WordPress for business: what the free software really costs
WordPress powers about 43% of all websites and close to 60% of those that run a content management system, according to W3Techs. The licence is free; the real cost is not. It is paid in maintenance and security, every month, for the whole life of the site. That line item, not the build price, decides whether the choice pays off.
- The real cost of WordPress is not the licence, which is free, but maintenance and security.
- Plugins are both its strength and its main source of vulnerabilities.
- WordPress.org and WordPress.com are two different products, often confused at the moment of choosing.
- A slow WordPress site is almost always slow because of its theme and its plugins, not the software.
- A compromised site costs more in lost sales and reputation than in cleanup fees.
On this page
Content management system
A content management system is software that lets you create, edit and publish the pages of a website without writing code. It separates the content from its presentation, which lets a non-technical team keep a site alive. WordPress is the most widespread of them, ahead of eCommerce platforms and hosted site builders.
The real market share, and why the figures vary
For a management team, WordPress's market share is not a curiosity, it is a risk argument. A widely used technology guarantees you will always find someone to take over the site, which protects you from depending on a single vendor. In return, it draws the bulk of the web's automated attacks, and it is your maintenance budget that pays for it.
If you have ever paid for a site that ended up slowing down, breaking or getting compromised, the cause was almost never the software. You own a site the way you own a commercial vehicle: the purchase price says nothing about the cost of ownership, and it is neglected upkeep that sidelines the tool at the worst moment.
Two sources are authoritative, and they do not give the same figure. Understanding the gap is better than quoting one at random.
W3Techs measures about 43% of all websites and close to 60% of those that use an identifiable content management system. HTTP Archive measures 33% instead.
The gap comes down to method. W3Techs counts the subdomains of a single site, addresses like shop.example.com, as one entry, whereas HTTP Archive counts them separately. HTTP Archive also limits its measure to sites present in the Chrome User Experience Report, which lists only sites actually visited by real users, which leaves out the smallest ones. Both figures are accurate, they simply do not measure the same population. For a business owner, the conclusion fits on one line: whatever figure you keep, the pool of available skills stays the widest on the market, and that is what protects your investment.
| Platform | Share of all sites |
|---|---|
| WordPress | About 43% |
| Shopify | About 4.8% |
| Wix | About 3.7% |
| Squarespace | About 2.3% |
| Joomla | About 1.5% |
| Drupal | About 0.8% |
W3Techs notes that WordPress's share rises to about 49% among the top one million most-visited sites and close to 52% in the top one hundred thousand. So the dominance is not an effect of small-site volume: it shows up at the top of the ranking too.
What to know before choosing or taking over a site
The licence costs nothing, ownership does. Eight thousand two hundred and twenty-three distinct vulnerabilities were published in 2024 across the ecosystem, almost all of them in plugins. The real budget line is monthly maintenance, and a company that does not plan for it will pay for it anyway, in a rush and at a higher price.
- Who applies the updates, how often, and who checks that the site still works afterward?
- How many plugins are installed, and how many are still updated by their author?
- Where are the backups, how often, and when was a restore last tested?
- How many sales do we lose per day if the site goes down, and how long can we hold out?
- Who holds the administrator access, the domain and the hosting, us or our vendor?
A solid answer gives a frequency, a named owner and a date for the last restore test. A vague answer says everything is up to date, or that the host takes care of it.
Deciding whether to take back control of, replace or secure an existing site is a five-figure trade-off. A 90-minute consultation settles it, with a written summary that circulates through your organization.
WordPress.org or WordPress.com
The confusion is common and it has real consequences, because the two products do not offer the same freedoms.
| Criterion | WordPress.org | WordPress.com |
|---|---|---|
| Nature | Software to install | Hosted service |
| Hosting | On you, with the provider of your choice | Included in the subscription |
| Plugins | All, without restriction | Depending on the plan |
| Code | Fully editable | Limited |
| Maintenance | On you | Handled for you |
| Data ownership | Full | Framed by the provider |
The cost of this confusion is paid later, at the moment a needed function turns out to be impossible without changing plans or platforms. For a business that wants to control its site, its data and its evolution, WordPress.org is the default choice. WordPress.com suits a simple project with no particular technical requirement.
The real cost of WordPress is security
The software costs nothing to install. What costs is keeping it up to date, and that burden grows with its popularity.
Security firm Wordfence recorded 8,223 distinct WordPress vulnerabilities published in 2024 alone. The overwhelming majority do not concern the core of the software but the plugins and themes, the modules added to give it functions or an appearance, built by third parties whose quality and longevity vary enormously.
It is the point that website design quotes almost always leave out, because it appears nowhere in a mockup.
Limit the number of plugins
Every plugin is one more door and one more dependency. A plugin installed for a function used twice a year is a permanent risk for a marginal benefit.
Check the vitality before installing
Date of last update, number of active installs, developer responsiveness to reports. An abandoned plugin stays functional for years then becomes a vulnerability.
Apply updates quickly
Most compromises exploit vulnerabilities that have been known and patched for weeks. The delay between a patch's release and its application is the real window of risk.
