WordPress
WordPress builds you can actually maintain.
WordPress runs a large share of the web because it is flexible and inexpensive to start with. The same flexibility is why so many WordPress sites end up slow, fragile and impossible for anyone but the original developer to touch.
Is WordPress still the right choice for a business website?
For most content driven business sites, yes. It handles a large number of pages well, the editing experience is familiar, it has mature structured data and SEO tooling, and you are not locked to one vendor's hosting or export policy.
The trade-off is maintenance. WordPress sites need updates, backups, monitoring and security hardening, and a site left alone for a year becomes both slow and vulnerable. That is an ongoing cost, not a one time one.
It is the wrong choice when the site is small and static, where a hosted builder is simpler, or when the requirement is really an application rather than a website.
Why WordPress sites go wrong
Almost every problem we are asked to fix on a WordPress site traces to the same root cause: it was built by assembling plugins rather than by making decisions, and nobody owned the consequences.
A purchased theme brings features for every possible business, most of which you do not use, all of which load. A page builder adds a layer of markup between your content and the browser. Each plugin adds its own scripts and styles to every page, whether that page uses the plugin or not. Twenty plugins later the site takes six seconds to become usable and nobody can say which one to remove.
The security picture has the same shape. Most WordPress compromises are not clever attacks on WordPress itself. They are automated exploitation of an abandoned plugin that stopped being updated three years ago and stayed installed.
None of that is an argument against WordPress. It is an argument for building deliberately and maintaining it, which is exactly what the cheapest builds skip.
The page builder question, honestly
Page builders let a non-developer arrange a page visually. That is a genuine benefit and it is why they are everywhere. It is worth understanding what it costs.
The output is heavier. A builder generates nested markup and loads its own stylesheets and scripts to render what a custom template would produce with a fraction of the weight. On a fast connection you will not notice. On a phone on a weak signal you will, and so will your Core Web Vitals.
Read the full breakdown: The page builder question, honestlyHide the full breakdown: The page builder question, honestly
It is also a lock-in. Content built inside a builder is stored in that builder's format. If you ever remove it, the pages do not gracefully degrade, they break, and the migration is a rebuild.
Our default is a custom theme built on the block editor, which is the editing experience WordPress itself now ships, with a small number of well chosen blocks. You get visual editing, you get clean markup, and you are not tied to a third party plugin for the existence of your content.
Where a client already has a builder based site and it works, we will say so rather than recommending a rebuild for its own sake. The honest question is whether the site is actually costing you anything today.
How a build is actually put together
The distinguishing feature of a maintainable WordPress site is how few moving parts it has.
Decide what the site has to do, then pick the minimum to do it
Every plugin is a permanent dependency with a security surface and a performance cost. A site that needs forms, SEO controls, caching and backups needs roughly four plugins, not twenty four.
Build a custom theme rather than buying one
A theme written for your site contains only what your site uses. A purchased theme contains everything every possible buyer might want. The difference shows up in page weight and in how difficult it is to change anything later.
- Templates for the page types you actually have
- Reusable blocks for the patterns that repeat
- No demo content, sliders or features nobody asked for
Make it editable without being fragile
Text, images, staff, hours and service pages should all be editable by you without a developer. Structural change should require one. A site where anyone can accidentally break the layout is not more empowering, it is just less reliable.
See the remaining steps: How a build is actually put togetherHide the remaining steps: How a build is actually put together
Build to a performance budget from the start
Image handling, font loading, script count and layout stability decided during the build rather than retrofitted. Retrofitting speed onto a finished WordPress site is substantially more expensive than building it in.
Harden it before launch
Administrator accounts limited and named, file permissions set correctly, the login endpoint protected, unused themes and plugins removed rather than deactivated, and automatic updates configured for security releases.
Set up the things that save you later
Automated off-site backups that have been tested by restoring one, a staging environment for changes, uptime monitoring, and a documented list of what is installed and why.
The documented list is worth more than it sounds. The most common state we inherit is a site where nobody knows what any given plugin is for.
The performance bar the build has to clear
Google publishes these thresholds and reports your site against them from real visits in Search Console. They apply to a WordPress site exactly as they apply to any other.
SourceCore Web Vitals thresholds, Google (web.dev)
A heavily plugin dependent WordPress site frequently fails Interaction to Next Paint in particular, because the accumulated JavaScript keeps the main thread busy when somebody taps.
Signs a WordPress site is heading for trouble
You can check most of this yourself from the WordPress dashboard in ten minutes.
- More than about ten active plugins, or any plugin nobody can explain the purpose of.
- Plugins with an update available that has been available for months.
- Plugins marked as untested with your version of WordPress, or no longer maintained by their author.
- Several administrator accounts, including ones belonging to people who no longer work with you.
- A username of admin, which is the first guess in every automated attack.
See the full checklist: Signs a WordPress site is heading for troubleHide the full checklist: Signs a WordPress site is heading for trouble
- No backups, or backups stored on the same server as the site, which protects you from nothing.
