WordPress is everywhere, and that is both its biggest strength and its biggest weakness. A huge community, thousands of plugins, and practically every developer has built something on it. On the other hand, most hacked websites run on WordPress, because attackers go after what is popular.
“WordPress or not?” has no good answer without context. There is, however, a fairly simple rule we give our clients.
When WordPress makes sense
The admin panel is the main reason to choose it. If someone in your business publishes regularly (blog posts, news, offers, promotions), a content management system earns its keep.
The second reason is functionality a static site can’t provide on its own: an online shop, bookings, a product catalogue with filters, a forum, a client area. There are ready-made plugins and integrations for all of these, and they save months of development.
The third reason is complexity that will keep growing. A site with 200 pages, an editorial team with several authors, new language versions added every year. Here the burden of maintaining the system pays for itself in flexibility.
When a static website wins
A business website with five to fifteen pages, updated a few times a year, is what most companies have today. And for most of them, running a content management system is overkill. There is a simpler way:
A static website is a set of HTML files. No database, no admin panel to log into, no plugins to update. The result:
- Speed. The server hands over a file and that’s it. With no page being generated on every visit, Core Web Vitals scores usually come out twice as good as WordPress with plugins on the same server.
- Security. There is nothing to break into: no login, no plugin vulnerabilities, no database to leak. Attacks on WordPress happen every day; attacks on an HTML file are a curiosity.
- Running costs. Hosting a static site can be free, because the load is negligible. Agencies typically charge $50 to $300 a month to maintain and update a WordPress site.
- Resilience. Copy the folder and you have the whole site. Restoring it takes a minute.
Historically there was one problem: every change needed a developer. That is no longer true. You can make changes in a chat, the way our Webomat does it: you type “change the phone number in the footer and add a pricing section”, and the site generates a new version of its files. The admin panel is no longer the only way in.
The decision in three questions
Answer honestly:
- Will someone in the business publish content more than once a month?
- Does the site need a shop, bookings or a customer login?
- Will the site grow beyond fifteen pages in the foreseeable future?
Three “no”s mean a static website. Two or more “yes”es mean a content management system, most likely WordPress.
The tricky part is that “I don’t know” is also an honest answer to all three. In that case, starting with a static site is the cheapest option, because moving the content to WordPress later is easy. Going the other way can be more painful.
Three years in numbers: WordPress vs a static website
Let’s add up the cost of running a five-page business website for three years, not counting the cost of building it:
WordPress:
- WordPress-ready hosting: $100 to $400 a year,
- maintenance and updates (an agency or a capable freelancer): $50 to $300 a month,
- clean-up after a break-in attempt, statistically once every few years: $300 to $1,500,
- three-year total: $2,400 to $13,500.
Static website:
- hosting (the cheapest plan will do): $0 to $100 a year,
- updates: practically none, because there is nothing to update,
- clean-up after a hack: a rarity, attacks on HTML files barely exist in practice,
- three-year total: $0 to $300.
The difference over three years: anywhere from about two thousand to over thirteen thousand dollars. That is what an admin panel costs you if you don’t publish in it regularly. Which is why the “will anyone actually write?” question from the start of this post matters more than any technical argument.
What moving off WordPress looks like
I hate to think how many sites stay on WordPress purely because “migrating is a nightmare”. It isn’t. Here is what it looks like:
- Export the content: posts, pages, images, comments (small businesses usually have none).
- Build static pages from that content, with a fresh layout.
- Map old URLs to new ones and set up 301 redirects.
- Publish on the same domain.
With us, an agent does this: it reads the client’s entire WordPress site, moves the content and sets up the redirects. A human signs off. The day before, you lose an admin panel you never used; the day after, you have a site that loads in a fraction of a second.
The middle ground: a well-maintained WordPress site
I don’t want to give the impression that WordPress is evil. We know WordPress installs that are lightning fast and locked down like a vault, because someone looks after them: updates every Monday, daily backups, only the plugins that are needed, dedicated hosting. If you have that kind of caretaker and you genuinely publish, stay. Moving makes sense when maintenance costs more than it should and the publishing never happened.
Questions worth asking yourself once a year
- How many posts did we publish in the last 12 months? (Zero means the admin panel is decoration.)
- How much did looking after the site cost this year, including fixes?
- When did someone outside the business last check the site’s speed?
- Does the admin login use a password that three people know and nobody remembers where it came from?
The answers speak for themselves. You don’t need to be technical to add them up.
Running WordPress and wondering whether it still makes sense? A free audit shows you its real condition: speed, mobile version and number of pages.
Frequently asked questions
WordPress or a static website for a small business?
Static, if you don’t publish content more than once a month and the site has up to fifteen or so pages. WordPress, if you need an admin panel, a shop or bookings.
Is a static website more secure than WordPress?
In practice, yes. No login, no plugins and no database means none of the usual attack routes. Attacks on static HTML files are a curiosity; attacks on WordPress happen every day.
Can you edit a static website yourself?
With Webomat, yes: you request changes in a chat and the system builds a new version. No admin panel, no plugins, no developer.