Keep backups off the server
A backup stored on the same server as the site disappears with it. That is the most common discovery at the moment you need it.
A WordPress site left without updates for a year is not a site that still works. It is a site that has not been attacked yet. The difference shows up at the moment it costs the most.
Only one thing has to stay in-house: ownership of the access. The domain, the hosting and at least one administrator account stay in the company's name, never the vendor's. That is what lets you switch partners without negotiating. Everything else can be delegated, and is delegated better: updates, monitoring, off-server backups and restore tests demand a regularity that no non-technical internal team holds for more than six months. The split to aim for is ownership in-house, execution outside, with a monthly report that proves the work was done.
Why a WordPress site is slow
The complaint is common and usually misdirected. WordPress itself is fast. What slows a site down is the layers added on top.
| Cause | Effect | Fix |
|---|---|---|
| Overloaded multipurpose theme | Unused code loaded on every page | A light theme, or a theme built for the project |
| Stack of plugins | Multiplied queries and scripts | Audit and removal of unneeded plugins |
| Unoptimized images | Excessive page weight | Modern formats and appropriate dimensions |
| Saturated shared hosting | High server response time | Hosting dedicated to WordPress |
| No caching | Every page rebuilt on every visit | Server cache and a content delivery network |
The order matters: changing hosts without removing the unneeded plugins moves the problem without solving it.
When WordPress is not the right choice
Its dominance does not make it the universal answer. Three situations justify going elsewhere.
No resource for maintenance. A company with no one to apply the updates and no budget for external upkeep will be better served by a hosted platform, where security is handled by the provider.
A very complex eCommerce catalogue. WooCommerce, WordPress's eCommerce plugin, covers a large share of needs, but elaborate pricing rules, product configurators or high order volumes often call for a platform designed for that.
A purely editorial site with high performance. An architecture that generates static pages, prebuilt once rather than recomputed on every visit, reaches display times a dynamic site cannot match. These pages are served by a global content delivery network, a set of distributed servers that bring each page closer to its visitor, at the cost of a different way of managing content.
WordPress is free to install and costly to neglect. The budget that matters is not the build, it is the three years that follow.
Falia analysis frameworkA check on your setup
Infrastructure and upkeep questions are covered on the WordPress hosting page. Choosing an eCommerce platform is covered in choosing your eCommerce platform. Performance issues are detailed in the technical checks to run on a site, and the redesign decision in the signals that a redesign is due.
The design framework, with its three readers, is set out in designing for three readers.
Already running a marketing team? See how we plug in as reinforcement on WordPress hosting and maintenance.
Frequently asked questions about WordPress
What share of the web uses WordPress?
About 43% of all websites and close to 60% of those with an identifiable content management system, according to W3Techs. HTTP Archive measures 33% instead, the gap coming from different ways of counting subdomains and low-traffic sites.
What is the difference between WordPress.org and WordPress.com?
WordPress.org is the software you install with the host of your choice, with full control of the code, the plugins and the data. WordPress.com is a hosted service where maintenance is handled but where your freedoms depend on the plan you subscribe to.
Is WordPress secure?
The core of the software is solid and patched quickly. The risk comes from plugins and themes built by third parties. Wordfence recorded 8,223 distinct vulnerabilities published in 2024, the vast majority of them outside the core.
Why is my WordPress site slow?
Almost never because of WordPress itself. The usual causes are a multipurpose theme that loads unused code, a stack of plugins, unoptimized images and a saturated shared host. The order of correction matters.
How many plugins can you install?
There is no fixed limit, but every plugin adds a dependency and an attack surface. The right rule is to remove any plugin whose function is not actually used, rather than aiming for a number.
Is WordPress suitable for eCommerce?
Yes. WordPress handles eCommerce through its WooCommerce plugin, and many catalogues run very well that way. Falia recommends Shopify and Shopify Plus instead: payment, security, updates and scaling are handled by the platform, which takes the most expensive thing to maintain, and the most dangerous to neglect, off your site. WordPress remains our ground for content sites and corporate sites.
- W3Techs, Usage statistics and market share of WordPress, accessed July 2026.
- W3Techs, Usage statistics of content management systems, accessed July 2026.
- HTTP Archive, Web Almanac, CMS chapter, accessed July 2026.
- Wordfence, annual reports on WordPress vulnerabilities, accessed July 2026.
Gabriel almost always takes your first call and carries out your audit. He builds the strategy starting from your growth goal: where to put your budget, which market to test and how to connect each lead to a real sale in your CRM. He mainly leads engagements for three goals: Optimize the profitability of your digital campaigns, Develop a new market, and Generate demand and growth. With Geneviève, he also works on organic search (SEO), AI visibility (GEO) and conversion rate optimization (CRO). The sales a Google Ads or Meta Ads campaign brings in depend on the page that receives the click. He writes mainly about marketing strategy, paid advertising and measurement.
About Falia →
SEO
Paid advertising
Conversion
AI visibility
Web design