WordPress or custom-built? An honest comparison
WordPress runs a huge part of the web. That is its strength, and exactly its weakness. When is it the smart choice, and when do you pay for it later?
Updated 10 min read
In short
- WordPress runs 39.5% of all websites and holds 58% of the content management system market. It is mature, flexible and there is a plugin for almost everything.
- Those plugins are also the weak spot: in 2025, 11,334 new security vulnerabilities were found, 91% of them in plugins and only 6 in WordPress itself.
- On speed, WordPress scores poorly on average: only 45% of WordPress sites pass Google’s Core Web Vitals on mobile.
- Choose WordPress if you publish a lot, like to tinker and have someone who keeps up with the updates. Choose custom if your site drives revenue, connects to your systems or handles customer data.
- You can switch without losing your Google rankings, as long as you redirect every old page properly.
Why WordPress is so big
WordPress started in 2003 as blogging software and grew into the best-known system for building websites. According to W3Techs, 39.5% of all websites run on it, and it holds 58.2% of the content management system market1W3Techs, 2026Usage Statistics and Market Share of WordPressOpen the source. For comparison: Shopify powers 5.3% of all sites, Wix 4.2%2W3Techs, 2026Usage Statistics and Market Share of Content Management SystemsOpen the source.
That success is earned. WordPress is free, there are thousands of themes and plugins, nearly every web developer knows it and the editor works well if you publish a lot. And the core is secure: in 2025, only six vulnerabilities were found in WordPress itself, all of them low priority3Patchstack, 2026State of WordPress Security in 2026Open the source. The problem is rarely WordPress. It is everything bolted onto it.
Where it falls short
Plugins: handy, and the biggest risk
The average WordPress site runs on a stack of plugins: for forms, SEO, speed, backups, security, cookies. Each plugin is code from a different vendor, with its own update schedule. Patchstack, which tracks security vulnerabilities in WordPress, counted 11,334 new ones in 2025, 42% more than the year before3Patchstack, 2026State of WordPress Security in 2026Open the source.
91%
of new vulnerabilities in 2025 were in plugins, 9% in themes3Patchstack, 2026State of WordPress Security in 2026Open the source
46%
had no fix from the developer yet when the vulnerability went public3Patchstack, 2026State of WordPress Security in 2026Open the source
5 hours
until the first attack, the median for heavily exploited vulnerabilities3Patchstack, 2026State of WordPress Security in 2026Open the source
So if you have a WordPress site, you need to keep track of what is installed, apply updates quickly and test that everything still works afterward. That is not a one-time job. It is monthly maintenance.
Speed
The HTTP Archive, which analyzes millions of websites every year, puts WordPress among the slowest systems on mobile: 45% of WordPress sites pass the Core Web Vitals, compared with 85% for Duda and 74% for Wix4HTTP Archive, 2026CMS | 2025 | The Web Almanac by HTTP Archive (Chapter 12)Open the source. One big reason: around 60% of WordPress sites use a page builder, which ships a lot of extra code4HTTP Archive, 2026CMS | 2025 | The Web Almanac by HTTP Archive (Chapter 12)Open the source. A typical mobile homepage now weighs about 2.5 MB5HTTP Archive, 2026Page Weight | 2025 | The Web Almanac by HTTP Archive (Chapter 14)Open the source.
To be fair, WordPress is getting faster. Its score rose by about four percentage points in 20254HTTP Archive, 2026CMS | 2025 | The Web Almanac by HTTP Archive (Chapter 12)Open the source. A cleanly built WordPress site with a lightweight theme can be perfectly fast. Most just aren’t.
Maintenance that never stops
WordPress runs on PHP, and that needs updating too. WordPress itself recommends PHP 8.3 or newer6WordPress.org, 2026RequirementsOpen the source, while 34% of all PHP sites still run version 7 or older7W3Techs, 2026Usage statistics of PHP version 8 / PHP for websitesOpen the source. PHP 8.1 has had no security updates since December 31, 2025, and 8.2 reaches that point on December 31, 20268PHP.net, 2026Supported Versions / Unsupported BranchesOpen the source. More on that in Is PHP outdated?
What custom-built means in 2026
When people hear custom-built, many picture an expensive project where everything is coded from scratch. It hasn’t worked that way for years. A modern custom site is built with proven building blocks, such as React and TypeScript, and runs on a global network close to the visitor. Cloudflare, which we build on, has servers in more than 330 cities9Cloudflare, 2026500 Tbps of capacity: 16 years of scaling our global network; Cloudflare Global NetworkOpen the source.
The difference from WordPress: there is no theme and no stack of plugins in between. The site contains only the code it needs. You get an admin area for exactly the things you want to change, like text, prices, packages and photos, without any way to break something by accident. Developers are moving to this kind of stack too: in Stack Overflow’s big survey, 43.6% use TypeScript versus 18.9% PHP, and 44.7% React versus 23.4% jQuery10Stack Overflow, 2025Stack Overflow Developer Survey 2025 – TechnologyOpen the source.
