Each plugin is separately maintained code
Written by a different team, on a different update schedule, with no guarantee any two plugins were tested against each other.
WHY NOT · WORDPRESS
We do not build on WordPress
WordPress is a content management system that runs on plugins, small add-on programs installed to add features the base platform does not include. Each plugin is separately maintained code, on its own update schedule, running on the same site as every other plugin installed alongside it.
Not: "While WordPress has its place, we've found that..." We do not build on it, and here is the actual mechanism, not a general dislike.
THE MECHANISM
Why risk and weight accumulate, not why they start high
A site rarely launches slow or exposed. It gets there gradually.
Abandoned plugins stop receiving patches
A plugin the site depends on can simply stop being maintained, silently, while a known vulnerability in it stays open indefinitely.
Page weight accumulates, nobody notices gradually
Each plugin adds its own scripts and database queries. No single addition feels significant. The sum does.
MEASURED, NOT ARGUED
Two WordPress sites, before and after
Starting scores recorded before we touched anything, both testable right now.
Shark Jet Ski
WATERSPORTS · BOOKING · REBUILTBEFORE31WordPress, 4.1MB
→AFTER100Static, 9 Oct 2026
Panda ELD
TELEMATICS · REBUILTBEFORE34WordPress, F headers
→AFTER99Static
THE ONE EXCEPTION
When WordPress is genuinely the right answer
Publishing what we will not do includes saying when the alternative is fine.
A very simple brochure site, a handful of pages, no growth plans, can run on WordPress for years without the plugin ecosystem ever becoming a problem. For a very simple catalogue a template can genuinely be cheaper, and we will say so rather than sell a rebuild nobody needs. The mismatch appears at scale: ecommerce with real variants, multi-language done properly, booking with deposits and no-shows, anything that needs data structure a content-publishing tool was not built around.
STRAIGHT ANSWERS
Questions about this position
The ones that come up when people notice we say this plainly instead of hedging it.
The core software is maintained and patched regularly. The risk sits in what gets installed on top of it: plugins, each one separately maintained code with its own update schedule, and some of them abandoned entirely while still running on live sites.
No. It runs a large share of the web reasonably well for what it was designed for: publishing content through an interface a non-technical person can use. The mismatch shows up when a business outgrows content publishing and needs real data structure: ecommerce with variants, multi-language done properly, a booking system with deposits and no-shows.
For a very simple brochure site with a handful of pages and no growth plans, it can be cheaper and perfectly fine for years, and we will say so rather than sell a rebuild nobody needs.
Panda ELD, audited 14 August 2026 before work began: WordPress, F-grade security headers, 34 out of 100. Shark Jet Ski: WordPress, 4.1MB homepage, scoring 31, rebuilt to a static site scoring 100 on mobile, measured 9 October 2026. Both scores are published and testable by anyone.
Send us your website address. We will tell you what is wrong with it.
Two days, no charge, no obligation, and you keep the report whether or not you hire us.