WordPress or a custom-built website in 2026: what to choose for a small business

The two approaches in a nutshell

WordPress is a content management system with an admin panel, themes and plugins. According to W3Techs (data as of November 6, 2026), it powers 39.5% of all websites and 58.2% of websites whose content management system could be identified. It is the most popular tool of its kind in the world.

A custom website is code written for a specific project. One example is Next.js in static export mode: the build produces ready-made HTML, CSS and JavaScript files which, according to the Next.js documentation, can be hosted on any web server that serves static files. There is no database and no login panel, and content is changed in the code or in a connected editing tool.

When WordPress is the better choice

WordPress wins where independence and ready-made solutions matter:

• You want to change content yourself often: add posts, news, photos, a price list. The WordPress dashboard is familiar to many people and requires no coding.
• You are planning a store with many products. WooCommerce is a full-featured store plugin with payments, shipping and integrations, proven in a huge number of shops.
• You need common features that exist as plugins: forms, multiple languages, a newsletter, simple bookings. A ready-made plugin is usually cheaper than a feature written from scratch.
• You want to be able to find someone else to look after the site easily in the future. There are a great many WordPress specialists.
• Hosting is simple: standard hosting with PHP and a database is enough. WordPress recommends PHP 8.3 or newer, MySQL 8.0 or MariaDB 10.11 or newer, and HTTPS support.

When a custom website is the better choice

A custom-built website has the edge when speed, security and unusual features matter:

• Speed: the browser loads only what is needed, without theme code and a dozen plugins. That makes good Core Web Vitals results easier to achieve.
• Security: a static website has no database, no login panel and no plugins, which means fewer places someone can attack.
• Unusual features: calculators, configurators, interactive presentations, integrations with external systems. A custom build does exactly what you need instead of stitching several plugins together.
• Your own visual design, without the limits of a ready-made theme.
• Content that rarely changes: a service website, a landing page, a business card site.

There are limitations too: changing content usually requires a developer or a separate editing tool that has to be planned from the start. According to the Next.js documentation, static export does not support features that need a server, such as Server Actions or server-side cookies, so a contact form, for example, needs a separate script or service.

Security: what the data says

The most common criticism of WordPress is security. Patchstack's “State of WordPress Security in 2026” report (updated February 25, 2026, covering 2025) shows where the risk really comes from:

• In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than in 2024.
• 91% of them were in plugins and 9% in themes. Only 6 vulnerabilities were reported in WordPress core itself, all of them low priority.
• 46% of vulnerabilities did not receive a fix from the developer before public disclosure.
• For the most heavily targeted vulnerabilities, the first exploit attempts came within hours of disclosure: the median time, weighted by attack intensity, was 5 hours.

The takeaway is simple: WordPress itself is well maintained, and the risk grows with every plugin. A secure WordPress site means few plugins from active developers, regular updates and backups. According to the WordPress documentation, minor core updates, including security fixes, install automatically, and automatic updates for plugins and themes can be turned on. Before bigger updates the documentation recommends a backup.

A static website doesn't have these problems, but it isn't maintenance-free either: it is worth updating libraries whenever the site is rebuilt, and the hosting and contact form have to be configured properly.

Speed and Core Web Vitals

Core Web Vitals are three Google metrics measured with real users: LCP (loading the main content) should happen within 2.5 seconds, INP (response to a click) should be no more than 200 milliseconds, and CLS (layout shifting) no more than 0.1. What counts is the result for 75% of page loads, measured separately on mobile and desktop.

Google states plainly that Core Web Vitals are used by its ranking systems, but good results don't guarantee top positions, and Search always tries to show the most relevant content even if the page experience is not ideal. Speed helps, but it won't replace good content.

According to the CMS chapter of the 2025 Web Almanac (HTTP Archive, published January 15, 2026), 45% of WordPress sites pass Core Web Vitals on mobile, which puts it among the lowest-ranked systems. The same report notes, however, that WordPress performance variance is driven more by configuration than by limitations of the platform itself. A well-built WordPress site with a lightweight theme and a few plugins can be fast; a heavy page builder with dozens of add-ons usually isn't.

Maintenance and update costs

Hosting and plugin prices vary widely, so instead of amounts, here is what you pay for in each case:

• WordPress: hosting with PHP and a database, a domain, regular updates to core, the theme and plugins, backups, licenses for paid plugins (often renewed yearly) and time to check that everything still works after an update.
• A custom website: a domain and hosting, which can be simpler, since a server that serves static files is enough. Fewer ongoing updates, but every change to content or features usually means developer work, unless an editing tool is connected from the start.
• In both cases: make sure you have access to the hosting, the domain and the code or a copy of the site. For a custom website, ask for the code repository and short documentation so that someone else can take over in the future.

How to decide

Answer four questions:

• How often will you change content yourself? Every week: WordPress is the safer bet. A few times a year: a custom website will work well too.
• Do you sell many products online? Yes: WooCommerce or a ready-made e-commerce platform. A few products or services: a simpler solution is enough.
• Do you need an unusual feature that ready-made plugins don't offer? Yes: a custom website.
• Who will take care of updates and backups? If nobody, choose the solution with the fewest moving parts to update.

I build websites both on WordPress and custom-built, and the choice depends on how you will use them. A landing page usually takes about a week, a multi-page website about 2 weeks, and an online store about 3 weeks. If you describe in the contact form what you want to edit yourself and which features you need, I'll suggest which option fits your business.

Frequently asked questions