WordPress or custom: the four decisions that differ

One. Who patches it. WordPress is a plugin ecosystem, and OWASP's Top 10 lists Vulnerable and Outdated Components as its own category for a reason. The project documents the maintenance surface, and somebody has to own it monthly. Custom code has fewer moving parts and no update channel, which cuts both ways.

Two. The performance ceiling. A custom build can be budgeted against Web Vitals from the first commit. A WordPress site can clear the same thresholds, and the practical guidance is published — but it is work done against a theme and a plugin set rather than designed in.

Three. Who can edit it. WordPress gives a non-technical owner an editor. A custom build means a developer, or a CMS somebody chose for you. In our experience this is the decision made by the agency and regretted by the client.

Four. What happens when you leave. WordPress is portable by default: a host change moves it. Custom code is portable only if the contract says so.

Ranking inputs. There is no stack field. Google's helpful-content guidance and its SEO starter guide apply identically to every one of them.

So the choice is operational. Decide decisions one and three honestly — who patches, who edits — and the rest follows. An agency that leads with custom-is-better-for-SEO has answered a question nobody should be asking.