Comparison
WordPress + Theme vs. Hand-Coded Custom Website
WordPress powers a huge portion of the internet, and there are good reasons for that. But the way most agencies deliver a "custom" WordPress site — a premium theme, a page builder, and a stack of plugins — is a different animal from a genuinely hand-coded build. Here's what actually differs.
| ArdinGate (hand-coded) | WordPress + Theme/Builder | |
|---|---|---|
| Upfront cost | $1,000–$2,500 one-time | $500–$3,000+ depending on theme/dev |
| Monthly cost | $30–$75 hosting (optional) | $20–$80 (hosting + plugin licenses) |
| Security patches | Not applicable — no CMS, no attack surface | Ongoing — WordPress core + every plugin updates constantly |
| Plugin dependency | Zero plugins | Often 10–30+ plugins, some unmaintained or abandoned |
| Load time (typical) | < 1s first paint | 1.5–4s depending on plugins and theme |
| Core Web Vitals | Pass by default | Often fails on mobile with builders; varies widely |
| Self-editing (CMS) | No — content changes go through the developer | Yes — WordPress admin accessible to non-technical editors |
| Hack risk | Very low — no CMS, no login page to brute-force | Higher — WordPress is the most-targeted CMS on the internet |
| Code ownership | You own the files outright | You own the files, but they require WordPress/PHP to run |
| Support | Same person who built it | Depends on developer — plugin issues often bounce around |
When WordPress is actually the right call
WordPress has one decisive advantage: a full content management system that non-technical people can actually use. If you're running a news site, a high-volume blog, or a business where multiple staff members need to update content without touching code — WordPress is built for that. The same goes for e-commerce builds using WooCommerce, or anything requiring a large library of user-managed content.
The catch is that you don't just get a CMS — you get the full WordPress ecosystem: regular core updates, plugin update cycles, the occasional plugin that breaks on a PHP version bump, and a login page that bots probe constantly. If you're not actively maintaining it or paying someone to do so, most WordPress sites end up outdated within 18 months.
When hand-coded is worth the trade-off
If you don't need to edit your own content daily — and most small service businesses don't — the CMS you're paying to maintain becomes pure overhead. You're taking on security patch cycles, plugin compatibility headaches, and a larger performance footprint in exchange for an admin panel you rarely open. A hand-coded site skips all of that.
The speed difference is real. A hand-coded page with no plugin stack loads in under a second almost automatically. That same page built with a WordPress theme and five or six plugins regularly lands in the 2–4 second range. Core Web Vitals directly affect Google rankings. A slower site isn't just a bad user experience — it actively hurts your SEO.
The security difference is also real. WordPress runs on roughly 40% of the public web, which makes it an enormous and constant target. Plugin vulnerabilities are the leading cause of WordPress compromise — not WordPress itself, but the ecosystem it depends on. A custom PHP site with no CMS has no login page, no plugin surface, and no automated scanner finding it.
The honest summary
WordPress with a well-built custom theme (not a drag-and-drop builder, not Elementor, not Divi) is a legitimate way to build a site. The problem is that most agencies don't do this — they install a theme, stack plugins on top of it, call it "custom," and charge custom-build prices. You end up with something that looks finished but performs like bloatware and needs constant babysitting.
A genuinely hand-coded site has fewer moving parts, lower attack surface, faster load times, and nothing that needs updating except the content. The tradeoff: you can't edit it yourself without touching code, and any content changes go through the developer. For most small service businesses, that's not a problem — they update their site a few times a year at most. For a media company publishing five posts a day, it's a dealbreaker.
Not sure which fits your project?
Describe what you're building and I'll tell you which approach makes sense for your situation.
Ask a question