Should you use WordPress for your website, and what to consider instead

Ask ten web developers how to build a business website, and nine will tell you to install WordPress.

Do not take that as gospel.

WordPress powers roughly 40% of all websites, which sounds like an overwhelming endorsement until you realise it grew to that share by giving non-technical writers an easy way to publish essays on the internet without learning HTML. If you run a digital newspaper with forty staff journalists publishing ten breaking stories an hour across twelve editorial desks, WordPress is still an impressive engine for that specific task.

For a local firm, it is usually overkill.

Running an entire dynamic database server for a five-page plumbing or legal firm creates problems you never asked for. You end up babysitting security alerts. You pay for specialised hosting. And every single update brings the quiet risk that your contact form might stop delivering enquiries.

Before you buy a WordPress site, or pay to rebuild your current one, look at how the technology actually behaves.

Where WordPress succeeds

WordPress became famous because it solved genuine publishing headaches.

It worked.

Need an obscure booking calendar, a mortgage calculator or a photo slider? Someone in the community has probably written a plugin for it, published it to the directory, and made it available for anyone to install in a few clicks. You do not have to write a line of code, and you change a few settings at most.

It gives editorial teams granular user roles. Editors can draft articles, proofreaders can check copy, and administrators can schedule publications. It handles deep media libraries with ease.

If your daily business depends on churning out articles, WordPress does the job well.

The trouble starts when you use that same architecture for a simple company website that rarely changes and occasionally posts a blog article.

Security risks, plugins and the five-hour attack window

Most business owners assume keeping WordPress safe means logging in once a month to click update.

The data says otherwise.

The core WordPress software is stable, with only six vulnerabilities discovered across the entire codebase in 2025. The problem is the precarious tower of third-party plugins and commercial themes you have to install just to turn that bare blogging engine into a credible business website.

In their State of WordPress Security in 2026 report, security researchers at Patchstack catalogued 11,334 new vulnerabilities across the WordPress ecosystem in 2025 alone, representing a staggering 42% surge in a single year.

91% of those security flaws lived in plugins, and another 9% percent lived in themes.

How do they find victim websites?

Automated bots do not target you personally. They scan millions of IP addresses across the internet day and night, probing known plugin file paths to find any server that has fallen behind on updates. Patchstack found that the weighted median time from a vulnerability’s public disclosure to the first exploit was just five hours.

Worse still, 46% of disclosed vulnerabilities had no patch available from the plugin developer when they were published.

Five hours.

If a bot discovers an unpatched gallery plugin on your server at two in the morning, it does not wait for your scheduled maintenance window. Because WordPress runs your database, your uploaded media files and your application server on a single machine, an exploit in one abandoned contact form plugin can expose your enquiries and the customer details stored with them.

The maintenance treadmill and update anxiety

To make WordPress function as a commercial website, web builders assemble a patchwork of software.

One plugin handles your contact form. Another handles search engine metadata. Then you add separate plugins for image optimisation, caching, spam filtering, analytics, fonts, and off-site backups.

Within a few months, your modest five-page brochure site depends on twenty separate software packages written by twenty different strangers who never spoke to each other or tested their code together. Update notices arrive every week, and any one of them can break your design or switch off your contact form without warning. Our analysis of why cheap websites fail small businesses shows how often unseen form failures quietly destroy customer enquiries.

Small firms end up trapped.

Either you pay for a care plan, or you leave the site alone and hope an automated bot does not take it down. UK WordPress care plans start at about £30 to £50 a month for updates and backups, and run to £150 a month or more once they include developer time each month.

Why dynamic websites struggle on mobile phones

Speed is not an aesthetic choice. It decides whether you get the job.

When Google studied more than 10 million visits to Renault’s websites, a page whose main content appeared one second sooner went with a 13% rise in completed lead forms.

WordPress operates as a dynamic monolith.

When a prospective customer taps your link on their smartphone from a local Google search, your web server has to start from scratch, parsing PHP files, executing dozens of SQL queries against a MySQL database, stitching page templates together, and generating raw HTML before sending the first byte of data back across the network.

On budget shared hosting, that server processing creates noticeable lag.

Visual page builders such as Elementor and Divi make the drag worse by generating thousands of lines of bloated code, heavy stylesheets, and render-blocking scripts that choke mobile processors.

The performance figures are damning. The HTTP Archive Web Almanac, built on real Chrome user data, found that only 40% of WordPress websites passed Google’s mobile Core Web Vitals assessment in 2024. Six in ten WordPress websites fail Google’s benchmark for an acceptable mobile experience.

That failure harms your local search visibility and costs you customers.

What are the alternatives?

The web has changed a lot in the last five years. You no longer need a live database and a public PHP server to show your phone number, list your services, take enquiries and display recent reviews.

Three paths now exist.

1. Hosted website builders (Squarespace, Wix, Webflow, Framer)

For business owners who want to avoid developers entirely, hosted platforms make an appealing promise, because the platform company manages server security, applies software patches and runs the infrastructure for you. You never have to spend a Sunday morning recovering a broken MySQL database or pay someone to do it for you.

