WordPress powers 40.1% of all websites, and 58.6% of the sites whose content management system can be identified, according to W3Techs in October 2026. It is free, open source, and supported by an enormous community. A well-built WordPress site, on good hosting, maintained by someone who knows what they are doing, can be fast, secure, and effective.
We do not build on it. This article explains why, using the data, and is honest about what we give up.
The problem is rarely WordPress itself
The WordPress core software is well maintained. Patchstack, a company that sells WordPress security services, reported that of the 11,334 new vulnerabilities found in the WordPress ecosystem in 2025, 91% were in plugins and 9% in themes. Only six were in WordPress core, and Patchstack rated them low priority.
That is the pattern: WordPress becomes a typical small business website through plugins and themes. A contact form plugin, a page builder, a slider, a booking widget, an SEO plugin, a caching plugin, a security plugin to protect the other plugins. Each one is written by a different developer, updated on a different schedule, and adds its own code to every page.
What that does to security
Patchstack also reported that 46% of the vulnerabilities it tracked in 2025 had no fix from the developer by the time they were publicly disclosed. For that window, a site running the affected plugin is exposed, and there is nothing the owner can install to close it.
The typical small business WordPress site has nobody watching for this. The person who built it moved on. Updates pile up, because updating one plugin sometimes breaks another, and the owner learned to stop clicking the button. The site keeps running until the day it does not.
What it does to speed
Every plugin and every heavy theme adds code the visitor’s phone has to download and run. Across the web, that shows up in Google’s Core Web Vitals. In November 2025 HTTP Archive data, 46.28% of WordPress sites passed all three Core Web Vitals, compared with 70.39% of Squarespace sites and 84.87% of Duda sites.
Those figures describe the median WordPress site, not the best. A carefully built WordPress site on good hosting with few plugins can pass easily. The number shows what usually happens to WordPress in the hands of a small business over a few years.
How we build instead
Our sites are built with modern web frameworks and deployed on Vercel, which serves pages from a global network close to each visitor. In practical terms:
- Pages are built ahead of time and served as finished HTML. There is no database query and no plugin code running when a customer opens your homepage. That is the main reason the sites are fast.
- There is no public login page. Most WordPress sites have a standard login address that automated attacks try constantly. Our sites have no admin page on the public website to attack.
- There is no plugin layer. Forms, booking, menus, and integrations are built into the site directly and reviewed as part of it. Nothing on the site updates itself without us knowing.
- Every change is versioned. Every edit to the site is recorded, can be reviewed before it goes live, and can be rolled back in seconds.
- Search engines and AI crawlers get the full text on the first request. Content is in the HTML, not assembled by scripts after the page loads.
Each site is built to pass Core Web Vitals and WCAG 2.2 AA accessibility standards before launch, and checked against both before any change to layout or code ships.
What we give up, honestly
The plugin marketplace. WordPress has a plugin for nearly everything. When a client needs a feature, we build it or integrate a service directly, which takes more skill than installing a plugin. That work is ours, and it is included.
Hiring any freelancer to edit it. Almost any web freelancer can work on a WordPress site. Our sites are built on widely used open frameworks, so any competent web developer can work on them, but the pool is smaller than the pool of people who know WordPress.
We think those trade-offs favor the owner, because the work they shift lands on us, and that work is what the monthly plan pays for.
If you are on WordPress now
You do not need to rebuild just because your site runs on WordPress. You should rebuild if the site fails Core Web Vitals on mobile because of its theme or plugin load, if nobody is applying updates, if adding a page means calling someone who no longer answers, or if the site has been hacked before. Any one of those means you are paying the cost of WordPress without getting what makes it good.
A custom build, hosting, maintenance, and the marketing that runs on top are all included in the $500 a month plan, with no upfront fee and no plugins to update.
If you want a straight read on your current site, book a call. I will run it through the same checks we use on our own builds before we talk.