The short answer: yes, WordPress is still worth it if you need what it's good at and you have someone keeping it updated. If your site is a ten to forty page brochure for a service business and nobody's maintaining it, 2026 has made it a risky and expensive way to run one.
Where WordPress still wins
WordPress is free, open-source software that you install on hosting in your own name, so nobody can switch it off or put the price up. That ownership is still its biggest strength, and a few jobs are still easier on WordPress than anywhere else:
- Big content sites. Hundreds of guides, case studies or news posts, with categories and authors.
- Features from plugins. Bookings, memberships, events and learning platforms, without paying a developer to build them.
- Selling alongside services. WooCommerce adds a shop without moving platform.
- Teams who edit every day. A familiar dashboard that staff can use with little training.
If that's you, WordPress is very likely still the right choice. The question is whether it's being looked after.
What's changed in 2026
Three things have made running WordPress harder this year:
- PHP itself became a target. On 21 October 2026 the PHP project shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, and attacks started before the patches came out. Every self-hosted WordPress site depends on its host updating PHP. We explain what to do in our PHP2Shell guide.
- Older PHP versions are running out. PHP 8.1 no longer gets official fixes, and PHP 8.2 stops receiving security updates on 31 December 2026.
- Plugins carry most of the risk. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024. 91% were in plugins, 46% had no fix when they were made public, and the most heavily exploited were attacked at scale within a median of five hours.
None of this makes WordPress unsafe by design. It makes an unmaintained WordPress site unsafe, and the gap between "maintained" and "unmaintained" has never mattered more.
Three years of running costs compared
Build costs vary with every project, so this table leaves them out and compares only what you'd pay to keep a small business site online for three years. The monthly ranges come from our UK website cost guide.
| Option | Typical monthly cost | Over 3 years |
|---|---|---|
| WordPress, hosting only | £5 to £30 | £180 to £1,080 |
| WordPress, hosting plus maintenance | £55 to £180 | £1,980 to £6,480 |
| Wix or Squarespace plan | £10 to £35 | £360 to £1,260 |
| Shopify plan | £19 to £65, plus card fees | £684 to £2,340 |
| Astro site on Cloudflare | £0 for hosting | £0 |
Add your domain name to every row, usually around £10 to £20 a year, and business email if you pay for it. The WordPress hosting-only row is cheap on paper, but it assumes someone updates PHP, the theme and every plugin for free, which is rarely true for long.
Stay on WordPress or move?
You should probably stay on WordPress if:
- You publish a lot of content, or several people edit the site every week
- You depend on plugins for bookings, memberships or a shop
- Your host or a developer already keeps everything updated, and you can see it happening
You should probably move if:
- The site is a brochure that changes a few times a month
- Nobody has updated the plugins in months, or you don't know your PHP version
- You're paying for maintenance just to keep a simple site standing still
If you move, there are two honest routes. A website builder such as Wix or Squarespace takes the maintenance away, but you'll pay a monthly plan for as long as the site exists. A static site built with Astro and hosted on Cloudflare has no PHP, plugins or database to maintain and no hosting bill. Cloudflare bought the team behind Astro in January 2026 and has since launched EmDash, an Astro-based CMS it calls a modern successor to WordPress, so it isn't a fringe choice. We compare all three on our WordPress alternative page.
Whichever way you go, a move doesn't have to cost you your Google rankings. Every old address gets a permanent redirect to its new one, the same process we use on every website redesign.
Questions people ask
Is WordPress dying?
Is WordPress still good for SEO?
What is the cheapest way to run a small business website in 2026?
Should I move my WordPress site to Wix or Squarespace?
Sources
- Patchstack: State of WordPress Security in 2026
- php.net: supported versions
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
- Cloudflare: Cloudflare acquires Astro (press release, 16 January 2026)
- ITdaily: Cloudflare launches EmDash
- Cloudflare docs: static assets are free and unlimited
