WordPress vs a Custom-Coded Website for Small Business: Security, Speed and the Real Yearly Cost
For most small service businesses that need a fast site, a booking form and a few pages they can edit, a custom-coded website is cheaper to keep safe and quicker to load than a WordPress site held together by 20 plugins. WordPress is still the better choice for content-heavy blogs, magazines and projects that genuinely need its plugin ecosystem. The difference is not the first build, it is the years after: plugin updates, licence renewals, security patches and page-builder bloat. This guide compares both honestly, with the numbers.
Key takeaways
- Patchstack counted 11,334 new WordPress ecosystem vulnerabilities in 2025: 91% in plugins, 9% in themes and only 6 in core.
- WordPress core has no built-in two-factor authentication, so the admin login depends on a plugin or your host.
- Premium plugins and page builders are yearly licences: Elementor Pro alone runs around $60 to $108 a year per site as of late 2026.
- Page builders add extra code to every page, which is often why WordPress sites for plumbers or salons feel slow on phones.
- WordPress wins for large blogs, publishers and sites that rely on a specific plugin; a custom site wins for lean, fast service-business sites.
- Whichever you pick, own your domain, keep backups off the server and check your security headers.
WordPress vs custom website: what is the actual difference?
WordPress is a content management system: a PHP application with a database, a theme that controls the look and plugins that add features such as forms, booking, SEO fields, caching and security. A typical small business WordPress site is the core software plus a premium theme plus somewhere between 10 and 30 plugins, each written by a different developer on a different update schedule.
A custom-coded website is built for one business. The pages, contact form, booking flow and admin panel are written for what that business actually does, with no unused features. There is no plugin marketplace, so there is also no plugin you forgot to update. The trade-off is that new features need a developer instead of a one-click install.
Is WordPress secure enough for a small business website?
WordPress core itself is well maintained: Patchstack's 2026 security report found only 6 vulnerabilities in core during 2025, all low priority. The risk sits in the ecosystem around it. The same report counted 11,334 new vulnerabilities in 2025, up 42% on 2024, with 91% in plugins and 9% in themes. Around 46% had no developer fix available when they were publicly disclosed, and roughly half of the high-impact ones were exploited within 24 hours.
Login security is the other gap. WordPress core has no built-in two-factor authentication, so unless someone installed and configured a 2FA plugin, the admin account is protected by a password alone. Our guide to two-factor authentication for business websites explains what a proper login setup looks like, and the website security guide covers the rest of the basics.
What we find when we recover hacked WordPress sites
ITCM regularly cleans up hacked WordPress sites for small businesses, and the story is rarely a clever attack. It is usually an old plugin nobody remembered installing, or a site that stopped getting updates when the original designer moved on. The owner notices only when Google shows a warning, customers report strange redirects, or email starts landing in spam. If that is happening to you now, follow our step-by-step hacked website recovery guide.
The patterns we see again and again:
- A plugin that was deactivated but never deleted, still sitting on the server with a known hole.
- A 'nulled' (pirated) premium theme or plugin with a backdoor already built in.
- Several admin accounts, including old staff or past freelancers, with reused passwords and no 2FA.
- Hidden spam pages or casino and pharmacy links injected into the database, hurting Google rankings.
- Backups stored on the same server as the site, so they were infected too.
- Contact forms quietly sending leads nowhere because a form plugin update broke the mail settings.
How many plugins is too many on a WordPress site?
There is no magic number, but every plugin is extra code to update, another vendor to trust and another thing that can conflict after an update. A cleaning company or electrician site that needs pages, a contact form, a booking calendar and reviews should not need 25 plugins. When we audit WordPress sites we often find three plugins doing overlapping jobs (two SEO plugins, a cache plugin fighting the host's cache, a slider nobody uses).
A useful rule: if you cannot say what a plugin does and who maintains it, it should probably not be there. Check when each one was last updated; a plugin with no release for over a year deserves a closer look.
Do page builders like Elementor slow down WordPress?
Page builders such as Elementor, Divi and similar tools make WordPress easy to design visually, but they generate extra wrappers, scripts and styles on every page. Combine a builder with a slider, a popup plugin, a chat widget and a reviews widget, and a simple five-page site for a dental clinic can load several megabytes of code before the phone number appears.
You can tune a WordPress site with caching, image compression and careful plugin choices, and our guide on how to speed up your website walks through it. A custom-coded site starts light because it only ships the code its own pages use, which makes good mobile scores easier to reach and easier to keep after future changes.
How much does a WordPress website really cost per year?
WordPress itself is free, which is why the true cost is easy to underestimate. Many of the features a service business needs come from paid plugins with yearly licences. Below are typical items for a small business site; prices vary by vendor and are approximate as of 2026. Elementor Pro, for example, was listed at $60 a year for one site (Essential) up to $108 a year for three sites (Advanced) in late 2026.
| Item | Typical yearly cost (approx.) | Notes |
|---|---|---|
| Page builder (e.g. Elementor Pro) | $60 to $108 | Renews yearly; features stop updating if it lapses |
| Premium theme | $0 to $80 | Some are one-time, many sell yearly updates |
| Forms, booking or calendar plugin | $50 to $300 | Booking plugins with payments are often the priciest |
| Security and backup plugins | $0 to $200 | Free tiers exist; off-site backups usually cost extra |
| SEO or caching premium add-ons | $0 to $150 | Often optional |
| Updates and fixes (your time or a freelancer) | A few hours a month | Updates should be tested, not clicked blindly |
When is WordPress the right choice?
