[alexpatin]

This is my first HN comment - I must be the only WP developer who reads Hacker News or something. Let me preface this by saying I'm not going to be repeating what's already been said about non-technical user friendliness.

WordPress was my gateway in 2008-9 to web development. back when I was still a graphic design student. I started off hacking away at themes with my extremely limited HTML / CSS / PHP knowledge back then. Shit, my Google-fu was't really even halfway decent then.

Today, thanks to the large community of developers working on the core WordPress project every day, and the sheer number of bug fixes, security updates, and new features that get added with each release -- there's absolutely nothing to compare it to. It runs nearly a quarter of the entire internet.

And now, with the upcoming release of the JSON REST API as a part of core, developers will be able to take advantage of using WP as a data backend (read: users still control their content), while using the API to build applications with modern tech like React or Angular.

Just my two satoshis.

Edit: I'd also like to point out that several (not all) hacks come from popular themes and plugins that are created by 3rd party authors / sources. Some of these are not available on the wordpress.org theme and plugin repositories, and usually this is due to not following certain standards. I would blame most successful hacks on brute force attempts against sites with admins who leave their username as the default admin and have incredibly weak passwords. I would also venture to say most of these hacks come from through exploits in third party code or out of date code, which users often fail to update.

[snowwrestler]

IMO there is no excuse for the lack of login rate limiting in Wordpress core. Drupal has had this for years and it causes no usability problems at all, while making it almost impossible to brute-force an admin session. It just boggles my mind that it takes a plugin to provide this basic protection on WP.