A director at a Midlands logistics firm called us last month. Their WordPress site had been hacked for the third time in eighteen months. The previous developer had disappeared, and now they had Japanese text in their Google listings and a warning screen when customers tried to visit. They asked: should we rebuild in WordPress again, or is there another way?
This question comes up constantly. WordPress runs a huge portion of the web. It has thousands of plugins, themes for every industry, and a vast community. For many businesses, it's the default choice. But for others, it's the wrong tool entirely, and the costs of that mismatch compound over time.
We build custom websites for UK small businesses, so we're not neutral here. But we also know WordPress has its place. The question isn't which is objectively better. It's which is better for your specific situation, and how to make that call without getting burned.
What WordPress actually is
WordPress started as blogging software in 2003. Over two decades, it evolved into a content management system that can run almost anything, from a simple brochure site to a complex e-commerce platform. The core software is free and open source. You install it on a web host, choose a theme (the visual design), add plugins (extra features), and edit content through an admin dashboard.
The appeal is obvious. You don't need to code. You can add a contact form, image gallery, or booking system by installing a plugin. Thousands of designers offer WordPress services. If your developer vanishes, finding a replacement is relatively straightforward.
But WordPress's flexibility comes with architectural costs. The system loads dozens of files on every page request, queries the database multiple times, and processes PHP code to assemble the HTML your visitor sees. Themes and plugins can clash. Security updates are frequent, and skipping them is risky. Many plugins are abandoned by their authors or harbour vulnerabilities.
For some businesses, these trade-offs are fine. For others, they're a slowly tightening noose.
When WordPress makes sense
If you're a local business that needs a simple five-page website with a blog and a contact form, WordPress is probably the right choice. The setup cost is low, the editing interface is familiar, and you can hand it off to a local developer for updates.
If you publish content frequently and need multiple non-technical people to add pages, blog posts, or portfolio items, a CMS like WordPress handles that well. The dashboard is designed for editors, not engineers.
If your budget is tight and you need something live quickly, a well-configured WordPress site can go up in a week or two. There's a plugin for almost everything, and while quality varies, the ecosystem is genuinely vast.
If you anticipate changing your site structure often or experimenting with new features regularly, the plugin system offers a kind of flexibility. You can bolt on a members area, e-commerce, or a booking calendar without rebuilding from scratch.
But notice the caveats in each of those scenarios. Simple site. Low budget. Frequent content updates by non-technical staff. These are specific conditions, not universal truths.
When WordPress becomes a liability
We rebuilt a site last year for a Surrey-based training provider. Their WordPress installation had 47 plugins. Forty-seven. Each one added weight. Each one was a potential security hole. Each one had its own update schedule. The site took eleven seconds to load the homepage on a mobile connection. Their bounce rate was appalling, and their Google rankings had tanked after a core update that punished slow sites.
The core problem wasn't WordPress itself. It was that WordPress had been asked to do something it wasn't designed for. The business needed a fast, secure platform to handle course bookings, student accounts, and integration with their CRM. Instead, they'd layered plugin on top of plugin until the whole thing groaned under its own weight.
This pattern repeats. A business starts with a simple WordPress site. They add e-commerce via WooCommerce. Then a membership plugin. Then a form builder, an SEO plugin, a caching plugin to fix the slowness caused by the other plugins, a security plugin to patch vulnerabilities in the other plugins. At some point, the site crosses a threshold where maintaining it costs more than rebuilding it properly would have.
Speed is the most common casualty. WordPress sites can be fast, but making them fast requires careful configuration, aggressive caching, image optimisation, and restraint with plugins. Most small businesses don't have the technical resource to maintain that discipline. A typical WordPress site scores poorly on Google's Core Web Vitals, and since page speed is a ranking factor, that directly impacts visibility.
Security is the second casualty. WordPress core is reasonably secure if kept updated, but plugins are a different story. Vulnerabilities are discovered constantly. If you run ten plugins, you're trusting ten different codebases, often from solo developers or small teams. One bad plugin can compromise your entire site. The logistics firm we mentioned earlier had been hacked through an outdated plugin they didn't even know they had installed.
Maintenance is the third. WordPress requires regular attention. Core updates, plugin updates, theme updates, PHP version updates on your hosting, database optimisation, broken plugin conflicts after updates. For a small business without in-house technical resource, this becomes a recurring expense or a recurring risk.
What a custom build actually means
When we talk about a custom website, we mean code written specifically for your business, not assembled from a theme and plugins. The structure, the features, the backend, everything is built to your exact requirements.
This doesn't mean reinventing the wheel. We use modern frameworks and libraries that handle the standard web infrastructure, so we're not writing every line from scratch. But the site's logic, design, and features are yours alone.
A custom build is faster because it only loads what it needs. There's no theme bloat, no unused plugin code, no database queries to fetch options you'll never change. A typical custom site we build scores 95+ on Google PageSpeed Insights out of the gate, with no caching plugins or complex optimisation required.
