WordPress or custom code: which should you choose?

First, a confession. A studio that writes its own code has an obvious interest in telling you WordPress is bad. We'll try to resist. WordPress runs an enormous share of the internet, and for good reason, because in a lot of cases it genuinely does the job. So the real question is which one is better for what you're building. And what it will cost you over three years, not just in the first month.

When WordPress is the right choice

There are situations where we'd recommend WordPress to you ourselves. No point hiding that.

Say you write a lot and publish several times a week. WordPress was built for exactly that. Text editing, categories, authors and archives are already there and working, without anyone writing a line of code. If you need something standard that thousands of sites already have, there's probably a plugin that solves it today rather than in two weeks.

The same goes if the budget is very small and the site is simple. A tidy WordPress site that works beats an expensive project that never gets finished.

Where the real cost hides

Building a WordPress site is usually cheaper. But the cost of ownership, meaning what you pay while you have the site, isn't lower, and you only see that later. We broke down what the price of a site is actually made of in how much a website costs.

• Plugins with an annual licence. Serious plugins for forms, SEO, e-commerce and security are billed every year. Collect five of those and you have a standing cost nobody mentioned in the first quote.
• Maintenance. The core, the theme and the plugins keep getting new versions. If you don't update them, the site becomes vulnerable. If you update them without checking, something occasionally falls apart.
• Conflicts between plugins. Two plugins that each work beautifully on their own can pick a fight with each other. Finding the culprit then becomes work nobody planned for.
• Hosting. WordPress asks more of the server than a static site does, so cheap hosting quickly turns into the bottleneck.

Security: WordPress gets attacked because it's everywhere

WordPress isn't insecure in itself. It gets attacked because it's the most widespread, which makes an automated attack on a known vulnerability simply worth the effort. As soon as a flaw in a popular plugin is published, bots start hunting for it across the whole internet within hours.

For you, that means a WordPress site needs discipline. Regular updates, a limited number of plugins, strong passwords and backups. All of that is doable, but somebody has to keep doing it. Better to agree on it up front than to find out the morning the site refuses to open.

Speed can be measured

A ready-made theme arrives with code for a hundred situations, and you need three. The other ninety-seven ride along on every page load. Then come the plugins, each with its own slice of code, and a simple page can end up pulling a megabyte and a half before anything shows up on screen.

When the code is written for the project, the page carries only what it actually needs. The page you're reading right now paints its main content on a phone in about a second. You don't have to take our word for it. Put our address into PageSpeed Insights and check for yourself.

Whether that difference matters to you depends on the business. For a blog with three posts a month, probably not. For a shop or a booking system, where every visitor who gives up is a lost order, it very much does. Speed, by the way, is also one of the reasons a site does not show up on Google.

When custom code makes sense

Custom code pays off when you need something that isn't standard. At Navy Blue two brands share the same fleet and the same calendar, so a booking on one site has to take the slot on the other one too. There's no plugin for that. At Zov Divljine the search has to know that “štap” and “stap” are the same word. Croatian words carry diacritics, and Croatian shoppers routinely type without them, so an off-the-shelf search would return zero results for the word they actually typed.

The second reason is maintenance in the long run. When the code is yours, a change is just a change. When it belongs to someone else, every change starts with a hunt for the spot where the theme author planned for it. And if they didn't plan for it, you get a workaround that falls apart at the first update.

The third path that rarely gets mentioned

Are you really choosing only between WordPress and building from scratch? Not necessarily. For smaller sites there's also the static web. The pages are generated in advance and served as finished files from a CDN. There's no database to go down and no plugins to update, so attackers have nothing to get hold of. Hosting is close to free and the speed is the best available.

Bigger projects with a catalogue, payments and user accounts need a proper system. We usually use Next.js and PostgreSQL for that. You still edit the content through an interface, it's just that the interface is built around your content instead of being generic. What a project like that involves in scope and price is set out in how much a web shop costs.

So, which one? If you write a lot, your budget is small and you need standard things, WordPress is a sensible decision. If speed, security or some unusual logic affect your revenue, a ready-made platform will cost you more over a few years than it ever saved you. How we approach a build is on the web development page. And if you already have a WordPress site and are wondering what to do with it, there's also redesign or a new website.