pay too much for custom web development, is businesses that treat their IT systems like a consumer-level Windows XP box. And we know what happens to those.
P.S. IT, IS... whichever acronym floats your boat.
Stuff like this is why I usually set my smallest clients up with a static html generator. (At least if they don't want comments, and then we consider Disqus before wordpress.)
It is really hard to have vulerabilities with static html. Similarly, hosting these costs nothing. Usually in the ballpark of $3/year, the DNS alone is the dominate cost. And if they do get a sudden inrush of traffic, static hosts need to see a thousand times more load than stock wordpress before they fall down.
Come to think of it, I've never had a client that was the correct size for Wordpress. They were either way too small or way too large.
Clients left to their own devices can eventually destroy anything.
I had a client who wanted a static site, but at the last minute decided they needed a "news" sidebar on every page that they could update. This was before any of the off the shelf solutions existed (to mixing static and dynamic content), so I wrote some javascript (before jquery made ajax easy) that grabbed the content from a flat file.
Long story short, a few years later, they had someone on staff who knew some html, and they basically turned that tiny sidebar from a div displaying 2 or 3 paragraphs of text into an entire website--complete with oversized videos, rotating image headers, and dozens of links.
I cut my teeth building wordpress/drupal brochure sites for small businesses. I have inherited custom web sites for these customers who got duped by some punk developer who didn't feel like using an established solution.
I want to punch all developers in the mouth who think a custom application for this type of situation is a good idea. They give us all a bad name and exacerbate the cost problem.
I want to smack all the developers and designers who think Wordpress is "good enough". It's not. It's an unmaintainable mess. Every client-run Wordpress site I touch is disgustingly out of date and everything added since the first design looks like crayon drawings done by five-year olds with ADD. I don't see much Drupal in the wild so I can't comment on that.
Web development has not reached the state where non-technical end users can maintain websites. In theory, sure, in practice, there's tons of money to be made fixing hacked sites and cleaning up years of technical debt.
I would not recommend Wordpress for anything other than a simple blog. Do anything else with it, you need a developer on staff. And a simple blog will never be enough for the needs of a small business.
I'd much rather work on some 90s-era custom-built app than the vast majority of brutally hacked together Wordpress sites.
WordPress is excellent, and there are some mighty big WP sites out there. You're barking up the right tree when you say "you need a developer on staff" though. Web sites are not just "set and forget" deals. They need continuing care and maintenance. And the whole idea of having a site that the receptionist can take care of on a Friday afternoon, which I have found pervasive in small businesses, has just never really worked at all.
Small business needs an easy CMS whereby staff can do most of the tasks without present "IT Crowd". AFAIK WordPress gets it done (with some minor problems - as you wrote fe. updating is a problem for non-technical people and WordPress haves no MVC, so it`s easy to go spaghetti way with the code). WordPress devs are trying to resolve problems which are most voted within the community.
They're not minor problems. Please don't underestimate the epidemic of hacked sites that are a direct result of end-user unwillingness to upgrade and possibly break their site. This is a problem that can't be solved without significant architectural changes. Customers are more willing to risk getting their websites pwned than to risk an upgrade that may take their site down, so upgrades often aren't done for years.
It's not a small problem, its a huge one, and the primary reason why I can no longer recommend Wordpress.
I agree with "Security is a process, not a product." AFAIK security is important for WordPress team. There is a lot of good documentation on a project site and there are some materials from WordCamps (fe. http://codex.wordpress.org/Hardening_WordPress)
Latest WP "hack" via botnets was because of weak logins and passwords which are set by the users. Can you blame WP devs for that?
Speaking about upgrading; making updates easier it`s also one of the goals of the project. Also it isn`t that hard when you develop WP sites using information from WordPress Codex docs.
I hope it will get better with time, and as i wrote people are working to get things better. Sorry to hear that you are not going to recommend WordPress any longer.
It's not Wordpress that's the issue, it's with the current state of the problem domain. People want websites that they don't have to pay a programmer to maintain. Wordpress solved this for blogging, but using it for anything else and not having technical talent on call makes for a giant mess.
Yes, exactly - it`s not a problem with tool, but with use of it. I also wouldn`t recommend using any software without knowledge how it behaves and what can be done with it.
What you're essentially saying here is that only programmers should have websites. This is not a good attitude. Like saying only mechanics should own cars. We need to change the technology, make it more accessible, not just say that only the technically savvy should use technology.
No, i`ve tried to say that WordPress is simple enough (for a non-technical person after a short training) to deal with the majority of tasks. I don`t know easier open source CMS comparable to WordPress.
It's not a matter of Wordpress being 'good enough', as much as being sometimes 'what the client wants and all they're willing to pay for.' You're not wrong about the codebase though, but it's not entirely the fault of developers.
I feel kind of the opposite, where I've seen wordpress used to create what is effectively a static brochure site - what good is a Content Management Solution when the content isn't being managed? The only reason they're using it is that's all they know, and it allows them to create the site without looking at any code. Plus, giving customers a wordpress site opens up the door for user error, plus the inevitable security issues (even though I insist on using HTTPS, but now I have to explain what HTTPS is).
My solution so far has been to build static sites with Middleman. If they need a couple other features (like a contact form), I can use third party services called client-side. Ultimately, my turnaround is about the same as a wordpress site with the same features, and is quite a bit less complex, at least in my opinion. Of course this only applies to very basic websites, if they want a more complex app and will update the content regularly, I will use a CMS. I guess I'm just not sure what's wrong with this solution, but then again I'm pretty new at this.
Static sites are an excellent solution. It keeps clients from getting too ambitious for their own good.
As far as CMSes go, I was pretty impressed with Umbraco. It lets you design the client interface that they use to update the site. It's .NET, but I've yet to see a better solution.
This is very true. The clients we have had to date which are prepared to spend good money on a website have done so to differentiate themselves from their competitors with great success.
The average small business needs a website with their hours, phone number, some pictures, and maybe a blog that they'll never actually update, but they don't really know the difference between paying someone to set up wordpress and paying someone to build a bespoke web application.
The only reason the majority of small businesses think they need custom functionality is because they don't know enough to know what they're really trying to do. Try to listen to what the client wants to accomplish, not how they want to accomplish it, and see if you can come up with an off the shelf solution to their problems (or refer them to someone else who can).
Think about all those times someone on stackoverflow asks how to do something in a really roundabout way that seems wrong. The first question you ask is "what are you trying to accomplish?" Most of the time there is a simpler way to do it.
Edit:
[1] When I say wordpress, I mean wordpress/drupal/cushycms not just wordpress. Basically anything where you're not charging the client to build a custom blog/CMS engine, or charging $2k for a custom design.