Ask David! Question
“I am building a website with my partner. He wants to use WordPress to build it, saying that 50% of the websites use it, so it must be good. I point to the high maintenance, and that hacked WordPress websites are way too common. We will need to use many plugins for the features we need, but UltimateWB has everything we need built-in. Einstein’s quote that insanity is trying the same thing over and over again and expecting different results didn’t work on him. I want to use UltimateWB. Help!”
David’s Answer
First, a small correction. Your partner’s “50% of the web” figure is a little high. As of October 2026, WordPress powers about 40.2% of all websites.
That is still an enormous share of the web. There is no question that WordPress is popular, and that popularity has real advantages. There is a huge community, countless tutorials, and an enormous ecosystem of themes and plugins.
But popularity doesn’t answer the question you actually need to answer: what platform makes the most sense for the website you two are building?
You already know you will need many plugins for the features you want. You are also concerned about maintenance and security. Those are the things I would be looking at, rather than simply counting how many other websites use the platform.
And who hasn’t used that Einstein quote at some time?! In this case, it fits your argument pretty well.
If you already know you don’t want to deal with plugin maintenance and security problems, why choose a setup that creates more of those same problems and then expect your experience to be different?
If I were sitting down with both of you over coffee, I wouldn’t ask:
“Which platform is more popular?”
I would ask:
“What do you want to be doing two years from now: growing your website, or maintaining it?”
That is really what this decision comes down to.
Popularity alone does not tell you whether it is the right engineering platform for your project.
Instead of debating opinions, let’s compare what life looks like after your website launches.
WordPress vs. UltimateWB
| Feature | 🛠️ WordPress | 💎 UltimateWB |
|---|---|---|
| Core Functionality | Extended through plugins for advanced functionality. | Major website features such as e-commerce, directories, memberships, forms, and SEO tools are built in. |
| Security Profile | Depends heavily on third-party plugins and themes, requiring ongoing monitoring and updates. | Built-in functionality developed and maintained as part of one integrated platform. |
| Maintenance | Regular plugin, theme, and core updates requiring compatibility checks. | Centralized software updates with fewer moving parts. |
| Performance | Can become slower as additional plugins and database queries are added. | Lightweight, streamlined architecture designed for speed and clean code. |
| Ownership | Yes, when self-hosted and not using subscription-based plugins. See Do you really own your WordPress website? | Yes. You have complete control over your files, hosting, and database. |
The Popularity Argument Is a Double-Edged Sword
WordPress’s popularity is both one of its greatest strengths and one of its biggest challenges.
A Bigger Target
Because WordPress is the world’s most widely used CMS, attackers spend enormous amounts of time discovering and automating exploits against WordPress installations and the surrounding plugin ecosystem.
Automated bots scan the internet for outdated plugins, vulnerable themes, weak passwords, and other common vulnerabilities.
That does not mean every WordPress website gets hacked.
It does mean that WordPress sites are frequently targeted because attackers know they can potentially reach a very large number of websites by exploiting common vulnerabilities.
UltimateWB takes a different approach, with major website functionality built directly into the platform instead of requiring a large collection of third-party extensions.
The Plugin Dependency
WordPress is designed to be extended through plugins. This is another double-edged sword.
WordPress plugins allow website owners to add almost any functionality they need.
However, they also introduce another layer of maintenance.
To add advanced features like custom forms, e-commerce, member directories, or granular SEO functionality, many WordPress websites rely on third-party plugins.
Many business websites end up relying on a collection of plugins created by different developers.
Each plugin has its own:
- Release schedule
- Coding practices
- Support quality
- Security history
- Compatibility requirements
Every additional plugin becomes another piece of software that needs updates, testing, and monitoring.
Where Many WordPress Vulnerabilities Come From
Most newly reported WordPress vulnerabilities are found in third-party plugins and themes rather than WordPress core itself.
When you build on WordPress, you are not only trusting WordPress.
You are also trusting every plugin developer whose software becomes part of your website.
We explain the WordPress plugin security issue in more detail in our article:
Why do WordPress websites and blogs get hacked so much?
Even highly reputable plugins are not immune.
Supply-chain attacks have shown that attackers can compromise trusted software updates and distribute malicious code through software that website owners believed was safe.
We covered a major real-world example in:
Over 1.6 Million WordPress Sites Hit: The OptinMonster and ShapedPlugin Supply Chain Attacks
How I’d Explain It to Your Partner
You’ve already made the case for why you’re concerned about WordPress. I’d explain it to your partner this way:
“If we choose WordPress, we aren’t just building a website once. We are also signing up to maintain a complex ecosystem of separate plugins for years to come.
We’ll spend time installing updates, checking compatibility, troubleshooting conflicts, and making sure our website continues working properly after changes are made.
With UltimateWB, everything we need is already engineered directly into the core platform by the same team. The software is designed as one integrated system instead of dozens of separate components from different developers.
