WordPress powers roughly 43% of the internet. That is a testament to its accessibility, not its quality. Ask any agency that ships production sites and you'll hear the same thing: WordPress is a compromise most businesses can do better than.
Security
WordPress is the single most-attacked platform on the internet. Not because the core is uniquely broken — the core is actually pretty solid — but because the plugin ecosystem is a Wild West of code quality.
A typical WordPress site runs 15–30 plugins. Each plugin is a potential vulnerability. Every plugin update is a potential breakage. Every WordPress site we've been asked to audit has had at least one outdated plugin that was actively being exploited.
Custom sites don't have this problem because there are no third-party plugins to compromise.
Performance
WordPress can be fast. Most WordPress sites are not. Between page builders, dozens of plugins injecting scripts, and the standard "we'll add caching later" mentality, average WordPress performance is significantly worse than a custom-built equivalent.
Core Web Vitals — Google's ranking signals — are consistently harder to pass on WordPress than on modern static frameworks like Astro.
Maintenance
WordPress requires ongoing maintenance:
- Core updates
- Plugin updates
- Theme updates
- Database optimisation
- Security scanning
- Backup verification
Miss any of these and your site drifts into vulnerability. Retainer fees for WordPress maintenance typically run $100–$300/month per site.
Custom sites need updates too — but usually just periodic dependency bumps, not a monthly plugin roulette.
Total cost of ownership
The upfront cost of WordPress looks cheap. Total cost over 3 years usually isn't:
- $2,000 build + $150/mo maintenance = $7,400 over 3 years
- Custom $4,500 build + $50/mo maintenance = $6,300 over 3 years
And the custom site is faster, more secure, and easier for your team to work with.
When WordPress is still right
We use it sometimes. WordPress is still a fair choice when:
- Your team already runs multiple WordPress sites and has strong internal WordPress expertise
- Your content editors need a WYSIWYG builder they already know
- The site is a pure blog with no custom business logic
- Budget is under $2,000 and you're willing to accept the tradeoffs
For everything else, custom wins on every axis that matters.
What "custom" actually means
Custom doesn't mean rebuilding the wheel. Our custom stack looks like this:
- Frontend: Astro or Next.js for the marketing side, React for admin
- CMS: Either a purpose-built PHP+MySQL admin (this site's approach) or a headless CMS (Sanity, Directus)
- Hosting: Cloudflare Pages, Vercel, or standard shared hosting
Modern tooling makes custom cheaper than it used to be. The maintenance overhead is lower than WordPress. The security surface is smaller. And the site actually loads fast.
If you're on WordPress and it's working, don't rebuild. If you're starting fresh, ask hard questions before defaulting to WordPress.