Why We Don't Use WordPress (And What We Use Instead)

WordPress Is Great - For Some Things

If you're running a blog with hundreds of posts, managing a news publication, or building an e-commerce store with thousands of products through WooCommerce - WordPress is a solid choice. It gives you a content management system, a massive plugin library, and a community of millions of developers who can help when things go sideways.

We've got nothing but respect for what WordPress has done for the web. It democratised website building and gave millions of people a voice online. That's massive.

But here's the thing. Just because a tool is popular doesn't mean it's the right tool for every job. And for the small businesses we work with - cafes, tradies, gyms, salons, consultancies - WordPress is almost always the wrong choice.

For Small Business Websites, It's Overkill

Think about what most local businesses actually need from their website. A homepage. An about page. A services page. Maybe a gallery. A contact form. That's it. Five pages, tops.

To run those five pages on WordPress, you need:

• A PHP runtime environment
• A MySQL database
• A web server (Apache or Nginx)
• The WordPress core (thousands of files)
• A theme (hundreds more files)
• 15-30 plugins for basic functionality
• Monthly hosting that can handle all of the above

That's a full-blown content management system, a database server, and a backend programming language - all to display five pages of mostly static content. It's like renting a warehouse to store a suitcase.

Meanwhile, those same five pages can be built with clean HTML, a bit of CSS, and a sprinkle of JavaScript. No database. No server-side processing. No bloat. Just fast, clean code that does exactly what it needs to do and nothing more.

The Speed Problem

Here's where things get real. The average WordPress site takes 3 to 5 seconds to load. Some are worse. We've audited local business WordPress sites that take 8+ seconds on mobile.

A hand-coded HTML site? 0.5 to 1.5 seconds. Sometimes faster.

Why the massive difference? Every time someone visits a WordPress site, the server has to wake up PHP, query the database, assemble the page from dozens of template files, load the active theme, execute whatever code the 20-odd plugins want to run, and then - finally - send the result to the browser. And that's before the browser starts downloading the CSS, JavaScript, fonts, and images.

Each plugin you install adds weight. Another CSS file. Another JavaScript library. Another HTTP request. Some plugins load their assets on every single page, even if they're only used on one. A contact form plugin that loads its scripts on your homepage? That's WordPress for you.

Google has been crystal clear about this: page speed is a ranking factor. A slow site doesn't just frustrate visitors - it actively pushes you down in search results. And 53% of mobile users abandon sites that take longer than 3 seconds to load. That's more than half your potential customers, gone before they even see what you offer.

The Security Problem

WordPress is the single most targeted platform on the internet for hackers. That's not an opinion - it's a statistical fact. Over 90% of hacked CMS-based websites are running WordPress.

Why? Because it's everywhere, and because its architecture creates a massive attack surface:

• Plugin vulnerabilities - Third-party plugins are the number one entry point. Many are built by solo developers with no security background, rarely audited, and frequently abandoned.
• Outdated themes - Premium themes that haven't been updated in a year become ticking time bombs. Known vulnerabilities get published and bots start scanning for them within hours.
• Brute force attacks - The /wp-admin login page is the same on every WordPress site. Automated bots hammer it with credential combinations 24/7.
• Database injection - Because WordPress relies on a database for everything, SQL injection attacks are a constant threat.

Now compare that to a static HTML site. There's no database to inject into. No admin login to brute-force. No plugins to exploit. No PHP to manipulate. The attack surface is essentially zero. The files just sit there, being served directly to the browser, with nothing to hack.

For a local business, getting hacked isn't just embarrassing - it can be devastating. Google flags your site as unsafe, customers lose trust, and cleaning up a compromised WordPress installation can cost hundreds or thousands of dollars. With a static site, that entire risk category simply doesn't exist.

The Maintenance Problem

Even if your WordPress site hasn't been hacked, it still demands constant attention. WordPress core releases updates every few weeks. Your theme needs updating. Each of your plugins needs updating - on their own schedules.

Skip an update? You're exposed to known security vulnerabilities. Run the updates? There's a decent chance something breaks. Plugin A updates and suddenly conflicts with Plugin B. Your theme update overwrites your customisations. A PHP version change on your host breaks three plugins you forgot you had installed.

We've seen business owners spend hours trying to figure out why their site suddenly shows a white screen of death after a routine update. Or worse, they don't notice their site has been down for three days because they don't check it regularly.

Maintaining a WordPress site properly is genuinely a part-time job. And most small business owners don't have time for a part-time job on top of the full-time job they're already doing - which is, you know, running their actual business.

A static HTML site? Once it's built and deployed, it just works. There are no updates to run. No plugins to patch. No database to maintain. It'll look and function exactly the same in two years as it does today. It's the kind of thing you set and forget - which is exactly what a busy business owner needs.

What We Use Instead

We used to hand-code every site as static HTML, and the points above still hold. These days we build on Shopify, because it keeps most of those benefits while letting you edit your own site and sell online:

• Hosted and maintained for you - Shopify runs the servers, security patches and SSL certificate, so there's no software for you to update and no plugins to patch.
• Fast on mobile - pages and images are served from Shopify's global network, and images are converted to modern formats like WebP automatically.
• Built to sell - an online store, Shopify Payments, Afterpay and NZ shipping are part of the platform, not plugins bolted on later.

We start from one of our ready-made designs and rebuild it with your brand, photos and words, so you're not paying for a site designed from nothing. Every section is there for a reason, and the technical SEO is set up from day one.

But How Do Clients Update Content?

This is the question we get the most, and it's a fair one.

Two ways: do it yourself, or ask us.

Shopify's editor lets you change text, photos, prices and products yourself without breaking the layout. If you'd rather not, send a request through your client portal and we'll do it for you.

And here's the reality most people don't talk about: the average small business updates their website content 2-3 times per year. You shouldn't have to maintain a server, a database and twenty plugins for two or three text changes a year.

So When Does WordPress Make Sense?

We'll always be straight with you. WordPress is still the right call in some situations:

• Content-heavy blogs with hundreds or thousands of posts that need categories, tags, and search
• E-commerce stores with large product catalogues where WooCommerce genuinely shines
• Sites with 50-100+ pages where a CMS makes content management practical at scale
• Multi-author publications where different people need different access levels

If that sounds like your business, WordPress might genuinely be the best option. We'd tell you that.

But if you're a local business that needs a fast, beautiful, secure website that brings in customers and doesn't create headaches - there's a better way. And we'd love to show you what it looks like.