WordPress is not a bad choice. Just not always yours.
It powers over 40 % of the web and its core is among the best-maintained software there is. The question is not whether it is good — but whether what you want from a site can be had without nursing it every week.
We are not against WordPress. We send some clients to it — below we say exactly when.
Core is not the problem — six findings in a year, all low risk. The problem is the surface you install on top of it.
Source: Patchstack, State of WordPress Security in 2026.
The core is fine. The surface around it is not.
During 2025, 11,334 vulnerabilities were disclosed across the WordPress ecosystem. Six were in core, all of them low risk.
The rest sit in plugins and themes — that is, in exactly what you install on top of WordPress to make it do what you need. More features, more surface.
Every plugin has its own vendor and its own release cadence. An update you postpone is an open window; an update you apply can break another.
Not in buying it. In keeping it.
An ordinary business site on WordPress rests on six to fifteen plugins. Each has its own vendor and its own release cadence.
A postponed update is an open window. An applied update can break another. A custom site has no such layer — what needs no updating cannot break either.
A custom site is not an expensive WordPress. It is a different decision — you pay once so that the layer which breaks is not yours to look after.
The question is not which is better, but what you want from a site.
Five things decide it: speed as a business requirement, ties to internal systems, whether the process is yours or the plugin's, accessibility, and how many years the site should run unattended.
If none of them matter to you, WordPress is the cheaper and more sensible choice, and we will tell you so.
- You need a site next week and the budget is under a thousand euro.
- A content site or blog with no ties to internal systems.
- Someone on your team knows WordPress and will maintain it.
- Requirements are standard and you can live with how a plugin solves them.
- Speed is a business requirement, not a technical metric.
- The site has to talk to your CRM, stock or accounting.
- The process is yours, not whatever the nearest plugin offers.
- WCAG 2.1 AA accessibility has to hold up under inspection.
- The site should run for five years without weekly nursing.
If you recognised yourself on the left, let us say so on the call — building you something custom that WordPress would handle is expensive advice.
A site with no layer that breaks.
No plugin layer
Features are part of the site, not installed from six vendors. Nothing to update and nothing to break.
Speed as a brief
Core Web Vitals are handled in the design, not by a cache plugin bolted on at the end.
Wired to your systems
CRM, stock, accounting, payment gateway — over an API, not a CSV export.
Accessible from the start
WCAG 2.1 AA is part of the brief, not a repair after the audit.
Common questions
Is WordPress not secure?
The core is — Patchstack records six vulnerabilities in it during 2025, all low risk. For software running on over 40 % of the web that is an excellent result. The risk sits in the surface around it: 91 % of findings were in plugins and 9 % in themes. WordPress without plugins is secure, but that WordPress is usually not the one you need.
Is a custom site not more expensive?
To buy, almost always yes. The difference is what you pay afterwards: with WordPress, ongoing maintenance of the plugin layer; with a custom site, hosting and occasional changes. Where exactly it turns over depends on how much the site does — for a simple content site it never does, and that is when we will recommend WordPress.
Can we edit a custom site ourselves?
Yes. We build the editing side so someone in marketing changes content without a developer. The difference from WordPress is not whether it can be edited, but that only what should change can — so the layout cannot be broken by accident.
What if we want to leave you?
The source code is yours and we hand it over with deployment documentation. This, incidentally, is a point where WordPress and a custom site are equal — both can be taken and moved. With rented platforms that is not the case.
Can we move off WordPress without losing Google rankings?
Yes, if the migration is done properly: keep the URL structure or set permanent redirects, carry over content and metadata, and measure before and after. A post-migration drop does not come from changing technology — it comes from forgotten URLs.
Tell us what the site has to do.
Write to us with what you need from the site and what you have today. Within 24 hours we reply on whether it is custom work — or whether WordPress will do and you save the money.