Who should stay on WordPress

It is the dominant system by a wide margin: 58.3 per cent of sites with an identifiable system, with the nearest rival under 8 per cent. Its community held 81 events in 39 countries last year and its directory holds more than 60,000 plugins. Every host sells a plan for it. Millions of people know its editor, which matters more than engineers admit: a team that can already update the site will update it, and a team facing a new editor sometimes will not.

Its core team patches fast and widely. When a critical flaw was fixed in September 2026, the fix was backported to a version nine years old. Its pass rate on Google’s speed measures has risen three years running, from 28 per cent of sites in 2023 to 45 per cent in 2025.

And some things are hard to do without it. A membership site with logged-in users and content that changes for each of them. A large shop whose catalogue is wired into a stock system through plugins that exist only for WordPress. A site where many people publish daily with editorial sign-off. For these, WordPress is a reasonable tool, and the move away from it is a bigger project than the gain.

The description that fits a site that should stay is specific. The plugins are few, each one is still maintained by its developer, and nobody has added one in a year without removing one. The team knows the editor and uses it. Somebody applies security fixes within days, has a way of knowing when one is published, and keeps a backup off the host that has been restored at least once. The site is on a modern, well-run host and a current version of PHP. And the business needs something WordPress does well, not just something it does.

If that is your site, it is a reasonable choice, and we will say so in writing if you ask us to look at it.

Most business sites we see do not match that description, not because the owner is careless but because the description is hard to keep true. A site built four years ago with 30 plugins, by an agency that has moved on, with a theme nobody has updated and a team that edits it twice a year, is the common case. Nine in ten of the flaws disclosed last year were in plugins, nearly half had no fix on the day, and the first exploit attempt came a median of five hours later. A site like that is not being looked after; it is being left, and the difference shows up as a hacked site or a slow one, usually both.

For a brochure site, a product library or a data sheet collection, the things WordPress is good at are not needed, and the things it costs are paid in full. That is the case for moving, and it is a case about fit, not about WordPress being bad.

If you stay, these are the conditions, and they are the ones the UK’s Cyber Essentials scheme and the evidence point to.

1. Fewer plugins. Remove every one you cannot name the purpose of. For each that remains, check when its developer last updated it; a year of silence is abandonment.
2. Patch within 14 days, and within 48 hours when a public exploit exists. This needs a person, a way of hearing about fixes, and a test site to try them on. It is a job, and it should be somebody’s.
3. Back up off the host, and restore once. A backup nobody has restored is a hope.
4. Lock the login. Two-factor authentication on every account, no shared logins, and the admin address not advertised.
5. Keep the platform current. A supported PHP version, a current WordPress version, a host that patches its own servers.
6. Measure twice a year. Run the site through PageSpeed Insights and the HTTP Observatory, and keep the figures, so decay is seen when it starts.

We look after sites like this under ongoing care, on the same cadence, with a log you can read. We will also tell you plainly, each year, whether the description above still fits, because the day it stops fitting is the day the case for moving starts.

Tell us what your site runs and who looks after it. An engineer will reply within one working day with whether it fits the description, and if not, what it would take to make it fit or to move.