WordPress vs. a custom-coded site.
WordPress powers a huge slice of the internet, and it also accounts for the overwhelming majority of hacked websites currently on the internet. The honest comparison is not which option is cheaper. The honest comparison is which option actually puts paying customers on your calendar, and what each one quietly costs you in leads you never see.
The thing nobody calculates
A WordPress site comes with a hosting bill, a maintenance retainer, and a small handful of plugin licenses, and that is the visible cost of the arrangement. The invisible cost is the percentage of mobile visitors who bounce because the site loaded too slowly, the local-pack ranking you never quite earned because the schema underneath was generic, and the day the site gets hacked and your phone stops ringing for a week. For a service business, lost leads are an order of magnitude bigger than the platform bill, and they are entirely real, even though they never show up on an invoice.
Where WordPress structurally costs you leads
- Page speed is uphill. WordPress page-builders (Elementor, Divi, etc.) ship hundreds of KB of unused CSS and JavaScript to every visitor. Real-world service-business WordPress sites typically score 30–65 on Google PageSpeed mobile. Hitting 90+ takes substantial caching and developer time. A custom-coded site sits at 95–100 the day it launches and stays there.
- Security is a recurring lead-killer, not just a chore. WordPress is the most-targeted platform on the internet, by a wide margin. The day your site gets defaced, redirected, or de-indexed by Google, your phone stops ringing. The maintenance retainer most agencies charge is buying you reduced, not eliminated, risk. A static custom-coded site has no admin login, no database, no plugin runtime, and no comparable attack surface.
- Plugin sprawl is a hidden tax on speed and stability. A typical service-business WordPress site runs 15–30 plugins. Each one has updates, conflicts, CVEs, and CSS/JS overhead. Every plugin update is a chance the site breaks the next time a real customer is trying to fill out your contact form.
- Local SEO is heavier than it should be. The plugins that handle schema (Yoast, Rank Math) are competent but generic, their structured data outputs the same shape on every WordPress site in your trade. Google's local algorithm increasingly weights uniqueness. A custom-coded site gets custom-coded schema that matches your specific Google Business Profile and service catalog.
- You depend on a chain of vendors. Hosting + theme + page builder + backup + security + SEO + forms. Each is its own subscription, its own update cycle, its own thing that can break independently. With a custom-coded site, it is one integrated stack with a single point of accountability.
- Forms convert worse out of the box. Contact Form 7, Gravity Forms, etc. are generic. They do not segment by trade, urgency, or job type. A trade-specific intake form on a custom site asks the right three questions and converts measurably better.
Where WordPress is the right call
WordPress is genuinely strong for publishers, news sites, magazines, multi-author blogs, content memberships, anyone running a high-volume editorial workflow. The editor and user-role system are what the platform was built for. If your site exists primarily to serve writing, run with WordPress, ideally with a managed host and a maintainer you trust.
Side-by-side, on the things that move revenue
| Dimension | WordPress (typical service-biz build) | Custom-coded |
|---|---|---|
| Typical mobile PageSpeed | 30–65 | 95–100 |
| Time-to-interactive on a phone | 5–10 seconds | Under 1.5 seconds |
| Security attack surface | 15–30 plugins, login, database | No admin, no DB, no plugin runtime |
| "Hacked" risk | High, #1 target on the internet | Effectively zero |
| Local-SEO schema | Plugin-generic, shared shape | Custom-coded, GBP-matched |
| Service-area page depth | Plugin/template-driven | Real, indexable, unique per metro |
| Form intelligence | Generic plugin (Name/email/message) | Trade-specific intake, urgency-routed |
| Updates that can break the site | Plugins + core + theme + PHP | None, static output |
| Editing workflow | Built-in editor (Gutenberg) | Email me, with quick turnarounds on most business days |
| Multiple-author publishing | Mature user roles | I publish on your behalf |
| Cookie banner required | Often (plugins inject trackers) | No (privacy-first analytics) |
The honest math
If your average job value is $500 and a custom site converts even one extra visitor a week into a call, that is $26,000 of additional pipeline a year, before counting the weeks of lost leads if a WordPress site is compromised. If your average job is $5,000, the math is an order of magnitude bigger. For a service business with 5–15 pages and a contact form, WordPress is the wrong shape: you are paying for an editorial CMS you do not need, while inheriting a security and performance burden that costs you customers.
Already on WordPress and tired of maintenance? Free 5-point audit, I run real Lighthouse numbers, real schema checks, and a real conversion-flow review on your URL, and show you exactly what a migration would change.
WordPress is the antithesis of principles 2, 4, and 7. Plugins, runtime, security retainer. The Standard ships a static site with no admin login, no database, and no plugin update treadmill.
Read the seven principles →Tired of WordPress maintenance? Let's talk.
The discovery call runs twenty minutes on Google Meet. I will walk you through what a migration off WordPress would look like, what stays the same (your domain and your content), and what changes for you, including the lead gap that closes the day the new site goes live.