WordPress is the platform that everyone has an opinion about and almost nobody has a nuanced opinion about. WordPress evangelists will tell you it runs 40% of the web and nothing else comes close. WordPress critics will tell you it's a slow, vulnerable mess held together by questionable plugins. Both are partly true.

For an Australian small business trying to decide between WordPress and a custom-coded site, the question isn't which camp is right. It's which one applies to your specific situation. This post is the honest comparison.

What WordPress actually is

WordPress started as a blogging platform and grew into a general-purpose CMS. It has three parts:

WordPress Core — the base software that handles pages, posts, users, and the admin interface
Themes — the visual design layer, which determines what the site looks like
Plugins — third-party extensions that add features (contact forms, e-commerce, SEO, security, analytics)

A "WordPress site" is always a combination of those three. The quality of the result depends entirely on which theme and which plugins are used, which is why two WordPress sites from two different agencies can look and perform completely differently.

The case for WordPress

WordPress isn't the wrong answer in every situation. Legitimate reasons to use it:

You need hundreds of content editors

WordPress has the most mature multi-user content management workflow of any platform. If you have a newsroom, a university site, a government site, or any business where dozens of people need to publish content regularly with proper role-based permissions — WordPress is legitimately the best tool available for that.

You need a specific WordPress plugin that solves a specific problem

WooCommerce for e-commerce, LearnDash for courses, BuddyPress for communities, Easy Digital Downloads for selling digital products. These plugins have been around for years, have thousands of real installs, and work. Rebuilding that functionality from scratch on a custom site is expensive and usually unnecessary.

You want to own a site that another WordPress developer can maintain

WordPress's ubiquity means you can hire a WordPress developer from anywhere. If your agency relationship ends, the next developer speaks the same language. Custom-coded sites (especially React/Next.js sites) have a smaller pool of maintainers — fewer options but more specialised.

You're on a tight budget and you value breadth over depth

A $3,000 WordPress site can hit a lot of feature checkboxes that a $3,000 custom-coded site can't, because WordPress comes with 15,000 free plugins. If the feature breadth matters more than the quality of the implementation, WordPress wins.

The case against WordPress for small business

These are the reasons we don't build on WordPress, and the reasons we usually recommend against it for Australian small-to-mid businesses specifically.

Performance is structurally bad

WordPress was designed in 2003 for servers that ran PHP against a MySQL database on every page load. Even with caching layers on top, the baseline performance of WordPress is worse than any modern framework. A well-optimised WordPress site can hit decent speed numbers, but "well-optimised" means a specialist spent several days tuning caching, optimising images, minifying CSS, and auditing plugins — and those improvements decay the moment someone installs a new plugin.

A custom-coded Next.js site is fast by default. Page weight under 500KB. LCP under 2 seconds. Lighthouse 95+. Without any specialist tuning, and it stays that way.

If performance matters to your business — if you're trying to rank on Google, if mobile speed affects conversions — WordPress is a harder platform to win on.

Security is an ongoing chore

WordPress is the most popular CMS in the world, which makes it the most-targeted CMS in the world. Core WordPress gets security updates every month. Popular plugins get security updates regularly. Unpopular plugins often don't.

A WordPress site that isn't updated for 6 months is almost certainly vulnerable to something. Keeping a WordPress site genuinely secure requires:

Monthly core updates (with testing because updates sometimes break themes)
Plugin updates as they're released
Regular security audits
A web application firewall
Malware scanning
Regular backups

All of this is doable. Most small businesses don't do it. The ones that do pay a monthly retainer for someone else to do it, which adds $100–$400/month to the running cost.

A static or server-rendered custom site has almost no attack surface. There's no database to exploit, no admin panel to brute-force, no plugin to compromise. Security isn't a solved problem, but it's a dramatically smaller problem.

Plugin soup is a maintenance nightmare

A typical small business WordPress site ships with 15–25 plugins: Yoast SEO, WooCommerce, Contact Form 7, WPML for translations, WP Super Cache, Wordfence for security, Elementor for page building, and so on. Each plugin is:

Written by a different developer with different code quality
Updated on a different schedule
Capable of conflicting with other plugins in ways that break the site
A potential security risk

Six months after launch, a typical WordPress site has had:

3–5 plugin updates that required manual intervention
At least one plugin that's been abandoned and stopped receiving updates
A minor conflict between two plugins that caused an obscure bug
A security scare involving at least one of the plugins

None of this happens on a custom-coded site because there are no plugins to manage.

