WordPress or a custom-built website — how to decide?

The choice between WordPress and a custom-built site is a business decision, not a technical one. It depends on who will edit the site, what it has to do, and how much maintenance you are willing to pay for. Below are the three questions we hear most often, each with a direct answer. We build both, custom sites on Astro + Cloudflare and WordPress/WooCommerce through AgenticWP, so we have no reason to sell you one path over the other.

When is WordPress the right choice for a small business?

WordPress is the right choice when you edit a lot of content yourself, daily, when you need an online shop (WooCommerce), or when your team already knows WordPress and does not want to switch. The advantage is not the build price but the ecosystem: more than 60,000 plugins cover almost any feature without development.

Cases where WordPress wins:

• An online shop with dozens or hundreds of products. WooCommerce has payments, shipping, taxes and invoices solved. Building that from scratch means months of work.
• A blog or portal with several authors. Editorial workflow, roles, revisions and a media library are built in.
• A marketing team that builds its own landing pages. Elementor or Gutenberg blocks are enough to avoid waiting for a developer.

The price of that advantage is maintenance. The core, the theme and every plugin need regular updates. With 20 plugins that is 20 separate sources of risk. Most WordPress breaches go through an outdated plugin, not the core.

When is a custom-built website worth it?

A custom-built site is worth it when the site is mainly a presentation (services, company, contact, a few dozen pages), when speed and security matter to the business, and when you want near-zero running costs. A static site on Cloudflare has no server to break into, no database to steal, and no plugins to update.

What you get in practice:

• Sub-second load times on mobile networks, because the HTML is built ahead of time and served from the edge. Lighthouse 100/100 is the baseline.
• Attack surface close to zero. No PHP, no /wp-admin login form, no SQL. There are no security updates because there is nothing to update.
• Hosting that is practically free. Cloudflare Pages does not charge for traffic on static sites.
• Content editing of your own. News, projects and products are edited through an admin backed by a database (D1), not by editing code. The site you are reading works exactly this way.

The downside: every new feature is development, not a click on "Install plugin". If you need a booking system in six months, it has to be built or connected to an external service.

Is WordPress secure?

WordPress is as secure as it is maintained. The core has a security team and fast patches; the risk comes from third-party plugins and themes. An example from our news: a CVSS 10.0 vulnerability in the WooCommerce Wishlist plugin allowed unauthenticated file uploads. Nothing was wrong with the core, but the plugin had over 100,000 installs.

The minimum standard for a secure WordPress:

1. Automatic updates for core and plugins, with a staging environment to verify an update breaks nothing.
2. Fewer plugins. Remove every plugin you do not actively use; do not just deactivate it.
3. Two-factor login and a renamed or restricted /wp-admin.
4. Daily off-server backups with a tested restore procedure.
5. A WAF in front of the site (Cloudflare or equivalent) and XML-RPC blocked if you do not need it.

If neither you nor your contractor will do this, a custom-built site is more secure by default. Not because of better code, but because those five chores do not exist on it at all.

Decision table

Your situation	Recommendation
Presentation site, up to a few dozen pages, rare changes	Custom (Astro + Cloudflare)
Online shop with payments, shipping and stock	WordPress + WooCommerce
Blog or portal with several authors and daily posts	WordPress
Speed, security and low costs are a business requirement	Custom
Team already runs WordPress and will not switch	WordPress (with a maintenance contract)
Site will connect to AI agents, MCP or your own APIs	Custom, or WordPress with AgenticWP
Nobody available to take care of updates	Custom

How to proceed

If you recognise yourself in the "custom" rows, the next step is the website project brief: 11 short steps, and a scope proposal with an indicative price within one business day. If you need WordPress or WooCommerce, AgenticWP connects your existing site to AI agents without replacing it. Either way, the conversation starts with what the site has to do.