It's more secure because there's less attack surface. No plugin directory, no thousands of known exploits, no public admin login page. The codebase is small, auditable, and under our control.
It's easier to maintain in the long run because changes are deliberate. If you need a new feature, we build it properly, integrated with the rest of the system. There's no praying that a plugin update won't break your checkout flow.
The trade-off is upfront cost and time. Custom development takes longer and costs more initially. And you need to trust your developer, because you can't easily take a custom site to a random WordPress agency.
The real cost comparison
A basic WordPress site might cost £1,000 to £3,000 to set up. Hosting is cheap. Ongoing maintenance might be £50 to £200 per month if you're diligent, or nothing if you're not (until something breaks).
A custom build might cost £5,000 to £15,000 depending on complexity. Hosting is similar. Ongoing maintenance is lower because there are fewer moving parts, but you're more dependent on your original developer.
On paper, WordPress looks cheaper. But that initial saving can evaporate fast.
If your WordPress site gets hacked, remediation costs £500 to £2,000 depending on severity. If you need to migrate to a different hosting provider, expect complications and costs. If a plugin conflict breaks your site the day before a product launch, you're at the mercy of finding someone who can fix it quickly.
If your site is slow and your Google rankings suffer, the opportunity cost is harder to quantify but potentially much larger. How many customers never found you because you were on page three instead of page one?
A custom build front-loads the cost. You pay more upfront, but the total cost of ownership over three to five years is often lower, especially once you factor in lost opportunities from poor performance or downtime.
The content management question
The most common argument for WordPress is: "But we need to edit content ourselves." This is a reasonable concern, and it's where WordPress's dashboard genuinely shines.
But it's also worth examining the assumption. How often do you actually need to edit content? Many small businesses update their site quarterly at most. For a few tweaks per year, emailing changes to your developer is simpler and safer than maintaining an entire CMS with its security and maintenance overhead.
If you do need frequent updates, there are alternatives to WordPress. Headless CMSs like Sanity or Contentful give you an editing interface without the WordPress baggage. We can integrate one into a custom frontend, giving you the best of both worlds: a fast, secure custom site with an editor-friendly backend.
Or we can build a simple custom admin panel for the specific content you need to change. If you only ever edit your opening hours, team bios, and blog posts, a tailored admin that handles exactly those three things is simpler and more secure than a general-purpose CMS with thousands of features you'll never use.
Making the decision for your business
Start with your actual requirements, not assumptions about what you might need someday.
Do you need five pages or fifty? A contact form or a complex booking system? Are you selling products? Do multiple people need to edit content weekly, or are updates rare?
Is speed critical to your business? If you rely on Google rankings, if you're in a competitive market, or if your customers are impatient (which is everyone), then speed matters. A slow WordPress site will cost you customers.
What's your risk tolerance for downtime and security issues? If your website is business-critical, if downtime means lost revenue, if a security breach would damage your reputation, then the lower maintenance burden of a custom build has real value.
What's your realistic budget over three years, not just today? A £2,000 WordPress site that needs £200/month maintenance and a £2,000 emergency fix after a hack costs £9,200 over three years. A £7,000 custom site that needs minimal maintenance costs £7,000 over three years.
Do you have an ongoing relationship with a developer you trust, or will you be shopping around for help whenever something breaks? WordPress's advantage is the large pool of available help. A custom site needs a developer who knows the codebase, which usually means sticking with whoever built it.
The middle ground: static sites
There's a third option that doesn't get enough attention. For businesses that need a fast, secure site without frequent content changes, static site generators offer a compelling middle ground.
A static site is pre-built HTML files served directly, with no database, no PHP, no server processing. It's as fast as the web gets. It's inherently secure because there's no dynamic code to exploit. Hosting costs pennies.
The trade-off is that updating content requires regenerating the site, which usually means a developer. But for many small businesses, that's fine. Your services don't change weekly. Your team page updates quarterly. Your blog posts can be added through a simple workflow.
We've built static sites for professional services firms, tradespeople, and consultants. They get the speed and security benefits of a custom approach at a lower cost, because there's less infrastructure to build.
What we actually recommend
For most of the UK small businesses we work with, a custom approach makes more sense than WordPress. Not because WordPress is bad, but because the businesses that come to us have usually been burned by slow, complicated, or insecure WordPress sites, and they're looking for something better.
If you're a local business with simple needs and a tight budget, WordPress is fine. Find a good local developer, keep your plugin count low, stay on top of updates, and use a quality host. You'll probably be okay.
But if your website is a core part of how you do business, if speed and reliability matter, if you're tired of maintenance headaches and security scares, a custom build will serve you better. The upfront cost is higher, but the long-term value is clearer.
The worst outcome is drift. Starting with WordPress because it's familiar, adding complexity over time, ignoring the mounting problems until a crisis forces a decision. By then, you've spent thousands on maintenance and lost opportunities to slow performance, and you still need to rebuild anyway.