We once rebuilt a WordPress site that ran on Elementor into clean, custom PHP. The new site was faster, which we expected. What we didn't expect was what turned up in the old backups: SSH keys and database credentials, exposed in archive files that had piled up over the years. Nobody had done anything wrong on purpose. Nobody had looked inside those files either.
That's the part of the custom website vs WordPress debate most comparisons skip. They compare build price and the editor. For a business with 20 or 200 staff, the bigger costs arrive later.
The short answer: for an established small or mid-sized business with a real brand and a steady flow of inquiries, a custom-built website usually wins on speed, security and three-year cost, provided the people who build it also maintain it. WordPress is the sensible choice when you need a large plugin library and lots of staff editing content. AI builders are fine for a one-person business testing an idea, and a poor fit for almost everyone else.
What the three options actually are in 2026
A custom, hand-coded website is written directly in HTML, CSS, JavaScript and usually PHP with MySQL. No page builder, and no third-party plugins unless someone deliberately adds one.
WordPress with a page builder runs roughly 64% of CMS-powered sites on mobile, according to the 2025 Web Almanac from HTTP Archive. On top sits a visual builder such as Elementor, plus plugins for forms, SEO, caching, backups and sliders.
AI website builders come in two kinds. Hosted builders like Wix Harmony, launched in January 2026, or Framer, where you describe the site in plain English and an assistant builds it. And "vibe coding" tools like Lovable, which generate a full app with a database from a prompt. They get lumped together, but they're very different products.
Speed: where custom and WordPress part ways
Google's Core Web Vitals score how quickly a page shows its main content, how fast it reacts to a tap and whether things jump around while loading. The 2025 Web Almanac found that only 45% of WordPress sites passed on mobile. Wix, running on a tightly managed platform, came in at 74%. That's a real point in Wix's favor, and it's fair to say so.
WordPress isn't slow by nature. It gets slow because each plugin adds its own scripts and stylesheets, and a page builder wraps every heading in several layers of markup. Open the source of a typical Elementor page and a single heading often sits inside five or six nested div elements. A mid-range Android phone on a weak mobile signal has to chew through all of it.
A hand-coded page ships only what that page uses. There's nothing to strip out because nothing was added. We've written about why in detail in why hand-coded websites load faster, including what we remove first when we audit a slow site.
Wix's lead mostly disappears against a well-built custom site. Its lead over an average WordPress install doesn't.
Security and the maintenance you sign up for
WordPress: the plugins are the problem
WordPress core itself is well looked after. Patchstack's State of WordPress Security in 2026 report logged 11,334 new vulnerabilities across the WordPress world in 2025, up 42% on the year before. Only six were in core. 91% were in plugins and the rest in themes.
Two more numbers from the same report matter for a business owner. 46% of those vulnerabilities had no fix available by the time they were publicly disclosed. And the median time from disclosure to mass exploitation was five hours. A site updated "once a month" is exposed for weeks.
Paying for plugins doesn't help: premium and freemium components had three times more known exploited vulnerabilities than free ones.
So a WordPress site with 25 plugins is really 26 pieces of software from 26 different teams. Someone has to update them weekly and check nothing broke afterwards. If nobody's doing that, the site is exposed. If someone is, you're paying for it.
Custom: a smaller target, but only if it's built properly
A hand-coded site has a far smaller attack surface: no public plugin with a known flaw for bots to scan for, and no admin login at a URL every attacker knows. But custom isn't automatically safe. Careless custom code is worse than a well-maintained WordPress site, because nobody else is looking at it. What makes it secure is the person who wrote it: form validation, prepared database queries, secrets kept outside the web root, locked-down admin pages. If you're comparing agencies, ask to see how they handle those four things. Our security checklist for AI-built websites covers the same ground and works for any custom build.
AI builders: depends which kind
Hosted builders like Wix patch for you. That's a real benefit.
App-generating tools are a different story. In 2025 a flaw in how Lovable-generated apps set up their database permissions was logged as CVE-2025-48757. The official entry says it let unauthenticated attackers read or write arbitrary database tables on affected sites. Lovable disputes the classification, arguing its customers are responsible for protecting their own data. Which, from a business owner's point of view, is exactly the problem: the tool built it, but you own the risk.
Who can edit the content?
WordPress wins this one for most teams, and it's the main reason it's so popular. Your marketing person can publish a post or change a phone number without calling anyone. Wix and Framer are arguably easier still.
A hand-coded site needs a developer for changes, unless it's built with a simple admin area for the parts you change often (news, products, job openings). That's how we build for clients who update weekly. For clients who change their site twice a year, an email to us is faster than learning an editor.
Worth asking yourself: how often has anyone in your business actually edited the current site in the last six months? The answer is often "once, and it broke the layout".
SEO control
All three can rank. WordPress gives good control through SEO plugins. Wix ships sensible defaults, but you work inside what the platform lets you change. With a custom site, every title tag, redirect, schema block and image format is in your developer's hands, and the clean structure AI Overviews, ChatGPT and Perplexity favor comes by default. More on that in how to get found on Google and AI search.
Lock-in and ownership
This is where Wix vs a custom website stops being a close call.
Wix's own help center is plain about it: a Wix site can't be exported to another host, because it's a hosted service and your site has to run on Wix's servers. Your text and images are yours; the site isn't portable. If prices rise, you accept it or rebuild from scratch.
