Almost every business we meet is already on WordPress, usually with Elementor or a similar page builder, built by an agency several years ago and barely touched since. It is the default, and for good reason: it runs a large share of the web, every developer knows it, and there is a plugin for everything.
That last point is also the problem. What follows is not an argument that WordPress is bad software. It is an account of what happens to a WordPress site four or five years after launch, which is the state most of them are in when we are called.
What WordPress does well
- Genuinely open source. You can host it anywhere, and no vendor can revoke your access or reprice you out of your own site.
- The largest talent pool of any platform. If your developer disappears, replacing them is straightforward.
- An enormous plugin ecosystem. There is almost nothing you cannot bolt on.
Where it struggles for a growing business
It has the lowest Core Web Vitals pass rate in actual field data
In the HTTP Archive's 2025 Web Almanac, drawn from Chrome field data rather than lab tests, 46% of WordPress sites passed Core Web Vitals on mobile. That was the lowest of ten major platforms measured. Wix passed at 75% and Squarespace at 70%. Two honest qualifiers: those figures are mobile only, and the Almanac itself notes that implementation decisions usually matter more than platform defaults. WordPress is not inherently slow; the long tail of neglected installs loaded with plugins is.
The security exposure is in the plugins, and it is growing
Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, up 42% on 2024. Of those, roughly 96% were in plugins and themes. Only seven were in WordPress core. Core is well maintained. The stack bolted on top of it is the risk.
Keeping it updated is not the same as keeping it safe
In the same dataset, 46% of vulnerabilities disclosed in 2025 had no fix available from the developer at the time of public disclosure, and 1,614 abandoned plugins were removed from the WordPress repository after their authors stopped responding. Patchstack's own conclusion is that site owners cannot rely on plugin updates as a security measure. If a plugin is abandoned, there is no update to install.
Nobody owns the outcome
This is the failure we see most and it is not really technical. A site gets built, the agency moves on, a marketing coordinator adds a page, a plugin auto updates and breaks a layout, and three years later the site quietly misrepresents a business that has doubled in size.
The honest verdict
CHOOSE WORDPRESS IF
- You have your own technical staff who will genuinely maintain it.
- You need a specific plugin ecosystem (WooCommerce, LMS, membership) that would be expensive to rebuild.
- Your content team is already fluent in it and turnover is a real risk.
CHOOSE UNITNINETY IF
- Your site is four or more years old, nobody is confident what the plugins do, and updates are avoided in case something breaks.
- The business has outgrown what the site says about it.
- You want one person accountable for whether it is fast, secure and current, not a plugin vendor you have never heard of.
- You want every change to leave a record, opened as a pull request against your own repository rather than applied by a plugin nobody remembers installing.
Sources
Every figure above is linked so you can check it. Where we have made an argument rather than cited a measurement, we have said so in the text.