WordPress did not win the publishing market on features. It won on the twenty minutes after you decide to start a site.

Upload some files, fill in four database fields, click once. That is the whole installation, and it has been the whole installation for years. Every competitor asks more. Drupal wants you to understand its idea of nodes and taxonomies before you can produce a page. Movable Type needs a Perl environment configured correctly and a rebuild step whose purpose is not obvious until it fails. Both are respectable pieces of software and both lose an enormous number of people in the first hour, and the people they lose never file a complaint. They just do something else.

Nobody sets out to win a market by removing friction from setup, because it does not sound like an achievement. It is the most reliable one available.

The consequence is that a tool built for personal blogs is now running things that are not blogs at all. Company sites, magazines, shops. It manages that through plugins, and the plugin architecture is the second reason it won and the reason I would be nervous.

A plugin is arbitrary code from a stranger, running inside your installation, with unrestricted access to your database. There is no sandbox and no permission model. Install eight of them, which is normal, and you are trusting eight people you have never met with everything the site knows, on an ongoing basis, including whatever they push in next month’s update.

Most of those people are fine. That is not the same as safe, and the failure will not come from malice. It will come from a well-meaning plugin with a sloppy database query, installed on a few hundred thousand sites, discovered by somebody who scans for it.

The other thing worth noticing is Movable Type going open source this month. That is not a strategic pivot, it is a company acknowledging that its licensing decision three years ago cost it the market. It changed terms, its community left for the free option, and the free option compounded every month afterward. Reversing the terms does not reverse the compounding, because what left was not customers but the plugin authors and theme designers, and they are not coming back to rebuild an ecosystem that already exists elsewhere.

Publishing software is close to solved for most people now, which is genuinely good. The remaining problems are security and the sprawl that comes from a tool being used far outside what it was designed for, and neither gets easier from here.