Last year, a client in Kampala rang us in a panic. Their WordPress site had been hacked — for the third time in eighteen months. Customer data exposed. Google had flagged the domain as unsafe. Their developer couldn't be reached. The hosting company pointed fingers at outdated plugins. Nobody took responsibility, and the business was bleeding trust with every hour the site stayed down.
That phone call was not unusual. We hear variations of it every month.
WordPress powers roughly 43 per cent of websites worldwide, and that dominance creates a dangerous assumption: if everyone uses it, it must be the right choice. But popularity and suitability are not the same thing. After years of building, rescuing, and eventually walking away from WordPress projects, we made a deliberate decision to stop using it. This article explains why — and what we build instead.
WordPress Was Built for Blogs, Not Business Tools
WordPress started in 2003 as blogging software. That origin still defines its architecture. Every page request hits a database. Every visitor triggers PHP execution on the server. Every feature beyond basic text publishing requires a plugin.
For a personal blog, this works fine. For a business website that needs to load fast, stay secure, and represent a professional brand, it becomes a liability.
The core problem is architectural. WordPress generates pages dynamically — assembling HTML from database queries each time someone visits. A static website, by contrast, serves pre-built HTML files directly. No database. No server-side processing. No moving parts to break.
Think of it this way: WordPress is a chef who cooks your meal from scratch every time you order, even when you order the same dish. A static site is a well-stocked buffet — everything prepared in advance, served instantly, and impossible to contaminate through the kitchen.
That architectural difference drives every problem we cover below.
The Security Problem Nobody Mentions at the Sales Meeting
Here is a number that should concern every business owner: WordPress accounts for over 90 per cent of all hacked CMS platforms. Not because it is inherently terrible software, but because of three factors that compound each other.
First, the plugin ecosystem. The average WordPress site runs 20 to 30 plugins. Each plugin is code written by a third party — sometimes a professional team, sometimes a single developer working evenings. Every plugin is a potential entry point. In 2025 alone, security researchers disclosed over 7,000 WordPress plugin vulnerabilities. That is roughly 19 new vulnerabilities every single day.
Second, the update treadmill. WordPress core, themes, and plugins all require regular updates. Miss one, and you have an unpatched vulnerability sitting on a public-facing server. Most small businesses don't have staff monitoring WordPress updates weekly. They set it up, forget it, and hope for the best.
Third, the target surface. Because WordPress is so common, attackers automate their exploits. Bots scan the internet for WordPress installations and test known vulnerabilities continuously. Your site doesn't need to be important to be attacked. It just needs to be running WordPress.
A static website eliminates this entire category of risk. There is no database to inject. No PHP to exploit. No plugins to patch. No admin login page for bots to brute-force. The server delivers flat HTML files — and you cannot hack a file that doesn't execute code.
We don't claim static sites are invulnerable. But the attack surface shrinks from a sprawling apartment complex to a locked filing cabinet.
Every WordPress Site Looks the Same — And Your Customers Notice
Open five WordPress business websites in separate tabs. Chances are three of them use the same layout: hero image with text overlay, three feature cards below, testimonial slider, contact form at the bottom. Different colours, same skeleton.
This sameness isn't accidental. WordPress themes are designed to be generic — they must work for a bakery in Birmingham and a law firm in Lagos. The result is websites that look adequate but never distinctive. They communicate "we bought a template" rather than "we built something for our business."
I have sat with business owners who were genuinely surprised to see their competitor's website looked nearly identical to theirs. Same theme. Same structure. Even some of the same stock photography. For the customer visiting both sites, the message is clear: neither company invested enough to stand out.
Custom WordPress themes exist, certainly. But they cost more than most businesses expect, and they still carry all the security and performance baggage of the platform underneath.
When we build a site, we start from the company's actual brand, industry, and audience. No templates. No themes. No pre-built layouts. Every page is designed for that specific business. The fonts, colours, spacing, and layout reflect who the company is — not what came bundled with a WordPress package.
What Happens When Your Page Takes 8 Seconds to Load in Kampala
Performance matters everywhere. In East Africa, it matters more.
Mobile data isn't cheap. Network speeds fluctuate. Many users browse on mid-range phones. A WordPress site that feels acceptable on fibre in Kololo can become unusable on 3G in Mukono. And Google measures this — page speed directly affects search rankings.
