Here is the straight answer, before anyone sells you a retainer. Most small businesses do not actually need WordPress. It became the default because it is free to start and every web person already knows it, not because it is the right fit for a plumber, a cafe, or an accountant with a handful of pages and a contact form. WordPress earns its keep when you are publishing constantly yourself or running something genuinely complex. For most small sites it is more machine than the job needs, and the plugins that make it powerful are the same thing that breaks it, slows it down, and gets it hacked.
Quick plain English so we are talking about the same thing. WordPress is a free content management system, software that installs on a web server and lets you edit your site through a dashboard. It runs more than 40 percent of the websites in the world, so it is genuinely everywhere. A custom-built site is one designed and coded around your specific business, carrying only the parts you actually use and no dashboard full of features you will never touch. Both can look great. They age very differently.
Why is WordPress on half the internet then?
Because free is a powerful word, and because it does things a small site rarely needs. WordPress is built around plugins, little add-ons you bolt on for a booking form, a shop, a photo gallery, an SEO panel, and so on. Want a feature? There is a plugin for it. That is a fair pitch if you are running a big, content-heavy site and want to keep adding things yourself without ringing a developer every time. The trouble starts when a simple business site ends up lugging around twenty of these add-ons to do what a lean custom build does with none.
What is the catch with all those plugins?
Every plugin is code written by a stranger that your site now leans on, and each one has to be kept patched or it turns into an open door. This is not a scare story, it is simply where the sites fall over. In 2025, 91 percent of WordPress security holes were found in plugins, with only a handful in the core software itself. Of the sites that actually got hacked, 92 percent were breached through a plugin or theme, not through WordPress itself. Around 13,000 WordPress sites are hacked every single day, and once a flaw is made public, attackers are often trying it within about five hours. A plugin you installed two years ago and forgot about is exactly the kind of thing they walk straight in through.
So who fixes it when it breaks?
This is the question nobody asks until it is eleven at night and the site is showing a blank white screen. WordPress updates are constant, core, themes and plugins all need patching, and every so often one update quarrels with another and takes the whole thing down. The classic is the white screen of death after a plugin or PHP update, where the only fix is switching plugins off one at a time until you find the guilty one. Someone has to test those updates on a copy first, keep proper backups, and be around when it falls over. That someone is either you on a Sunday, or a care plan you pay for every month.
And that is where the free CMS quietly stops being free. In New Zealand, a WordPress maintenance plan runs somewhere between $50 and $250 a month depending on how hands-on it is. The money is well spent if you are on WordPress, because skipping it is exactly how sites get hacked, but it is a bill you carry forever just to keep the machine patched. It is the same slow drip we wrote about with builder fees, only wearing a different shirt.
When does each one actually win?
Be honest about what the site has to do. WordPress really wins when you or your team are publishing a lot yourselves and want to do it without a developer, or when you need a specific setup like a large shop, memberships, or an unusual integration with software you already run. That is real, and for those businesses it is the right tool. For a simple site, a custom build wins on almost every count that matters.
- It loads faster on a phone. That is how most of your customers arrive, and speed is something Google and the AI answer engines quietly reward.
- There is almost nothing to break. No weekly plugin updates, no add-on silently going out of date, and a tiny surface for anyone to attack.
- It costs less to run. No plugin treadmill, and no compulsory monthly care plan just to stay safe.
On price, a sharp custom small-business site built properly by us usually lands around NZD $4,000 to $5,000. Plenty of Auckland agencies will quote $6,000 to $10,000 and up for the same scope, WordPress or not, mostly to keep the office fed. Custom does not have to mean agency money, and it does not have to mean WordPress. Have a look at what we actually build before you assume the cheap-to-run option is the expensive one.
So which does your business need? If you are going to live in that dashboard every week, or you need something properly complex, WordPress is a fair call, just walk in knowing the upkeep is part of the deal. If you want a fast, sharp site that pulls in enquiries and otherwise leaves you alone, a custom build is usually the quieter and cheaper life. Tell us what your site has to do and we will tell you straight, even if the honest answer is stay right where you are.