I need to say something that feels a little like betraying an old friend.
I’ve been building WordPress websites for over fifteen years. Client sites, my own agency’s sites, sites for friends who “just needed something simple” and sites for businesses whose entire revenue ran through a WooCommerce checkout. I’ve written this post knowing that some of the people who taught me the most about the web will disagree with it. That’s fine. I’d rather be honest than comfortable.
Here it is: I think the WordPress era is ending. Not because WordPress got worse — it didn’t — but because the question WordPress was built to answer is no longer the question.
Fifteen years of earned respect
Let me start with what WordPress gave me, because none of what follows makes sense without it.
When I started building websites, WordPress was the great equalizer. You didn’t need to be a programmer. You installed it in five minutes, picked a theme, and you had a real website with a real admin panel that a real client could log into. For a young agency in Pune trying to deliver professional sites on tight budgets, that was everything.
I’ve lived through the whole arc. The theme frameworks. The Thesis-vs-Genesis wars. The rise of Visual Composer, then Elementor, then the block editor. I’ve debugged plugin conflicts at 3am before a client launch. I’ve restored hacked sites from backups. I’ve explained to a hundred clients where the “Update” button is and why they should never press the other one. I know the wp-config.php file the way some people know their own handwriting.
WordPress deserves its ~43% of the web. It earned that share by being open, free, extendable, and genuinely usable by non-developers at a time when the alternative was hand-coded HTML or expensive proprietary systems. It democratized publishing. That’s not marketing copy — that actually happened, and I watched it happen, one small business at a time.
So when I say it’s time to move on, understand that this is a goodbye, not an attack. Insiders get to say things outsiders don’t.
AI-native changes what a CMS even is
A content management system is, at its heart, an answer to one question: how does a human who can’t code change a website?
Every design decision in WordPress flows from that question. The admin dashboard exists because humans need forms to type into. The theme system exists because humans can’t write CSS. Plugins exist because humans can’t write PHP. The block editor exists because humans need to arrange content visually. The entire architecture is a thick translation layer between human intent and working code.
That translation layer was the product. It’s what we paid for — in hosting costs, in maintenance retainers, in plugin licenses, in the sheer weight of the software.
But the premise just broke. AI can now write the code directly. When a business owner can say “add a testimonials section under the pricing table, make it match our brand” and get production-quality HTML in response, the question changes from how does a human change a website without coding to how does intent become a live website with the least machinery in between.
And WordPress, through no fault of its own, is almost entirely machinery.
I want to be fair here: WordPress sees this too. WordPress 7.0 “Armstrong,” released in May 2026, shipped a native AI Client, an Abilities API, and a Connectors screen for wiring up model providers. It’s a serious, thoughtful effort by serious people. But it’s AI bolted onto a twenty-three-year-old architecture designed for humans with keyboards. The AI is being invited into the dashboard. The dashboard is the problem.
The technical case, from someone who knows where the bodies are buried
Plugin sprawl
The typical WordPress business site I’ve inherited runs 20 to 30 active plugins. An SEO plugin, a caching plugin, a security plugin, a forms plugin, a backup plugin, an image-optimization plugin, a page builder, three or four builder add-ons, and a long tail of small utilities nobody remembers installing. Each one is a third-party codebase from a different author, on a different update cycle, with different quality standards, all executing inside the same PHP process with broad access to your database.
Think about what that stack actually is: you needed a plugin to make the site fast, a plugin to make it secure, and a plugin to make it findable. Speed, security, and SEO aren’t features. They’re properties the architecture should have by default. The plugin ecosystem is, in large part, a marketplace of patches for the platform’s own gaps.
The wrong architecture for the job
Here’s the uncomfortable truth about most business websites: they’re static. A marketing site with ten pages changes maybe twice a month. Yet WordPress assembles every one of those pages dynamically — PHP boots, queries MySQL, loads the theme, runs every active plugin’s hooks, and renders HTML — on every single request.
