WordPress or a custom-coded website: which should you choose?

What's the difference, concretely?

WordPress is a content management system: software installed on a server, with a theme for the look and plugins for the features. Every time a visitor arrives, the server assembles the page from a database, then sends it over.

A custom-coded site is the opposite: no middle layer, no purchased theme, no collection of plugins. The pages are written directly for your business and served as they are, ready to display. Think of the difference between renting a pre-fitted commercial space you adapt as best you can, and fitting out your own exactly to your needs.

What WordPress does very well

We won't lie to you to sell code. If you publish content every week, run an active blog or manage a catalogue that changes all the time, the WordPress admin panel is a real asset. You log in, you write, you publish, without depending on anyone.

The ecosystem is also huge. There's a plugin for just about everything, thousands of themes, and providers in every town in Quebec able to take over your site. That portability has value: you are never locked in with a single agency.

So yes, there are projects where we answer without hesitating: "WordPress holds up very well here." This guide exists precisely because that's not always the case.

Where things go wrong: the plugins

Here is the number that should guide your thinking. In 2025, 11,334 security vulnerabilities were disclosed across the WordPress ecosystem. Of that total, only 6 affected the WordPress core itself, all minor. The rest? 91% came from plugins, and the remainder from themes.

In other words, WordPress isn't the problem. The problem is that a typical WordPress site rests on 20 to 30 plugins, each written by a different developer, each needing updates, each capable of opening a door. And attacks don't wait: when a serious flaw becomes public, the first automated scans start within hours.

We've cleaned up more hacked sites than we'd like. The story is the same every time: a plugin forgotten for two years, a site that starts redirecting to shady pages, and an owner who finds out from a client embarrassed to mention it. A hand-coded site simply doesn't have that attack surface: there's no database to breach, no admin panel to force, no plugin to exploit.

Speed, and why Google cares

Every added layer slows the page down: the server running code, the database being queried, the page builder stacking its scripts. Plenty of WordPress sites manage fine, but rarely without effort: they need caching, compression and image optimization plugins, which add maintenance of their own.

A site served as static pages starts with a head start: there's nothing to assemble, nothing to wait for. And that difference isn't cosmetic. Google measures the real loading speed of your pages and factors it into rankings, especially on mobile, where most of your visitors are.

The real cost, over three years

"WordPress is free." True for the software, but not for the site. Do the full math: the premium theme, the yearly licences for two or three paid plugins, suitable hosting, and above all the monthly maintenance plan, because leaving a WordPress site without updates, as we just saw, is not an option.

A custom site flips the curve: the investment happens up front, then recurring costs drop to a minimum. No licences to renew, no weekly security updates, light hosting. Over three years, the "free" site regularly ends up costing more than the one coded for you.

So, how do you choose?

Our honest grid, the same one we use in meetings:

• WordPress makes sense if you publish content several times a week, if someone on your team is comfortable managing the site and its updates, or if you value being able to switch providers easily.
• Custom makes sense if your site is a showcase meant to last for years, if speed and search ranking are priorities, if you have neither the time nor the desire to manage updates, or if you want low, predictable recurring costs.

And if you're still torn, ask yourself one question: who will look after the site six months from now? If the answer is "no one, we won't have time," you have your answer. A custom site forgives neglect. A WordPress site doesn't.