I'm not a serious blogger but like to create posts about once a month. I hate vanilla wordpress, but its feature set and ui is much better than anything I could write on my own. I wrote a basic blog app using django, but I hate having to support it. Have others struggled with this choice, what did you decide?
To me it is more about what do you want to do more, create and support your own blog software just so you can post once or twice a month or just use something that works so you can write. From my own experience if I have to create/support the code, I stop writing consistently and fail to post.
Wordpress is a bit of a beast, but it just works. The security concerns while not improper, are just not that worrisome for a basic blog. Wordpress can be plenty secure if you keep plugins to a minimum and follow best practices.
Ghost is a great option, and way more back to basics blogging to me. e.g. it gets rid of all the noise of trying to be everything to everyone which minimizes the security risks etc. This would be the direction I would recommend personally.
Wordpress has way to many security problems, especially if you use plugins, as that I would want to administer it myself. Especially since wordpress is so popular and you can assume that vulnerabilities are actively exploited very quickly.
A static site generator, something hosted or even a more modern, less popular platform takes away a lot of that pressure.
Automattic, the company behind WordPress, has a good security team and an active bug bounty program. They respond to reported vulnerabilities, especially serious ones, extremely swiftly. Furthermore, a good hosting service will eliminate almost all the security issues Automattic doesn't catch.
If you get a good host (e.g. WPEngine) you can automate backups and security updates, and the host will constantly monitor your account for suspicious activity and known-vulnerable plugins. It will even notify you if you install an unsafe plugin and automatically uninstall it.
I run my own information security blog on WordPress. I have comments disabled, I'm careful about what plugins I install (because let's be honest, there aren't many you really need) and WPEngine constantly scans my entire installation for suspicious activity or evidence of an intrusion. Aside from a 0day, there isn't much an attacker can do to compromise me.
Looking past alleged security issues, WordPress is a very established, robust and mature CMS for people who want stability and customization for their blog platform. I highly recommend it.
So you don'd administer it yourself, but use a managed service. Which is exactly what I suggested as an alternative, because it means that you have someone monitoring it and taking care of it and don't have to take care of quickly installing updates and stuff.
Having done both, repeatedly: use Wordpress or another blogging platform (I hear good things about Jekyll but haven't used it).
The feature set issue looks small, but becomes bigger the more time you spend on the single piece of blogging software. And the bigger and more sprawling your homebrew system becomes, the slower it is to add additional features, and the more likely you are to introduce bugs or security issues...
On that subject, security's another major problem. SEO comment spammers are persistent, and if they discover a way that your blogging code isn't secure, they'll hammer you. WP, provided you keep it up to date, has a lot more eyes making sure it's secure than you do.
(Counter-argument: if you're not going to keep the install up to date, don't go WP. You WILL get hacked.)
I tried jekyll and it is an excellent compromise, providing all the goodness of a flexible templating and layout system with the ease and server-lessness of static pages. Combined with s3-website, it took me about 3 hours to rebuild my blog (mostly time spent editing old posts into markdown).
It is extremely customisable. There are tens of thousands of themes and many themes can be heavily customised within their own right.
Even assuming you wrote your own blogging platform you still have to write a lot of the useful Wordpress addons like WP Super Cache, Google XML Sitemaps, and so on.
I'd honest think it would be a better use of your time to write your own Wordpress theme end to end, than to write your own blogging platform, at least the theme you could likely sell (as opposed to your own, unsupported, blogging solution).
I'm no Wordpress fan boy, but it "just works" out of the box, and the only real downside I can name is I wish it didn't have so many security issues (and "apply this now!" critical patches).
I am less technically proficient than a lot of people here. I know a little HTML and CSS and I used to hand-code my own sites. I moved them to Word Press to try to stop spending all my time on coding and, instead, focus more on content creation and general development. I was very frustrated with Word Press because of the amount of time I spent a) updating the backend and b) looking for a better template that I liked more than whatever I had settled for initially.
I ultimately moved everything to BlogSpot. I am much happier and I spend much more time on actual development of content and layout and so on.
For something that gets updated once a month, I'd go with a static site generator. I like https://middlemanapp.com/. If that seems like too much work, you should just write on Medium.
Having used WordPress heavily in the past, I wouldn't go near it for my own site. It's a great option if you need a CMS for non-technical contributors, but I find I can get things done much faster writing in my editor of choice. As others have mentioned, security is something you need to stay on top of...
I avoid WordPress self-installs due to its poor track record on security, so I'm currently using http://jekyllrb.com.
However, there's something to be said for just being able to open up a page on WordPress and start typing away.
The (albeit small) speed bump to getting a new post going in Jekyll has kept me from posting/writing many times. It's slightly cumbersome. I may switch to WordPress.com or something, soon.
I'd stick with Wordpress. Find a template you like, it'll be worth the $40-60 to not have to constantly support a custom app for something like blogging.
If you enjoy coding and are willing to spend hours at a time upgrading and maintaining your own blogging platform go for it. If you want to just post content then go with a blogging platform, but before you settle on one try a few of them out!
Wordpress is a bit of a beast, but it just works. The security concerns while not improper, are just not that worrisome for a basic blog. Wordpress can be plenty secure if you keep plugins to a minimum and follow best practices.
Ghost is a great option, and way more back to basics blogging to me. e.g. it gets rid of all the noise of trying to be everything to everyone which minimizes the security risks etc. This would be the direction I would recommend personally.