Payments are part of the lock-in question too. A hosted builder only works with the payment providers the platform supports, so if your finance team already runs on a particular processor, check that it's on the list before you commit. A custom site can connect directly to Stripe, PayPal, Square or Authorize.net, and WordPress can do the same through a plugin.
WordPress and custom code both move to any host. The catch is who holds the keys. We still meet businesses whose domain or hosting account is registered to a former developer, and portable code doesn't help if you can't log in. Whatever you choose, the domain, hosting and ad accounts should be in your company's name from day one. More on that in who actually owns your website.
What each option costs over three years
On an AI builder, you pay a monthly subscription forever. Wix's Business plan was listed at $39.77 a month on annual billing when we checked its pricing page. Over three years that's about $1,430. Apps from the Wix marketplace are often extra. And at the end of three years you own nothing you can move.
WordPress starts cheap and gets more expensive as it grows. Add annual licenses for premium plugins and the page builder, hosting that can cope with a heavy site, and someone's time every week for updates. Then the hidden one: after a few years, many page-builder sites get so slow and tangled that the honest advice is to rebuild. That's paying for the same site twice.
A custom site usually costs more upfront than a template WordPress build. For reference, see our packages and USD pricing. After launch there are no plugin licenses to renew and far less to update, so maintenance is lighter. And a properly built custom site doesn't hit the same "rebuild or suffer" wall.
We won't put one three-year total on each option, because it depends on plugins, content and who maintains it. But when you get quotes, ask for the three-year number, not the build number.
Custom website vs WordPress vs AI builder, side by side
| Custom, hand-coded | WordPress + page builder | AI website builder | |
|---|---|---|---|
| Speed | Fastest when built well; only loads what each page needs | Often slow; 45% passed Core Web Vitals on mobile in 2025 | Hosted builders do well (Wix 74%); app generators vary |
| Security upkeep | Small attack surface; depends on the developer's standards | Weekly plugin updates; 91% of 2025 WordPress vulnerabilities were in plugins | Wix patches for you; app generators leave it to you |
| Content editing | Via a custom admin area, or your developer | Easy for staff | Easiest |
| SEO control | Total | High, through plugins | Limited to what the platform allows |
| Portability | Move to any host | Move to any host | Wix sites can't be exported |
| Payment processor | Integrated directly | Via plugin | Limited to the providers the platform supports |
| Three-year cost pattern | Higher upfront, low ongoing | Lower upfront, rising licenses and upkeep | Low upfront, subscription forever |
| Scales with the business | Yes, anything can be added | Yes, but each addition adds weight | Within the platform's limits |
Which one should you pick?
A rough guide, based on the businesses we see every week.
- You're a sole proprietor or testing an idea. Use Wix, Framer or similar. Spend the money on your product, not your website. Revisit it once inquiries are coming in.
- You're a publisher, or five people post content daily. WordPress makes sense. Keep plugins to a minimum, skip the heavy page builder if you can, and pay someone to update it weekly.
- You need an unusual app fast, and it will hold no customer data. An AI app generator is a reasonable prototype. Get a developer to review it before real customer details go anywhere near it.
- You're an established business whose website brings in quotes, bookings or sales. Custom-built, by people who will still be maintaining it in three years. This is where speed, security and total cost all point the same way.
"Who will maintain it" is the bit to press on. A custom site handed over by a freelancer who then moves on is worse than a WordPress site anyone can pick up. Ask who hosts it, who fixes it at 9pm, and what happens if their code breaks. Our answer: our own server team runs the hosting in-house, and if something breaks because of how we built it, we fix it free for the life of the site. Any agency building custom should be willing to say something similar.
If you want to see what a switch looks like in practice, we've written up a page-builder to custom code rebuild, including the backup problem from the top of this post.
The site you want is the one nobody in your office thinks about. It loads before the customer loses interest, and there's no Monday-morning message saying the contact form stopped working over the weekend. All three routes can get you a nice homepage. Only one tends to stay that way without constant attention.
If you're weighing a rebuild, send us your current site's link. We'll tell you honestly whether it needs replacing or just a good clean-up.
Frequently asked questions
Is a custom website better than WordPress?
For an established business that relies on its site for leads or sales, usually yes: it loads faster, has far fewer third-party parts to patch and costs less to keep running. WordPress is the better choice if many staff need to publish content daily and you're willing to pay for weekly plugin maintenance.
Is a hand-coded website harder to update?
Only if it's built without an admin area. A good custom build includes simple editing for the sections you change often, like news, products or team members. For layout changes you'd contact your developer, which is often quicker than doing it yourself in a page builder.
Can I move my Wix website to another host?
No. Wix states that sites run only on its own servers and can't be exported. You can take your text and images with you, but the site itself would need to be rebuilt elsewhere.
Why is my WordPress site so slow?
Usually it's the page builder and the number of plugins, each loading its own scripts on every page. Cheap shared hosting makes it worse. Only 45% of WordPress sites passed Google's Core Web Vitals on mobile in HTTP Archive's 2025 data.
Are AI website builders good enough for a business website?
For a one-person business or a quick test, yes. For a company with real inquiries, customer data or online payments, the lock-in, limited control and security questions around app-generating tools make them a risky foundation.