What is WordPress (and what isn't it)?

Module 1: How WordPress works · Reading time: 7 minutes

Learning objective: After this lesson, you can explain what WordPress is, what the difference is between WordPress.org and WordPress.com, and when WordPress is, and isn't, the best choice.

Key concepts: CMS, open source, GPL, core, theme, plugin, WordPress.org, WordPress.com, self-hosting

A CMS: separating content and design

A website consists of pages in HTML: the language your browser reads. In the past, you built every page by hand and uploaded the file to a server. If you wanted to change a sentence, you opened the file, searched for the sentence among all the code, and uploaded the file again.

A CMS (content management system) separates these two things. Your text, photos and settings sit in a database. The design is kept separate, in a template. When a visitor requests a page, the CMS combines the content and the design at that moment into an HTML page. You edit the content in an admin area, without code.

WordPress is such a CMS, and the most widely used one in the world. It started in 2003 as blogging software, but now also powers business websites, online shops (with the WooCommerce plugin), association websites and intranets.

Open source and the GPL

WordPress is open source: the source code is public and anyone may use, study, modify and distribute it. This is set out in the licence, the GPL (GNU General Public License, version 2 or later). For you, this means:

• You pay nothing for WordPress itself. At most, you pay for hosting, a domain name, a paid theme or a paid plugin.
• Nobody can take WordPress away from you. You can always take your website to another host.
• Thousands of volunteers and companies contribute to it. Security issues are discussed openly and fixed quickly.
• Themes and plugins that work together with WordPress are, according to the WordPress community, also covered by the GPL. So you may officially pass on a paid plugin. But be careful: a "free" copy of a paid plugin from an unknown website (a nulled plugin) often contains a deliberate backdoor. More on this in lesson 5.3.

Three layers: core, theme and plugins

A WordPress website consists of three layers that you can replace independently of each other:

1. The core: WordPress itself. The admin area, database handling, users, the editor. The same code on millions of websites. You never modify this yourself, because it gets overwritten with every update.
2. The theme: determines how your website looks. Colours, fonts, the layout of a page, the menu. You always have exactly one active theme.
3. Plugins: add functionality. A contact form, an online shop, a cookie notice, caching, a backup. You can have none or dozens.

This distinction comes back throughout the course. If something goes wrong after an update, the first question is: is it in the core, in the theme, or in a plugin? And if you want to change something, the question is: does this belong to the design (theme), to a function (plugin), or is it simply content?

WordPress.org and WordPress.com: not the same thing

This is where things often go wrong. There are two things with almost the same name:

This course is about self-hosted WordPress: the software from WordPress.org, on a hosting plan. That's what you get when you install WordPress with a hosting company, as in the examples in this course using DirectAdmin. Much of this knowledge also applies to WordPress.com and to managed WordPress hosting, but there the provider handles part of the maintenance and you don't have access to everything.

What self-hosting gives you, and what it costs

Self-hosting gives you freedom: any theme, any plugin, your own backups, your own email on the same domain. But that freedom comes at a price in time and attention. You are responsible for:

• updates of core, theme and plugins (module 7);
• backups and being able to restore them (module 8);
• security: strong passwords, few plugins, correct permissions (module 7);
• speed (module 6);
• legislation, such as the GDPR and cookie rules (module 9).

A host takes over part of this (server backups, a firewall, a free certificate), but what happens within your WordPress installation remains yours. An outdated plugin is your vulnerability, even on the best server.

When WordPress isn't the best choice

WordPress is versatile, but not always the most convenient choice. A few honest examples:

• A one-page business card website that never changes. A simple static HTML page or a website builder is faster, safer and needs no maintenance.
• You don't want any maintenance at all. A paid website builder or a hosted online shop service handles updates for you. But you give up freedom and you're more tied to that provider.
• A large online shop with thousands of products and integrations. This is possible with WordPress and WooCommerce, but requires serious hosting, caching and a developer. A specialised platform may then be simpler.
• An application (a booking system with its own logic, a portal) is often better served by a framework than by dozens of plugins trying together to do something they weren't built for.

WordPress is a good fit if you want to change content regularly, want to be able to extend it yourself, and want the freedom to migrate elsewhere. As long as you're willing to keep it maintained.

Recognising whether a website runs on WordPress

You can often tell whether a website uses WordPress without logging in. Open the page source (right-click, "View page source") and look for:

• paths containing /wp-content/ or /wp-includes/ (themes, plugins and scripts);
• a reference to /wp-json/, WordPress's programming interface (REST API). This also appears in the response headers:

link: <https://example.com/wp-json/>; rel="https://api.w.org/"

A website that shields its WordPress installation well shows less, but paths like /wp-content/ are almost always there. That's not a problem: the fact that a website uses WordPress is no secret. What matters is whether its components are kept up to date.

Summary

• A CMS separates content (database) and design (theme), and assembles pages at the moment they're requested.
• WordPress is open source under the GPL: free, you can always migrate, and it's maintained by a large community.
• A website consists of core, theme and plugins. You never modify the core yourself.
• WordPress.org is the software you host yourself; WordPress.com is a service that hosts it for you.
• Self-hosting gives you freedom, but updates, backups and security are your responsibility.

Quiz

Exercise

Exercise A1.1: Does this website run on WordPress? Enter the address of your own website (or wordpress.org if you don't yet have a website) and indicate whether it runs on WordPress. Also name one piece of evidence you found yourself in the source code or the headers, for example a path containing /wp-content/ or the link header pointing to /wp-json/. The system checks whether your answer is correct.

Exercise D1.1: Does WordPress suit your project? Describe your own website (or a website you'd like to build) in a few sentences: who works on it, how often does the content change, which functions do you need? Tick the responsibilities you'll take on yourself (updates, backups, security, GDPR) and note who does it when you're not available.

Further reading

These articles describe the steps in WebOké's panels; in other panels, they work similarly.

• DirectAdmin guide 1.9: Terms explained: domain, subdomain, pointer, DNS, mailbox and database
• DirectAdmin guide 13.1: Opening Installatron: what can you install?
• About WordPress and the GPL (wordpress.org, English): https://wordpress.org/about/license/