The average WordPress site loads in 3 to 5 seconds on a good connection. Add a few unoptimised plugins, a heavy theme, and large images, and that number climbs past 8 seconds. Research consistently shows that 53 per cent of mobile visitors abandon a site that takes longer than 3 seconds.
Static sites are measurably faster. Our builds routinely score 95 to 100 on Google Lighthouse performance tests. Pages load in under 1 second on decent connections and remain usable on slow ones because the files are small and pre-built.
The difference comes down to mechanics. A WordPress page might require 15 to 30 HTTP requests — loading the theme, stylesheets, multiple plugin scripts, fonts from Google's servers, and analytics trackers. Our static builds typically need 3 to 5 requests. Fonts are self-hosted. JavaScript is minimal. Images are compressed and served in modern formats automatically.
For a business trying to reach customers across East Africa, that performance gap isn't theoretical. It's the difference between a visitor who sees your services page and one who hits the back button before it finishes loading.
The Costs That Show Up After the Invoice
WordPress is technically free. The software costs nothing to download. This is the pitch, and it is technically accurate — in the same way that a free puppy is free until you start paying for food, vet bills, and chewed furniture.
Here is what a WordPress website actually costs over three years:
Hosting. WordPress needs server-side PHP and MySQL, which means you need proper hosting. Cheap shared hosting ($3–5/month) leads to slow speeds and security gaps. Managed WordPress hosting that performs well runs $25 to $50 per month. Over three years: $900 to $1,800.
Premium plugins. Contact forms, SEO tools, security scanners, backup systems, caching plugins, page builders. A typical business site uses $200 to $500 in premium plugin licenses annually. Over three years: $600 to $1,500.
Maintenance. Someone needs to update WordPress core, themes, and plugins regularly, test for compatibility issues after updates, and fix things when they break. A maintenance contract typically costs $75 to $200 per month. Over three years: $2,700 to $7,200.
Emergency fixes. When something breaks badly — hacked site, white screen of death, plugin conflict after an update — you're paying emergency developer rates. Budget one to two incidents per year at $150 to $500 each. Over three years: $450 to $3,000.
Total three-year cost of a "free" WordPress site: $4,650 to $13,500 — on top of whatever you paid to build it.
A static site, by contrast, can be hosted for free or near-free on platforms that serve static files. No database server. No PHP runtime. No premium plugins. No maintenance contract for software updates. The ongoing cost is essentially the domain name renewal.
What We Build Instead
We use a technology called Astro to build static websites. Astro generates plain HTML, CSS, and minimal JavaScript at build time — no server-side processing when visitors arrive.
Here is what that means in practice:
Speed. Pages are pre-built HTML. The server hands them over instantly. No database queries, no PHP assembly, no waiting. Our sites consistently score above 95 on Lighthouse.
Security. No database, no server-side code, no admin panel, no plugins to exploit. The attack surface is essentially zero. You cannot inject SQL into a site that doesn't use a database.
Cost. Static hosting is dramatically cheaper. Some providers offer it free for business-scale traffic. No plugin licenses. No managed hosting fees. No maintenance contracts for software updates.
Design. Every site we build is custom. We choose distinctive fonts, build colour palettes from the client's brand, and design layouts specific to the industry and audience. No templates. No themes. No "it looked different in the demo" surprises.
Performance across Africa. We self-host all fonts and scripts. Zero external requests to Google, Facebook, or CDN servers that might be slow from African networks. Images are automatically compressed and converted to modern formats. Pages typically weigh under 500 kilobytes on first load.
Does a static site work for everyone? No. If you need user accounts, a shopping cart, or a content management system your team updates daily, you need a dynamic application — and we build those too, using proper application frameworks. But for the vast majority of business websites — the company site, the service pages, the portfolio, the blog — a static build is faster, safer, cheaper, and more distinctive than WordPress will ever be.
The Question Worth Asking
The next time someone proposes WordPress for your business website, ask them three questions:
- Who handles security updates, and how often? If the answer is vague, your site will be vulnerable within months.
- What does the site score on Google Lighthouse out of the box? If they can't show you a score above 90, your visitors — especially on mobile — are waiting longer than they should.
- How is this design different from your other clients' sites? If the answer involves a theme marketplace, you're getting a costume, not a tailored suit.
Your website is often the first conversation a potential client has with your business. That conversation should be fast, secure, and unmistakably yours.
We'd like to show you what that looks like. Get in touch and let's talk about what your business actually needs from its website — not what a template decided for you.