The catch is that hosted builders solve maintenance by taking away flexibility, control and your time.

First, their add-on ecosystems are small next to WordPress. The WordPress directory lists over 74,000 free plugins. The Wix App Market has about 800 apps, the Webflow marketplace about 400, and Squarespace Extensions about 50. The gap is huge. If you need a niche trade merchant integration, a bespoke deposit calculator or custom booking rules, the WordPress directory probably has it. The moment your business needs something unusual on a hosted builder, you hit a wall.

Second, the learning curve catches people out. Marketing campaigns promise a finished website in an afternoon, but real builds are messy. Simpler tools like Wix and Squarespace become rigid when you try to change a template’s structure, and moving a block often breaks the mobile layout. Advanced tools like Webflow and Framer offer visual freedom, but they are professional design environments built on CSS box models and flexbox. For a non-technical business owner, that turns a DIY weekend build into three weeks of wrestling with padding and mobile overflow.

Finally, you face lock-in and a monthly bill that never ends. A plan with your own domain costs about £10 to £30 a month with VAT, paid annually, at Wix, Squarespace and Framer. You pay it for as long as the site is live, and if the price rises, you cannot take the site to another host. Webflow lets you export the code on a paid Workspace plan, but the export leaves out your CMS content, forms and site search.

2. AI-generated and self-built websites

Tools such as v0, Lovable and Bolt, alongside coding assistants like Claude, Codex, Antigravity and Cursor, can now generate a website layout from a single text prompt.

The results look impressive for the time spent. Generating code is not the same as running a business website, though, and the gap shows up the week after launch.

An AI generator can sketch a good-looking layout in minutes, but it does not configure your domain’s DNS records or set up the email authentication records (SPF, DKIM and DMARC) that help your notifications and newsletters reach customer inboxes. Nor does it stress-test your quote forms, add the structured data that Google Maps reads, or check accessibility. When a connected service changes or a form breaks, a prompt will not step in to fix it. More importantly it doesnt host it, configure SSL and maintain it for you.

Code generation is quick. A dependable business website still needs someone to engineer and look after it.

3. Pre-built pages, with an editor only when you need one

This approach takes the live server out of the picture. Instead of assembling each page when a visitor taps a link, a framework such as Astro builds every page once, ahead of time, into plain HTML, CSS and compressed images. Those files sit on an edge network such as Cloudflare, Vercel or Netlify, which copies them to data centres around the world.

First, the WordPress attack surface goes away. The bots that probe for WordPress plugin flaws look for a PHP runtime, a database and a /wp-login.php page, and a pre-built site has none of the three, so those scans come back empty.

Second, the pages are fast. A visitor’s phone receives a finished file from a data centre close to them, so the page appears almost as soon as it is tapped. A well-built static site usually passes Google’s Core Web Vitals without caching plugins.

Third, plugin maintenance stops. Pages change only when someone changes them on purpose, so an overnight update cannot break your layout or switch off your contact form.

Finally, you can move. The site is standard HTML, CSS and JavaScript that any host can serve, so if your host raises its prices or its service gets worse, moving it means a redeploy rather than a rebuild.

How, then, do you change your opening hours or add a new service or change your phone number?

There are two answers. If you change your site a few times a year, you find any developer with html/css experience and they change it for you in 5 minutes. If you want to edit pages yourself, the site gets a content editor (CMS) that publishes to the same pre-built pages.

EmDash is one such editor. Cloudflare built it on Astro and TypeScript as a modern successor to WordPress, and from its first release keeps the visual dashboard that non-technical users value while rebuilding the security model underneath it. Instead of giving plugins full access to your server, EmDash runs each plugin in its own sandbox, where it can touch only what it declared and you approved before it installed. That greatly reduces the supply-chain risk that comes with traditional WordPress add-ons.

For sites with a lot of structured content, such as a services catalogue or a library of case studies, a headless CMS such as Sanity keeps the content in a separate store and rebuilds the pages when you press publish. The public site does not talk to the content store, so a bot that reaches your website finds no login page and no database behind it. This blog runs on Sanity.

---

The bottom line

Should you use WordPress for your website?

If you run a media brand, employ editors and publish several articles a day, yes. In that world, paying for strong hosting, regular security audits and dedicated maintenance makes commercial sense.

If you run a local service business, a trades company or a professional consultancy, usually not.

You do not need a database server and twenty plugins to present your services and collect quote requests. Pre-built pages give you fewer ways in for attackers, fast mobile pages and an end to plugin updates. When you want to change a page yourself, an editor such as EmDash or Sanity sits beside the site, and when you would rather not, you send the change and it is done for you.

That is how we build. We can build on WordPress when a project needs it, but we choose it last.

In an upcoming article, we will review the leading modern alternatives in detail, testing build costs, running expenses and the day-to-day editing experience across hosted platforms, headless setups and pre-built sites.

If you want a dependable site without the WordPress maintenance burden, see our website design packages for small businesses and our website care plan.