WordPress powers roughly 43% of the web. It is also responsible for the overwhelming majority of hacked CMS sites, a disproportionate share of slow page loads, and a maintenance treadmill that quietly costs Irish businesses thousands of euro over a site's lifetime. This is not an argument that WordPress is bad software. It is an argument that it is the wrong tool for a business website — and that the reason it dominates has almost nothing to do with the people who own the sites.

Why WordPress won (and why that is not a reason to use it)

WordPress won because it is fast to install and thousands of developers can be hired cheaply to assemble it. That is a supply-side advantage: good for the people selling websites, not necessarily for the people buying them. A business owner does not need a general-purpose content management system that can become a forum, a shop, a social network or a learning platform. They need twenty fast pages, a contact form that works, and to not think about it again. Buying WordPress for that is buying a container ship to cross a river.

Speed: the argument with a stopwatch

A typical plugin-stacked WordPress page loads in three to five seconds on a mobile connection. A hand-coded static page loads in well under one. This is not a vanity metric. Google's own research has shown for years that bounce probability climbs sharply after the three-second mark, and Core Web Vitals are a confirmed ranking input. Every second of load time is a measurable tax on both your traffic and your conversions.

The cause is structural. WordPress assembles every page on every visit: PHP executes, the database is queried dozens of times, and a stack of plugins each add their own CSS and JavaScript. Caching layers exist precisely to hide this architecture from itself. A hand-coded site has nothing to hide: the HTML is the page, served as-is, with one stylesheet and no framework overhead. Our builds routinely score 95–100 on Lighthouse — the SecureCloud dashboard holds 97 while rendering ten thousand findings — not through heroics, but because there is nothing to slow them down.

Security: the argument with a breach log

WordPress's own core is reasonably maintained. The problem is the ecosystem: the average business site runs fifteen to twenty-five third-party plugins, each one code you did not write, from a developer you have never met, updated on their schedule. Vulnerability databases have logged tens of thousands of WordPress plugin vulnerabilities; the typical compromise is not a genius attacker but an automated script sweeping the internet for a plugin version that was patched last month and never updated on your site.

A hand-coded static site removes the entire category. No database to inject into, no admin login to brute-force, no plugin supply chain to audit, no PHP runtime to misconfigure. There is simply less to attack — which is why security-conscious organisations default to static architecture for anything public-facing.

SEO: the argument with a ranking report

Ranking is content times authority times technical quality, and technical quality is where WordPress sites quietly bleed. Render-blocking plugin scripts, layout shift from theme bloat, duplicate content from tag and category archives, and the near-impossibility of achieving consistently good Core Web Vitals on a heavy stack. Hand-coded sites win the technical third of the contest by default: semantic HTML, precise control of every meta tag and schema block, and sub-second loads on every page. When two sites have similar content, the faster, cleaner one is the one Google has less reason to demote.

The cost argument nobody runs honestly

The WordPress quote is always cheaper — on day one. Then add premium theme and plugin licences (€300–€800 a year), managed hosting that can survive the stack, maintenance retainers for the update-and-pray cycle, and the rebuild when the theme is abandoned in year four. Over three to five years, the "cheap" WordPress site regularly outcosts the hand-coded one — which has no licences, no update cycle, and nothing to maintain but the content. Our own fixed build prices are public, so run the comparison against a real number rather than a sales call.

Ownership: the argument nobody makes

There is one more difference, and it only becomes visible when something goes wrong. A hand-coded site is a folder of files you own outright: it can be hosted anywhere, moved in an afternoon, and read by any developer on earth. A WordPress site is a runtime dependency chain — this theme, these plugins, this PHP version, this database — and when your developer disappears, the next one inherits a machine they did not build and often cannot safely touch. Ask any Irish business owner who has paid a "rescue fee" to extract their own website from a former supplier. Ownership is not a philosophical point; it is a portability guarantee.

When WordPress is genuinely the right answer

Fairness demands the exceptions. If you publish daily and need multiple non-technical editors, use a CMS. If you run a large catalogue e-commerce operation, use a platform built for it. The argument here is specific: for the standard Irish business website — services, case studies, contact — WordPress is cost, risk and drag that buys you nothing a static site does not do better.

The bottom line

Your website is a sales asset, not a hobby. Hand-coded means faster pages, fewer attack surfaces, cleaner technical SEO, and a three-year cost lower than the "cheap" option. WordPress's 43% share measures how easy it is to sell, not how well it serves the buyer. Choose the tool that benefits you.