What you take on when a site runs on WordPress

It's software you host, not a service you buy

You download it free from wordpress.org, install it on hosting you pay for, and from that point it's yours. The files, the database, the account. There's no vendor who can change the terms underneath you, because there's no vendor in the arrangement at all.

It's licensed under the GPL, written in PHP, and it keeps everything it knows in one database. That last part matters: get the database and the uploads folder and you have the site.

The trade for that ownership is that everything a hosted platform quietly does on your behalf is now somebody's job. Fine when somebody has that job. It's the whole problem when nobody does.

WordPress.org and WordPress.com are two different products

Almost everyone gets this wrong once. The two names sell genuinely different things.

WordPress.org is the software. Free, self-hosted, put it wherever you like, install any theme or plugin you want. That's what people usually mean by WordPress and it's what most of the web runs.

WordPress.com is a commercial hosting service run by Automattic. It runs the same software for you, keeps it patched and takes the server off your hands. In exchange, the cheaper plans limit what you can install, and your own plugins and themes only become possible further up the range. Those tiers change, so read the current plan page rather than an article about it, this one included.

Neither is the better one. They're two ends of a range, and where you sit on it is a maintenance question, not a technical one.

Hosting it, and what maintenance actually means

Running WordPress means running a PHP server, a database, backups and a certificate. Hosts sell that in tiers, from general shared hosting that runs whatever you upload, to managed WordPress hosting that handles updates, backups and caching and blocks plugins it knows cause trouble.

The maintenance is a short list. Core has installed its own minor security releases by default for years, and plugins update themselves too if you turn that on. Somebody still has to notice when an update breaks a page, keep the PHP version current, and check that a backup restores.

That's not a big job. It's also never zero, and it never announces itself. The sites that end up in trouble aren't the ones with hard problems. They're the ones where nobody wrote down whose job this was.

Themes and plugins are the whole argument

A theme decides how the site looks. A plugin decides what it does. Everything distinctive about WordPress follows from both being open to anybody who wants to write one.

The plugin directory lists tens of thousands of free ones, with a commercial market on top. Forms, ecommerce, memberships, events, bookings, translations. Whatever the unusual requirement is, something already does it and it's probably installable this afternoon. For a business that needs one specific capability, that's the strongest argument on the table.

The second argument is people. W3Techs, which tracks content systems across the web, has put WordPress well ahead of every other one for years, and the labour pool matches. You can hire for it, get three firms to quote the same job, and hand it on when a relationship ends. A niche platform guarantees none of that.

Where it's genuinely strong

Publishing. It started as a blogging tool and never lost the parts that made it good at that: drafts, revisions you can roll back to, scheduled posts, and roles from contributor up to administrator, so a new writer can submit without being able to publish.

If several people produce content on a schedule and an editor signs it off, that workflow is there on day one. Newer platforms are still catching up on it, which is much of why publishers stay put. A few thousand posts with categories, tags and authors is ordinary here, not an edge case.

Where it goes wrong

Through accumulation, almost always, and almost never on day one.

Plugin sprawl is the common one. Each was a reasonable decision by itself: a slider, a form, a popup for one campaign three years ago. Thirty of them later, every page loads a stylesheet and a script from each, the queries multiply, and the site is slow. That isn't the platform. It's a site carrying years of small decisions nobody removed.

The other one is updates nobody owns. The vulnerability reports published each year by the firms that monitor this put most new WordPress issues in plugins and themes rather than core, so your exposure tracks how many you run and how fast they get patched. An abandoned plugin is worse than an out-of-date one.

Both failures are organisational rather than technical, which is why changing platform fixes neither. Whatever you move to inherits the same habit.

The two comparisons worth reading next

Nobody weighs WordPress in the abstract. It gets weighed against something, and two of those comparisons have their own pages here.

Against Webflow, the question is who edits the site day to day, and what the plugin ecosystem costs you in return for the freedom it gives you.

Against Next.js, the question is different. It's whether you're building a site or an application, and what happens when the two need the same codebase.

Before either one, settle two things: who edits this site, and who owns its updates in year two. Both comparisons get shorter once those two names are written down.