That's why (mostly) static sites should be delivered as static HTML.

I just moved my last PHP site, my personal blog, to a static site generator. It looks like my timing was lucky!

The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.

	▲	geerlingguy 4 hours ago \| parent \| next [-]
		I'm using Remark42; some downsides but somehow, spam has not been a big issue for me. https://remark42.com
	▲	woile 4 hours ago \| parent \| prev [-]
		I've started using atproto as comments on my static blog: https://sequoia.pub/comments

▲

CodeCompost 4 hours ago | parent | prev | next [-]

How do you deal with end users wanting to edit their content? They have no clue what Markdown or Git is.

▲

eddythompson80 3 hours ago | parent | next [-]

Which is why suggestions like OP’s are never useful or actually serious. I honestly consider them snobby. Like the person who tells you you really ought to check your engine oil, radiator fluid, and brakes everytime you get in a car. It would prevent some awful issues sure, but it’s not gonna happen for 99% of people.

Having static site generator still require an admin endpoint that end users can use to author, publish or otherwise manage the content. Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git. Not to mention if there is no server side component that means the client needs to have full permission to publish content on the server. Until recently ssh was the only option. Maybe someone could vibe an iroh app that gives you a vpn'd server side app without that now.

▲

gadders an hour ago | parent | next [-]

Use CityDesk: https://www.joelonsoftware.com/2001/10/12/what-does-citydesk...

(So old.....)

▲

mkesper 2 hours ago | parent | prev | next [-]

Did you try to implement it seriously? Naturally you need an admin endpoint, it just does not have to be reachable for everybody from the internet, just via your VPN. Big difference.

▲

pessimizer 2 hours ago | parent | prev [-]

The person you're replying to didn't mention a static site generator. You could simply use Vinyl(fka Varnish), and after you pulled your PHP down, your boring brochure site would still be up.

The first site I put up professionally was a handrolled static generator written in PHP for a state website. Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. They could even add new sections by creating new subdirectories, and Imagemagick would automatically conjure new menu buttons and the code would put them in the right place.

> Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git.

This is not hard. Rsync? Rsyncd?

> Not to mention if there is no server side component

Why would there be no server-side component? What does that even mean? Just give them a script to trigger if you don't want them to have permission to do anything. Give them another script to revert if you don't want to get any emergency calls.

This is not advanced technology. Weird to talk about it like it's impossible.

> never useful or actually serious

So strange. That site was so simple to deal with that it stayed up for a decade after I left. Ancient technology.

	▲	eddythompson80 2 hours ago \| parent [-]
		> Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. Thanks for proving my point. > This is not hard. Rsync? Rsyncd? How do I do that on an iPad or an Android? > Just give them a script to trigger if you don't want them to have permission to do anything. uhhh, what permissions does that "script" have? or is that your /wp-admin equivilent? > So strange. Indeed.

▲

mkesper 2 hours ago | parent | prev [-]

Generate static pages from your content system. Even for wordpress there's some projects. If you need adaptations, AI should be helpful. You can sell this also to bosses: Delivery of static sites consumes drastically less resources.

▲

apexalpha 4 hours ago | parent | prev | next [-]

Exactly!

Unfortunately my static HTML is pre-rendered by a PHP engine before being served.

	▲	Cthulhu_ 4 hours ago \| parent \| next [-]
		That's not a problem - as long as the PHP scripts are not reachable by the general public you should be fine, generally speaking. These particular vulnerabilities affect PHP scripts accepting POST requests as far as I've been able to gather so far.
	▲	cm-t 4 hours ago \| parent \| prev [-]
		You might want to use Cecil ( https://github.com/Cecilapp/Cecil ) It's a static web site generator, powered by php :)

▲

ltbarcly3 39 minutes ago | parent | prev | next [-]

Because every once-in-a-lifetime AI is invented and finds security flaws in PHP? Seems like you are coming to an overly broad conclusion here.

▲

ltbarcly3 39 minutes ago | parent | prev [-]

Because every once-in-a-lifetime AI is invented and finds security flaws in PHP? Seems like you are coming to an overly broad conclusion here. Besides, you have to serve the static HTML somehow, and Apache and Nginx have had plenty of security vulnerabilities.