WordPress or custom development: how to choose for your website

Published on 4 November 2026by Tauro Lab9 min read

In short WordPress works for showcase sites, blogs and sites with common features: lower upfront cost and content you edit yourself. It runs 39.5% of all websites and in 2025 had 11,334 known vulnerabilities, 91% of them in plugins: it has to be kept updated. Custom development makes sense when the site must do unusual things or talk to your own software. Either way, what counts is maintenance, ownership of the code and the three-year cost.

WordPress for a showcase site, a blog or a shop with common features; custom development when the site has to do things no theme does or has to talk to your own software. That is the short answer. The long one matters because whoever tells you "build it in WordPress, it costs less" and whoever tells you "WordPress is insecure" are both right in some cases, and both are selling something. So are we: Tauro Lab builds custom software, so you are entitled to doubt us. That is why you will find verified figures here, and checks you can run yourself.

WordPress and custom development: what they are, with figures

WordPress is free, open source software for building websites, released under the GPL licence. You install it on a server, pick a theme that sets the look, add plugins for features and edit content from a dashboard. The program is free to download; you pay for the server, any paid themes and plugins, and the work of whoever sets it up. As of 31 October 2026 the current version is 7.1.4 and WordPress.org recommends PHP 8.3 or higher. According to W3Techs, on the same date it runs 39.5% of all websites and 58.2% of those with a recognisable content management system: by far the most widespread, which has consequences for better and for worse.

Custom development means a site programmed for your project: pages, dashboard and features designed around what you need. It does not start from nothing, since existing tools and libraries are used, but the whole is designed for your case rather than the average case.

When WordPress is the right choice

For many sites it is, and saying so costs us nothing:

the site is a showcase, a blog or a portfolio with the most common features;
you want to update text and photos yourself, through a dashboard many people already know;
the upfront budget is limited and your needs are standard;
you want to be able to change supplier: with 39.5% of websites behind it, professionals who can work on it are everywhere.

The saving is real at the start, because you begin with a ready-made theme and plugins. It is less real if you later want to change a lot: every customisation beyond the theme's options takes work, and every extra plugin is one more supplier to keep track of.

When custom development makes sense

the site has to do unusual things: a quote calculator with your own rules, a private area, a link to the management software you use;
doing one thing takes four plugins that fight each other;
you want a look that does not resemble a theme, with every screen designed for your case;
the site is part of a product or service that is growing, and you want to control data and features.

The price: higher upfront cost, longer timescales and dependence on whoever built it. If that person disappears, whoever comes next has to understand the code. That is why the code must be yours, tidy and handed over, and the assignment must be in writing: more on that below.

Security: the 2025 figures and what they mean

According to Patchstack's report on 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than in 2024. Of these, 91% were in plugins and 9% in themes; only six were in the core program, all low priority. And 46% had no patch available at the time of disclosure. The picture is clear: WordPress itself holds up, the risk sits in the added components and in whoever fails to update them.

This is not only a WordPress problem. The OWASP Top 10 for 2025, the list of the most critical risks for web applications, puts "Software Supply Chain Failures" in third place: the trouble that comes from third-party components that are old, abandoned or have known flaws. A custom site has no plugins to follow one by one, but it has libraries, a server and code written by people: it is not secure by magic. Either way, ask:

Who applies the updates, how often, and what happens if an update breaks the site?
Is there a backup, how often is it made and where is it kept? Has anyone ever tried restoring it?
Who holds the admin passwords, and is the main admin account yours?
What is included in the price after launch and what is charged separately?

The five-minute plugin check

If you already have a WordPress site, or someone is proposing one, you can measure the risk yourself. Ask for the list of installed plugins (in the dashboard it is under Plugins) and, for each one, open its page on wordpress.org. Look at three things: the date of the last update, the WordPress version it was tested with and the number of active installations. A plugin not updated for more than a year, or not tested with the current version, is a component nobody follows any more. Count them too: every plugin is one more supplier, and if a showcase site needs twenty of them, something in the project does not add up.

Also look at the WordPress version shown at the bottom of the dashboard. If your site runs on a major version that is years old, the answer to "who applies the updates" is: nobody.

Costs over time

The upfront price is one part. To compare properly, line up the items that repeat every year and add up three years. What drives the upfront cost is in how much does a website cost.

Item	WordPress	Custom
Initial build	Usually lower: you start from a ready-made theme and plugins	Usually higher: designed and written for your case
Hosting and domain	Every year	Every year
Paid plugins and themes	Often with an annual renewal	Normally none, though there may be outside services
Updates and checks	Regular: program, theme and every plugin	No plugins, but libraries and the server still need following
New features	Easy if a suitable plugin exists, costly if not	Programmed on request: more time, but built for your case
Changing supplier	Usually simple: many people can work on it	Depends on how tidy, documented and assigned the code is

A cheap WordPress site nobody updates can cost more, one problem after another, than a site built properly. And a custom site for a job a theme could have done in an afternoon is money wasted. Speed, either way, is measured rather than assumed: see Core Web Vitals without the jargon.

Who owns what

With WordPress the question is simpler than it looks: themes and plugins distributed for WordPress inherit the GPL licence according to the WordPress project, so you can use and modify them with whoever you like; the content is yours. With custom work the code is a work protected by copyright, and Italian law requires a transfer of rights to be proven in writing: if the contract says nothing, it is not automatically yours even though you paid. Ask for the sentence before you sign and, if the site is central to your business, have a lawyer read it. How this differs between agency and freelancer is in web agency or freelancer.

How to choose: four questions

What does the site have to do besides display pages? If the answer is "nothing", start with WordPress or something simple.
Who will update the content? If it is you, the dashboard matters most: ask to try it first.
Who handles maintenance and what does it cost? If the answer is "nobody", the problem is not the technology.
What happens if you change supplier? Logins, domain, code and content must be yours, in writing.

If you are still unsure after the four questions, starting with WordPress and moving to a custom site when your needs grow is a legitimate route, as long as content and addresses stay in order. When you do switch, follow the steps in redesigning a website without losing your rankings.

Neither route is faster or safer by definition: a badly built custom site is as slow as a WordPress site with thirty plugins.

Ask two professionals what they would propose

Write down the features the site needs beyond its pages, who will update it and how many years you expect to keep it as it is. Then ask two professionals what they would propose and why. If they always propose the same technology without explaining their reasons, that is a signal.

Our websites page shows how we work. If you would like an opinion on your case, write to us: we will tell you what we would choose in your place and why, even when the answer is WordPress.

Frequently asked questions

Is WordPress slow?

It depends on how it is set up. With a light theme, compressed images and few plugins it can do well. With many plugins and a theme full of features it often does badly. Measure speed with Google's tools instead of trusting the label.

Are WordPress sites hacked more often than others?

Being the most widespread, it is the most studied by people looking for flaws, and the 2025 figures say the risk sits in plugins and themes, not in the program. With regular updates, backups, strong passwords and few plugins the risk goes down. It never disappears, with WordPress or with anything else.

Can I move from WordPress to a custom site later?

Yes. You carry the content over to the new site and prepare the address table with 301 redirects, so Google does not lose the links. The tidier the content, the cheaper the move.

Can I update a custom site myself?

It depends on how it is built. If you need to, a dashboard for text, photos and opening hours can be included, designed around the things you actually change. Ask for it upfront and try it before handover.

Sources

Written by the Tauro Lab team, a web agency and software house in Turin. About us