Friends Don't Let Friends Use WordPress

Every few weeks an email arrives saying your website needs updating, and the person who set it up moved on years ago. That’s the attorney or CPA this post is for. WordPress runs a huge share of the web, plenty of those sites are well kept, and if you enjoy looking after yours, carry on.

For that owner, the website came with a job attached: keeping WordPress running.

The update treadmill

A WordPress site is three layers of software: WordPress itself, a theme that controls how it looks, and a set of plugins that add everything else, from the contact form to the photo gallery. Each layer gets updates on its own schedule, from different authors.

Most of those updates are routine. The trouble is that skipping them isn’t safe and applying them isn’t free. A plugin update can break the theme, a theme update can break a plugin, and the person who finds out is usually whoever visits the site next.

Where the security problems are

WordPress itself is well maintained. The risk sits mostly in the plugins. Patchstack, a company that tracks WordPress vulnerabilities, counted 7,966 new ones across the WordPress ecosystem in 2024, according to its 2025 security report. 96% were in plugins and 4% in themes, and seven were in WordPress core.

So a firm site running a dozen plugins has a dozen separate places a hole can turn up. Each one depends on its own author to publish a fix, and on someone at your end to apply it. A plugin whose author has stopped maintaining it may not get fixed at all.

Speed takes work

A WordPress page is normally assembled by the server each time someone asks for it, and many plugins add their own code to the page. Getting a WordPress site to load quickly is very doable, but it’s a project: caching, image handling, pruning plugins, and a host that’s up to it.

When WordPress is the right call

If someone at your firm likes editing pages, publishes often, and is happy to keep on top of updates, WordPress is a reasonable choice. Put it on a WordPress host that takes backups and applies updates for you, and you’re in good shape. If you ask us, that’s what we’ll tell you.

What we do instead

We don’t host WordPress. The sites we build and host are static files, stored in Amazon S3 and served through Amazon CloudFront, with no plugins and no WordPress install behind them. There’s nothing on your side to update each month, and there are fewer moving parts to fail.

You don’t log in and edit pages yourself. Changes go through update credits instead. Each credit covers 30 minutes of work, Starter comes with 2 a year, Standard with 4 and Pro with 6, and requests come back within 5 business days on Starter, 72 hours on Standard and 48 hours on Pro. For a firm that changes its site a few times a year, that’s usually less effort than running WordPress. For one that publishes every week, it may not be.

Each plan pairs a one-time build fee with the monthly hosting: $499 and $25 a month on Starter, $1,199 and $30 on Standard, $1,499 and $40 on Pro, with the SSL certificate included on all three. Moving a WordPress site to us means rebuilding it as static files, which is what the build fee covers. What each plan includes is on our web hosting page.

If you’re already on WordPress

You don’t have to throw anything away to look at your options. Your domain registration can stay where it is, your email keeps flowing while the new site is built, and you click through a working demo before the new site goes live. If the site you want to leave is on a website builder rather than WordPress, our post on moving off Wix, Squarespace or GoDaddy covers what each one lets you take with you.

And if a friend of yours is the one getting the update emails, send them this. That’s the whole point of the title.

Your Friends at Adams Digital