Every WordPress site looks like every other WordPress site

This isn't WordPress's fault exactly — it's a consequence of the theme marketplace. The top 100 themes get used by hundreds of thousands of sites. If you've seen five Astra themes, you've seen them all.

Even "custom" WordPress themes built by an agency are usually derived from a template starter. The underlying layouts and interaction patterns are familiar. Visitors who see a lot of small business websites can usually spot WordPress at a glance, and the brand perception hit is real in visually competitive markets.

A hand-coded custom site can look like anything. That's the whole point.

The specific failure mode nobody warns you about

Most WordPress sites built by agencies for small businesses go through a predictable lifecycle:

Month 0: Site launches. Looks fine. Loads reasonably well. Everyone's happy.
Month 1–3: Client adds a few plugins (analytics, chat widget, maybe a popup). Performance degrades slightly.
Month 4–6: Agency stops touching the site. Plugin updates start accumulating. A couple of them break when the client installs a new version.
Month 7–12: A conflict causes a visible bug. Client calls a WordPress developer to fix it. They fix the symptom, the underlying plugin soup gets worse.
Year 2: The site is noticeably slow. Broken bits appear and disappear. Small bugs become acceptable because fixing them costs more than ignoring them.
Year 3: Client decides to "redesign" and the whole thing gets rebuilt — often on another WordPress install, repeating the cycle.

This is not every WordPress site. But it's the median one. Custom-coded sites age more gracefully because there are no plugins to rot.

When to pick which — the short answer

Pick WordPress if:

You need a specific WordPress plugin that solves your exact problem (WooCommerce, LearnDash, etc.)
You have multiple content editors with role-based publishing
You want maximum flexibility to hire any WordPress developer in the future
Performance is not critical to your conversion funnel
Your budget is under $5,000 total and you need feature breadth

Pick custom-coded if:

Performance is important (you get customers from Google, mobile speed matters, Core Web Vitals matter)
Brand distinctiveness is important (visually competitive market)
You value ownership and portability (no platform lock-in, no plugin dependencies)
You can commit to $8,000+ for the initial build
You expect the site to exist and look premium for 3+ years without a rebuild

For most Australian small-to-mid businesses whose website is a real source of customers, the second list applies. WordPress is the cheaper upfront path and the more expensive long-term path. The break-even usually comes at 18–24 months.

The hybrid option (and why we don't usually recommend it)

Some agencies offer a "headless WordPress" approach: WordPress as the CMS backend, React or Next.js as the frontend. This combines WordPress's content management with modern frontend performance.

It's a real option, and in some cases it's the right one. It costs more than either pure WordPress or pure custom, because you're maintaining two codebases. It requires both WordPress expertise and React expertise on the maintenance side. It's usually the right answer for sites that genuinely need WordPress's content workflow (newsrooms, universities) but also need the performance of a custom frontend.

For most small businesses, the hybrid approach is overkill. Go pure custom with a modern CMS like Sanity or Payload, and you get the benefits of both without the WordPress complexity.

The honest bottom line

WordPress isn't broken. It's an appropriate tool for some jobs and the wrong tool for others. If you're choosing between a WordPress quote and a custom-coded quote, the question to ask is: what's the maintenance cost over three years, not just the build cost in year one.

For most small business sites where the goal is a fast, distinctive, low-maintenance website that generates enquiries — custom-coded wins the three-year math. For sites with specific plugin requirements or multi-editor content workflows — WordPress is the correct answer.

Run the numbers on your specific situation. Ask the agency quoting you WordPress what the monthly maintenance looks like, honestly. Ask the agency quoting you custom what the hosting and CMS costs are, honestly. The honest answers tell you which one makes sense.

If you want help running the comparison on your specific project, book a free audit. We'll look at what you have, what you need, and tell you honestly which path makes more sense — including pointing you at a WordPress specialist if that's the right answer.