What WordPress actually is

WordPress is free, open-source content management software that you, or someone acting for you, installs on hosting of your choosing. It is not a company you subscribe to and it does not host anything itself — those two facts explain almost everything else about it, including why it is simultaneously the cheapest option on paper and the one with the least predictable ongoing cost.

WordPress.org versus WordPress.com, named explicitly

This page describes WordPress.org — the free, open-source software downloaded and installed on hosting you choose, which is what “WordPress” means everywhere else on this page. WordPress.com is a separate, related but commercially distinct hosted service, run by Automattic, that installs and manages that same core software for you on its own infrastructure, in exchange for a subscription and with real limits on plugin and theme freedom at its lower tiers. Confusing the two is common and consequential: a business told “get a WordPress site” and signing up for WordPress.com is buying a materially different, more constrained product than the self-hosted WordPress.org software the rest of this page is about.

What “open source” means in practice

The software itself has no licence fee. Anyone can install it, inspect its code, and extend it, and a very large global community does exactly that. That openness produced the largest plugin and theme ecosystem of any web platform — tens of thousands of add-ons covering almost any function a business site might need, from bookings to memberships to full storefronts through WooCommerce.

It also means nobody is responsible for your particular installation except whoever you nominate. There is no WordPress support line to call when a plugin conflict brings a page down. That responsibility sits with your host, your developer, or you, in whatever combination you have arranged — and if that combination is “nobody,” the site is unmaintained whether or not anyone intended it to be.

The three WordPress layers you actually own: core, theme and plugins

A WordPress site is built from three separable layers: the WordPress core itself, a theme controlling appearance, and plugins adding function. Each updates independently, on its own schedule, and each can conflict with either of the other two after an update. This is the direct source of WordPress’s reputation for occasionally breaking after routine maintenance — not because the software is fragile, but because it is an assembly of independently maintained parts rather than one vendor’s single, internally-tested product.

Page building happens two ways inside that structure. The native block editor, Gutenberg, builds pages from WordPress’s own block system and stores content in a comparatively portable format. Visual page-builder plugins — a distinct, popular category layered on top — offer more design freedom at the cost of storing layout in the plugin’s own proprietary markup, which is a real switching cost if that plugin is ever abandoned or replaced.

What WordPress costs you in flexibility, both ways

WordPress’s flexibility is genuine and it runs in the direction people expect: there is very little a self-hosted stack cannot eventually be made to do, because it is not one company’s product roadmap that has to agree to build the feature. Custom functionality, unusual content structures, a membership area alongside a shop, all of it is achievable without leaving the platform.

The cost runs the other way, and it is less often stated upfront. Choosing WordPress is choosing to be, functionally, the operator of your own small piece of infrastructure. Someone has to apply core, theme and plugin updates on a schedule. Someone has to hold a working backup and have actually tested that it restores. Someone has to notice when a plugin is abandoned by its developer and stops receiving security fixes, which happens constantly across an ecosystem this large. None of that is optional maintenance in the way it might be on a hosted platform — it is the price of the flexibility, paid continuously rather than once.

Hosting freedom, and what it actually requires

Because WordPress is not tied to one host, you can move it to whichever hosting suits — shared, VPS, or a host that specialises in managed WordPress and handles the update and backup layer for a fee. That last option is worth naming explicitly: a large part of what a “managed WordPress host” sells is exactly the maintenance obligation described above, repackaged as a hosting feature. It is a legitimate way to buy back the labour, and it is worth pricing against a maintenance provider doing the same job, because the two are competing for the same task.

WordPress’s plugin ecosystem size is a feature and a diligence burden at once

Because anyone can publish a plugin, quality and maintenance standards vary enormously across a catalogue this large — two plugins solving the identical problem can differ hugely in how actively they are kept current, how responsive their developer is to a reported security issue, and how many other installations depend on the same code (a rough, useful signal for how quickly a serious flaw is likely to be noticed and fixed). None of this is visible from a plugin’s marketing description alone, which is why checking an update history and support activity before installing anything matters as much as checking what the plugin claims to do.

Where WordPress sits relative to a fully custom build

WordPress is not the most flexible option available — a fully custom build, covered in what a custom-built website actually is, has no ceiling at all because nothing about it is pre-built. WordPress sits a step below that: extremely flexible within the bounds of what a plugin, theme or a developer’s custom code can extend it to do, at a fraction of a custom build’s cost for anything the ecosystem already solves well. The practical question for most small businesses is not “does WordPress do everything a custom build could” — it does not — but “does it do everything this particular business actually needs,” which it very often does, cheaply, through existing plugins rather than bespoke development.

Who WordPress genuinely suits

WordPress suits a business whose content does real work — a publishing schedule, long or technical explanations, a site that already has an established search position built on WordPress, or requirements unusual enough that a hosted platform’s boundaries would be a real constraint. It also suits a business with, or willing to fund, an ongoing maintenance relationship, because that is not an optional extra on this platform, it is the operating cost of the flexibility.

It suits it less where nobody in the business will ever hold a maintenance relationship with anyone. An abandoned WordPress installation is a specific and well-understood security exposure, covered in why small-business websites get compromised, and it is the most common failure mode this platform produces — not a dramatic hack, just an accumulation of unpatched software nobody was watching.

Where to go from here

If content and search visibility are the deciding factor, the comparable hosted option built specifically for commerce is Shopify. If the deciding factor is who bears the maintenance obligation at all, that trade-off is set out directly in website builder versus CMS. And where a WordPress build needs an actual figure attached to it, that lives on what drives the cost of a website, which prices the work rather than the software.