WordPress and custom side by side
| WordPress | Custom | |
|---|---|---|
| Build cost | Low to medium, depending on theme and plugins | Used to be high, now comparable thanks to modern tools |
| Yearly cost | Hosting, premium plugins and updates | Hosting and maintenance, no plugin licenses |
| Speed | 45% pass the Core Web Vitals on mobile4HTTP Archive, 2026CMS | 2025 | The Web Almanac by HTTP Archive (Chapter 12)Open the source | Only the code it needs, so easy to make fast |
| Security | Secure core, the risk is in the plugins3Patchstack, 2026State of WordPress Security in 2026Open the source | Small attack surface, no code from dozens of vendors |
| Editing it yourself | Everything, including what you’d better leave alone | Exactly what you need, in your own admin area |
| Integrations | Through plugins, if they exist | Directly with your CRM, accounting or inventory |
| Publishing a lot | A strong point, with a good editor | Possible, but it has to be built in |
| Maintenance | Every month, by you or your agency | By the developer, as part of the subscription |
Which one fits you?
Seven questions, one honest recommendation. Some answers point to WordPress or a website builder, and that is exactly the point.
Seven questions, one honest answer
1Does the build have to stay under €1,000?
2Do you want to install plugins and switch themes yourself?
3Will several people publish articles or news every week?
4Should the site work with your own systems (CRM, accounting, stock, bookings)?
5Does a large part of your revenue come in through Google or ads?
6Do customers log in, pay or leave personal data on your site?
7Is there someone who checks and installs updates every month?
Answer at least three questions and the advice appears here.
0 of 7 answered
When WordPress is the right choice
- You publish a lot, with several people. A news site, a trade blog or an editorial team: that is what WordPress was made for.
- You like to tinker. Trying plugins, switching themes, building things yourself. Then the freedom of WordPress is an advantage.
- You have a working WordPress site that is well maintained. Rebuilding it just for the sake of rebuilding is a waste of money.
- Someone does the updates every month. With a lightweight theme, as few plugins as possible and good hosting, WordPress works fine.
When custom pays for itself
- Your site drives revenue, through Google or ads. Then speed shows up directly in your results. Rakuten 24 improved its Core Web Vitals and saw its conversion rate rise by 33%11web.dev, 2022How Rakuten 24's investment in Core Web Vitals increased revenue per visitor by 53.37% and conversion rate by 33.13%Open the source.
- Your site has to work with your systems. An integration with your CRM, accounting, inventory or booking system works better when it’s built in than when it depends on a plugin.
- Customers log in, pay or leave their details. Less third-party code means fewer ways in.
- You don’t want to worry about maintenance. No plugin updates, no theme that breaks after an update.
- You want to stand out. A design of your own instead of a theme thousands of others use too.
Switching without losing your Google rankings
The biggest fear when switching: disappearing from Google. That only happens when old URLs suddenly lead nowhere. Here’s how to prevent it:
- Make a list of all your current pages, with their URL, title and description. Search Console shows which pages get traffic.
- Keep URLs the same where you can, and permanently redirect every old URL that changes to its new page (a 301 redirect).
- Bring your text, titles and descriptions with you, and improve them where you can.
- After launch, check Search Console to make sure Google finds everything, and keep an eye on your rankings for a few weeks.
Our advice
We build custom sites, so we’re not neutral. But we are honest: if WordPress fits better with how you work, we’ll tell you. In that case, choose a lightweight theme, as few plugins as possible, good hosting and someone to keep it up to date.
If your site drives revenue, or needs to do more than show information, custom is no longer a luxury in 2026. With us, a custom website starts at €950 one-off plus €50 a month, including hosting, maintenance and support. For everything else a website costs, see our pricing guide.
Frequently asked questions
WordPress itself is: in 2025, only six vulnerabilities were found in the core. The risk is in plugins and themes, where 11,334 new vulnerabilities were found3Patchstack, 2026State of WordPress Security in 2026Open the source. A WordPress site is only as secure as its maintenance: keep plugins to a minimum and update quickly.
Not necessarily. With a proven framework and the right experience, custom no longer has to cost more, and you don’t pay licenses for premium plugins. At Forwarddd, a custom website costs from €950 one-off plus €50 a month, including hosting and maintenance.
Yes. You get an admin area where you change text, prices, packages and photos yourself. The difference from WordPress: you only see what you need, so you can’t break anything by accident.
A system where you manage your content separately from the website that displays it. The website fetches the text and builds the pages itself, which can be faster and more secure. You can use WordPress this way, but also other systems or a custom admin area.
Not if you do it right. Keep URLs the same where you can, permanently redirect every changed URL with a 301 redirect, bring your text and titles with you, and after launch check in Search Console that Google finds everything.
Sources
- 1W3Techs, 2026Usage Statistics and Market Share of WordPress
- 2W3Techs, 2026Usage Statistics and Market Share of Content Management Systems
- 3Patchstack, 2026State of WordPress Security in 2026
- 4HTTP Archive, 2026CMS | 2025 | The Web Almanac by HTTP Archive (Chapter 12)
- 5HTTP Archive, 2026Page Weight | 2025 | The Web Almanac by HTTP Archive (Chapter 14)
- 6WordPress.org, 2026Requirements
- 7W3Techs, 2026Usage statistics of PHP version 8 / PHP for websites
- 8PHP.net, 2026Supported Versions / Unsupported Branches
- 9Cloudflare, 2026500 Tbps of capacity: 16 years of scaling our global network; Cloudflare Global Network
- 10Stack Overflow, 2025Stack Overflow Developer Survey 2025 – Technology
- 11web.dev, 2022How Rakuten 24's investment in Core Web Vitals increased revenue per visitor by 53.37% and conversion rate by 33.13%