WordPress is a sensible, often better, choice in several situations, and we tell clients so:
- You publish a lot: a blog, news site or knowledge base with hundreds of articles and several writers.
- You need a specific plugin ecosystem, such as a membership plugin, LMS course plugin or a niche directory tool.
- You have an in-house person or agency who already updates and monitors WordPress every week.
- You want to hire from the biggest pool of freelancers and themes on the web.
- You want to move hosts easily: WordPress runs almost anywhere.
WordPress vs custom-coded website: side-by-side comparison
Here is how the two compare for a typical local service business such as a plumber, salon, clinic or restaurant.
| Factor | WordPress (theme + plugins) | Custom-coded website |
|---|---|---|
| Security surface | Core plus every plugin and theme | Only the code written for your site |
| Built-in 2FA | No, needs a plugin | Can be built into the admin panel |
| Ongoing updates | Core, theme and plugins, often weekly | Few moving parts, updated as needed |
| Speed on mobile | Depends heavily on builder and plugins | Lean by default |
| Yearly licences | Common (builders, forms, booking) | Usually none for features |
| Adding features | Install a plugin, often fast | A developer builds it |
| Best for | Blogs, publishers, plugin-dependent sites | Lean service-business sites with booking and leads |
Already on WordPress? A quick safety checklist
Moving away is not always necessary. If your WordPress site is working, tighten it first. Run your domain through our free SSL and security headers checker to spot easy gaps, then work through this list. If you would rather hand it over, our website security service covers hardening and monitoring.
- Delete (do not just deactivate) every plugin and theme you are not using.
- Turn on 2FA for every admin and remove old admin accounts.
- Update core, theme and plugins, after taking a backup.
- Store backups off the server and test that one actually restores.
- Replace any plugin with no update in the last 12 months.
- Send a test lead through every form to confirm it reaches your inbox.
How ITCM builds a custom website instead
ITCM builds a small business a custom website plus an installable app (PWA) for free first. You see it finished, in 3 design options, and pay $150 one-time only if you are happy; if you are not, you pay nothing. The $150 covers the website, the installable app, 24/7 online booking, lead management and an admin panel where you edit your own content, so there is no stack of plugins to license or update for those features.
Anything beyond that gets a fixed quote before any work begins, and there is an optional care plan from $100/month if you want us to handle changes and monitoring. If WordPress genuinely fits your business better, for example a large blog, we will say so.
Frequently asked questions
- Is a custom website better than WordPress for SEO?
- Not automatically. Google ranks content, relevance, speed and reputation, not the CMS. A custom site makes speed and clean code easier, while WordPress makes publishing lots of content easier. Either can rank well if it is built and maintained properly.
- Why do WordPress sites get hacked so often?
- Mostly because of outdated or abandoned plugins and themes, pirated premium plugins, and admin logins without two-factor authentication. Patchstack found 91% of new WordPress ecosystem vulnerabilities in 2025 were in plugins, not core.
- Does WordPress have two-factor authentication built in?
- No. WordPress core does not include 2FA. You need a plugin or a host-level login protection, and it has to be set up for every admin account.
- Can I edit a custom-coded website myself?
- Yes, if it comes with an admin panel. ITCM sites include one so owners can change text, photos, services and prices without a developer.
- Is WordPress cheaper than a custom website?
- The software is free, but premium plugins, page builders and maintenance time add up every year. For a small service site, a custom build can cost less over three years, while a large content site is often cheaper on WordPress.
- Should I move my WordPress site to a custom site?
- Consider it if the site is slow, has been hacked, needs constant plugin fixes or you are paying several yearly licences for features you barely use. If it is stable, fast and well maintained, keeping it is reasonable.
Related reading & services
- How to recover a hacked website
- Website security guide
- Wix vs custom website
- Website builder hidden costs
- SSL and security headers checker
- Get your website + app free until you're happy
- WordPress plugin vulnerabilities explained
More in Costs & Comparisons
- How Much Does a Website Cost?
- GoDaddy Website Builder (Airo) vs a Custom Website: 2026 Prices, Renewals, Limits and 3-Year Cost
- Freelancer vs Web Design Agency vs Small Studio: Which Should a Small Business Hire in 2026?
- One-Time vs Monthly Website Fees: Which Costs Less Over 3 and 5 Years, and What Do You Actually Own?
- Who Should Own My Website and Domain? What to Control, How to Check It, and What to Do If Your Designer Won't Let Go
- How to Switch Web Designers Without Losing Your Website, Email or Google Rankings
All Costs & Comparisons articles →
Free tool
Free Website Cost Calculator
Compare what your website would cost with an agency, a builder, a freelancer and ITCM.
Try it freeGet a website + app built for free
We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.
See the $150 offer Free website audit