That means less maintenance, fewer compatibility headaches, and more time spent actually launching and running our business.”
That is the difference I would focus on.
It is not just about what features a platform has today.
It is about what managing that platform looks like six months, two years, or five years after launch.
We’ve seen this firsthand with WordPress updates changing website designs even when the site owner didn’t intentionally change the design. See How WordPress Updates Broke This Website Design (And How UltimateWB Solved It).
Since you’re concerned about website maintenance, this guide may also be helpful:
How to Find a Website Builder with Low Maintenance Requirements
Think About the Opportunity Cost
Every hour spent updating plugins, troubleshooting conflicts, recovering from a broken update, or investigating security alerts is an hour that you are not spending on:
- Creating content
- Improving your search engine optimization (SEO)
- Serving your clients
- Growing your business
Choosing a website platform is not just about choosing software.
You are choosing how you will spend your time over the next several years.
WordPress & Plugins Frequently Asked Questions (FAQ)
Can’t we just install security plugins to protect WordPress?
First, a security plugin is another piece of software that has to be maintained. It can also consume significant CPU, RAM, and database resources. For example, malware scanning and live-traffic logging can generate substantial server activity, particularly on higher-traffic websites.
More importantly, a security plugin cannot protect you from every type of attack. If a trusted plugin is compromised and a malicious update is distributed through its legitimate update mechanism, the security plugin may have no opportunity to stop the initial compromise. The same applies when malicious code is injected upstream through a service or delivery network.
That’s what makes the supply-chain issue particularly important. Adding a security plugin does not eliminate the risks created by having many independent third-party plugins in the first place.
The better approach is to reduce the number of independent components your website depends on.
With UltimateWB, major functionality such as e-commerce, social networking, member systems, and forms is built into the platform rather than added through a collection of unrelated third-party plugins. Security can also be handled at the infrastructure level, including firewall and WAF protection, rather than relying entirely on another plugin running inside the website.
We explain the performance, maintenance, and supply-chain issues in more detail in:
The Hidden Cost of WordPress Security: Why Security Plugins Aren’t the Whole Answer
What happens if a WordPress plugin is abandoned or its developer changes it?
This is another issue with relying on third-party plugins for important parts of your website.
If a plugin developer stops maintaining a plugin, the plugin can eventually become outdated, incompatible with newer versions of WordPress or other plugins, or have security vulnerabilities that are no longer being fixed.
The developer can also change the plugin in ways you don’t want, including changing its features, pricing, or how it works. A plugin you originally chose because it worked one way may not remain the same forever.
There are real examples of this happening. For example:
WordPress Kirki Customizer Takeover: The Automatic Bait-and-Switch Plugin Trend
That leaves you with a choice: keep using an outdated or changed plugin, find a replacement, or pay another developer to recreate the functionality you had.
That is one reason I prefer having major website functionality built into the platform itself. With UltimateWB, features such as e-commerce, memberships, forms, directories, social networking, and other website functionality are developed and maintained as part of the same platform instead of depending on a separate plugin developer for each feature.
We cover real examples of abandoned WordPress plugins, changed features, ownership transfers, pricing changes, and other problems with third-party plugin dependency in:
Why Relying on WordPress Plugins Can Backfire (And How to Avoid It)
What happens when we uninstall a WordPress plugin?
Deactivating and uninstalling a WordPress plugin does not always mean everything it added to your website is removed.
Some plugins can leave behind database tables, files, or changes to your .htaccess file. This can happen because a plugin does not properly clean up after itself, or because it intentionally retains data in case you reinstall it.
We explain what can be left behind, and how to clean it up, in:
Do WordPress plugins sometimes leave stuff on your website after uninstalling the plugin?
With UltimateWB, built-in features can be enabled or disabled without having to install and later remove a separate third-party plugin.
David’s Final Thoughts
Do you want to spend your time growing your website, or playing digital janitor to keep it online?
If your goal is to focus on your business instead of managing plugins, updates, compatibility issues, and ongoing security concerns, an integrated platform with fewer moving parts is worth considering.
Good luck with the project. And if your partner still isn’t convinced, maybe have them read this article. It might help frame the conversation in a different way. 😉
— David
Related
The WordPress Backdoor Scandal: Why 30+ “Trusted” Plugins Just Turned Malicious
WordPress 7.1 Broke WP Rocket: The Fatal Error and the Plugin Problem
The Latest WordPress Core Exploit (wp2shell) and Why Forced Updates Break Websites
And in case you are on WordPress right now:
Thinking About Switching From WordPress? What Should You Consider Before You Move?
Ready to design & build your own website with a low-maintenance website builder? Learn more about UltimateWB! We also offer web design packages if you would like your website designed and built for you.
Got a techy/website question? Whether it’s about UltimateWB or another website builder, web hosting, or other aspects of websites, just send in your question in the “Ask David!” form. We will email you when the answer is posted on the UltimateWB “Ask David!” section.