- No staging environment, so every change is made on the live site.
- A purchased theme that has not been updated since it was bought, which is a common source of vulnerabilities.
- A page builder plus a theme builder plus a separate slider plugin, all loading on every page.
The backup item is the one worth acting on today. Untested backups are the same as no backups, and the test is simply restoring one somewhere safe.
WordPress against the alternatives
We will recommend the cheapest option that meets the requirement, including options that are not this one.
| Item | Better when | Worse when |
|---|---|---|
| WordPress, custom theme | Content heavy, many pages, needs to rank | Nobody will maintain it |
| Hosted site builder | Small, mostly static, launched quickly | You need control over speed and markup |
| Shopify | Selling physical products | The site is mostly content |
| Custom framework build | Performance or bespoke functionality is the point | You want to edit structure yourself |
If a hosted builder genuinely fits what you need, we will tell you so rather than selling you a build you do not require.
Moving to or from WordPress without losing rankings
Most ranking losses at launch are migration failures rather than design failures, and nearly all of them are preventable.
Before anything is built, there should be a written map of every existing URL that has traffic or inbound links, and where it will go on the new site. Pages that are being merged need a redirect to the page that absorbed them. Pages being retired need a redirect to the most relevant remaining page, not to the home page.
Content matters as much as URLs. A redesign that halves the word count on every service page in the name of a cleaner look will lose rankings, and the cause is rarely diagnosed correctly afterwards.
After launch: verify every redirect resolves in one hop, re-submit the sitemap, watch index coverage for a few weeks, and compare field performance data against the old site rather than assuming the new one is faster.
What we need from you
Access to the domain registrar, the current hosting and the existing site. Recovering a domain from a previous developer is the most common launch delay and it is entirely avoidable by starting early.
Content decisions and real material: services, hours, service area, named staff with credentials, and photographs of the actual premises and team.
Read the full breakdown: What we need from youHide the full breakdown: What we need from you
One person who can approve. Review by committee is the single largest cause of a doubled timeline.
A decision about maintenance. A WordPress site without ongoing updates, backups and monitoring will eventually be slow, broken or compromised, and pretending otherwise at the point of sale is how sites end up abandoned.
We do not publish a price for this piece of work on its own, because the right scope depends on what already exists. What is published is the bundle pricing: 2,400, 3,600 or 4,800 dollars a month depending on which channels are running. You can read the full breakdown on the pricing page, and you will get an exact number in writing before anything starts.
How this connects to the rest
This is one route through our web design and development work, alongside Shopify for stores and targeted fixes for sites that do not need rebuilding.
Technical SEO overlaps heavily here, because most of what makes a WordPress site rank or fail to rank is decided during the build rather than afterwards.
Website care and hosting is the ongoing half of this. A build without a maintenance plan is a decision to let the site degrade.
Speed optimisation and accessibility are built in rather than added later, because retrofitting either onto a finished WordPress site costs considerably more than doing it during the build.
Find out whether you need a rebuild or a cleanup.
A lot of WordPress sites need four plugins removed, a caching layer and a redirect map rather than a new site. We will tell you which one you are looking at.
Straight answers.
Do I own the site?
Yes. The domain, the hosting, the files and the database are yours throughout, and you can move them without our permission.
That is worth confirming in writing with any developer before a project starts, not after a disagreement.
Should we use a page builder?
It depends on how much you want to edit and how much speed matters to you. Builders make visual editing easy and cost you page weight and portability.
Our default is a custom theme on the block editor, which gives visual editing without tying your content to a third party plugin.
How many plugins is too many?
There is no fixed number, and if nobody can explain what each one does, you have too many. Most business sites need forms, SEO controls, caching, backups and security, which is around five.
Every plugin is a permanent dependency with a security surface and a performance cost.
Will my WordPress site get hacked?
Most compromises are automated exploitation of outdated plugins and themes rather than targeted attacks. A site kept updated, with limited administrator accounts and a protected login, is a much harder target.
Off-site backups that have actually been tested are the difference between a bad afternoon and a bad month.
Can I edit it myself?
Text, images, staff, hours and service pages, yes, and we record a walkthrough so you can rewatch it.
Structural change is development work. A site where anyone can rearrange the templates is not more empowering, it is less reliable.
How long does a WordPress build take?
It depends on page count and far more on how quickly content and approvals come back. You get a page count, a timeline and a launch date in writing before we start.
The parts we control are predictable. The parts you control are where projects slip.
Where this comes from.
Primary documentation and published research behind the guidance on this page.
- WordPress.org documentation (opens in a new tab)
- Hardening WordPress, WordPress.org (opens in a new tab)
- Core Web Vitals, web.dev (opens in a new tab)
- Google Search Console Help (opens in a new tab)
- OWASP Top Ten web application security risks (opens in a new tab)
- Securing your site with HTTPS, Google Search Central (opens in a new tab)
Talk to the team
A short call, a look at how the business currently shows up, and a straight answer on what we would do first.