A few years ago, recommending WordPress to a business would not have been Robert Scales's first choice. At Raincity Studios, the team spent years working with Drupal, expertise that built its reputation. It also built WordPress sites, but WordPress was then seen mainly as a blogging tool.
This change in position does not stem from a feature list. It stems from observing who actually uses a site after launch. Here in Bali, that means small tourism businesses, and their experience makes the case more convincingly than any technical argument.
A dive operator or a guesthouse owner has no web team. They manage a front desk, a boat that needs maintenance and some forty emails from guests. If changing the price of a course requires a developer, it will not get done. The site gradually becomes outdated. Six months later, it shows last year's prices and a Christmas promotion in July.
Drupal or WordPress: which suits a small tourism business?
Drupal is a powerful system. For a large organization with complex content, user roles and a developer on hand, it remains an excellent choice. For a five-person business, it is more than needed. Its admin screens confuse a non-technical owner, and small changes often require someone who knows how the site was built.
WordPress has matured considerably. Version 3.0, released last year, introduced custom menus and made custom post types practical, so a proper business site can be built with it, well beyond a blog. Version 3.2, released on July 4, is somewhat faster and its admin is cleaner. The editor resembles a word processor. Owners can log in, change a price, add a photo and log out without calling anyone.
That is the central argument: the best CMS for a small client is the one they will actually use.
What WordPress setup suits a tourism business?
A deliberately simple one. Tourism businesses need a few things: pages that describe their services, a way to display prices and schedules, plenty of photos, a contact or booking form, and a site that loads on a phone. Nothing unusual.
Which theme should you choose?
A clean, lightweight theme that is easy to adjust, rather than a heavy "premium" theme with sliders, shortcodes and three hundred options. Those themes look impressive in the demo, but they tie the client to the theme permanently, because all the content is built with their own special codes. If the theme is changed later, the pages fill with broken brackets.
How many plugins should you install?
As few as possible. Here is the basic list for most small sites:
- A spam filter for comments (Akismet, in most cases).
- A contact form plugin.
- A caching plugin, so pages load faster on budget hosting.
- A backup plugin that sends copies somewhere other than the server.
- An SEO plugin to manage titles and descriptions properly.
That is usually sufficient. When a client requests a feature, the first question is whether it can be achieved without a plugin. It often can.
What does the TimThumb vulnerability found this month reveal?
August demonstrated the point clearly. At the start of the month, a security vulnerability was found in TimThumb, a small image-resizing script bundled into a very large number of WordPress themes, including many premium ones. Sites whose owners had never heard of it were hacked. Those owners were unaware the code was present, because it came with the theme.
This is the essential issue: nobody chose TimThumb. It was included with the theme. Every plugin and every bundled script is one more component that must be kept up to date, and on a small business site, that task is usually neglected.
If your theme uses it, update the theme or patch the file now. If you do not know whether it does, we recommend checking this week.
Fewer plugins, fewer problems. It is an unremarkable recommendation, but probably the most useful one.
Why set up automated backups before anything else?
If only one rule from this setup were kept, it would be this: before the design, before SEO, before the plugins, set up automatic backups stored off the server.
Budget shared hosting is widespread, and it fails. Servers are hacked. Accounts are suspended over an unpaid invoice nobody noticed. An owner deletes the wrong page. An update causes an error.
Island conditions make these risks very concrete: power cuts, a hosting company on the other side of the world, and owners who may only notice their site is down when a guest mentions it. These problems cannot be fixed quickly from a café. The solution is to restore from a backup and address the cause afterward.
With a recent backup stored elsewhere, each of these incidents costs only an afternoon. Without one, the site might have to be rebuilt from whatever text and photos can be found in old emails.
The recommended routine is simple: daily database backups, weekly full backups, copies sent off the server automatically, and an occasional test restore to confirm they work. That last step is often skipped. A backup that has never been restored offers no guarantee.
What do we recommend to tourism operators this month?
Choose a system you can manage yourself. Limit plugins to the ones you genuinely need. Back up automatically, off the server, and test the restore. Check whether your theme includes TimThumb.
For further detail, the official WordPress documentation is the best starting point. It is not always user-friendly, but it is accurate, which cannot be said of much of what appears in search results.
When a custom WordPress website is the right fit, this lean approach is how we build it, with backups running from day one. For owners who would rather never think about updates, managed web hosting that handles them is a sound investment.
Drupal retains its strengths, but its admin screens are not suited to a guesthouse owner managing a site at eleven at night.