Why We Don’t Build on WordPress

WordPress powers a huge share of the internet. It is also the platform we see cause the most problems for small businesses. When a new client comes to us on WordPress, we rebuild the site on a modern framework. Here is why.

The Security Problem

On October 21, 2026, PHP released emergency patches for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). PHP is the language WordPress runs on. Researchers showed these flaws could let an attacker run code on a server without logging in. Every WordPress site runs on PHP, so every one on an unpatched server is exposed.

The fix is to update PHP on the server. Many small business sites run on cheap hosting with old PHP versions that no longer get updates. Those sites stay exposed.

The PHP flaw is the headline this week. The bigger problem never goes away. Patchstack found 11,334 new vulnerabilities in the WordPress ecosystem in 2025. That was up 42% from the year before. 91% of them were in plugins. Almost half had no fix from the developer when they went public. For the most targeted flaws, attacks started a median of 5 hours after disclosure.

Every plugin on a WordPress site is another door someone has to keep locked.

The Page Speed Problem

Most WordPress sites are built from a theme plus a stack of plugins. Each one loads its own scripts and styles on every page, whether that page needs them or not.

The result is a slow site. Slow sites rank lower on Google and lose visitors before the page finishes loading. You can spend money on caching plugins to patch over it. That is one more plugin to maintain.

The sites we build only load what each page needs. They are fast out of the box.

The Copy-and-Paste Problem

WordPress makes it easy to grab a template and a pile of plugins and call it a website. That is how a lot of agencies and freelancers work.

We have inherited clients whose last WordPress manager copied and pasted templates and plugins so many times that other companies’ information was buried in the site. Their code and metadata had another business’s name and details in it. Google reads that metadata. Those clients were sending mixed signals about who they were, and their SEO tanked because of it.

Cleaning that up on a WordPress site often takes longer than building a new one.

What We Build On Instead

We build every site on Next.js. It is the same framework used by companies like Netflix, Nike, and TikTok. It was built for speed, security, and search visibility from the start.

Why It Is Better

• Faster pages. Next.js builds pages ahead of time and delivers them ready to view. Images are sized and compressed for each device automatically. Visitors see your site almost instantly.
• Far less to attack. There is no WordPress login page, no plugin library, and no PHP running behind your site. Most of the attacks we covered above simply do not apply.
• Built for SEO. Clean code, unique titles and descriptions on every page, and structured data help Google understand exactly who you are and what you do.
• Room to grow. Booking forms, quote calculators, and connections to your CRM can be built right into the site. You never have to hunt for a plugin that almost does what you need.

Every Site Is Custom Coded

We do not start from a template. Our team designs and codes each site for the business it belongs to. Your layout, copy, and metadata are written for you and nobody else.

That means no leftover code from another company and no features you do not use slowing the site down. When you need a change, we make it in the code directly. You do not have to work around a theme’s limits.

If your WordPress site feels slow, outdated, or hard to keep secure, talk to us about a website rebuild.