The entire caching-plugin industry (WP Rocket, W3 Total Cache, LiteSpeed Cache) exists to undo this: to catch WordPress’s dynamic output and serve it as the static file it should have been in the first place. We built an industry around converting WordPress sites into what they always were.
The performance numbers tell the story. Industry benchmarks put the average WordPress page load at around 3.4 seconds, while modern static and framework-based sites routinely load in under a second. That gap isn’t a tuning problem. It’s an architecture designed for 2003’s web serving 2026’s expectations.
Security surface area
Powering 43% of the web makes you the biggest target on the internet, and the numbers are sobering. According to Patchstack’s State of WordPress Security report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 — a 42% increase over the previous year. Roughly 96% of these are in plugins, not core. Worse, in nearly half the cases, plugin developers didn’t ship a fix before the vulnerability was publicly disclosed.
WordPress core is genuinely well-secured — decades of scrutiny by thousands of contributors did their job. But nobody runs bare core. The real attack surface of a WordPress site is the sum of its plugins, and that surface is enormous, unaudited, and maintained by volunteers and small vendors with no standardized security process. I’ve cleaned up enough hacked sites to know: it’s almost never core. It’s the abandoned gallery plugin from 2019.
A plain HTML site has no PHP to exploit, no database to inject, no login page to brute-force. The most secure admin panel is the one that doesn’t exist on the public server.
Page builder lock-in
If you’ve built with Elementor, Divi, or WPBakery, try this experiment: deactivate the builder and look at your content. With WPBakery you get a wall of shortcodes. With Divi, much the same. With Elementor, your “content” largely lives as serialized JSON in post meta, invisible to the standard editor.
We told clients WordPress meant they owned their content and could never be locked in. Then we built their sites in proprietary builder formats that are meaningless outside that builder. The lock-in we were escaping came in through the side door, and we held it open.
An API built for dashboards, not agents
The WordPress REST API was a big step forward — in 2016, for the problem of 2016: powering JavaScript dashboards and mobile apps operated by humans. For AI agents, it’s rough terrain.
Authentication means application passwords or plugin-based OAuth. The API exposes WordPress’s internal furniture — posts, pages, taxonomies, meta fields — not the semantic structure of a site. An agent wanting to “update the pricing section on the services page” has to fetch a blob of rendered block markup, parse it, modify it without breaking anything, and write the whole thing back, hoping no plugin’s save hooks mangle it.
The new Abilities API in WordPress 7.0 is an honest attempt to fix exactly this, and I respect it. But it’s a compatibility shim between agents and an object model that was never designed for them.
The block editor's data model
The loyalist objections, taken seriously
“My clients know how to edit WordPress.”
This is the best objection, and for years it was decisive. But be honest about what actually happens: most clients don’t edit their sites. They email their agency. In fifteen years, the number of clients who confidently used the WordPress admin beyond publishing a blog post is smaller than I’d like to admit. The dashboard — menus, widgets, theme customizer, plugin settings — intimidates them, and rightly so, because one wrong click can break a live site.
And here’s the thing: the skill clients actually have isn’t “using WordPress.” It’s describing what they want in plain language. That’s the one interface every client already knows fluently. An AI-native site meets them there.
“A well-maintained WordPress site is perfectly secure.”
True. With managed hosting, a hardened configuration, disciplined updates, minimal vetted plugins, and monitoring, WordPress is secure. But look at that sentence — it’s a list of ongoing labor and cost required to defend an architecture that is attackable by default. The maintenance retainer clients pay isn’t for improvement; it’s largely for keeping the site as safe as it was yesterday. Static output doesn’t need defending in the same way. Security you don’t have to maintain beats security you do.
“The ecosystem — 59,000 plugins — is irreplaceable.”
The ecosystem is genuinely remarkable, and for certain needs it’s still the fastest path to a solution. But audit any real site: of those 59,000 plugins, a given business site uses perhaps twenty, and half of those exist to fix WordPress itself — caching, security, SEO, image compression, database cleanup. Of the rest, most implement things — forms, sliders, tables, FAQs — that AI can now generate as bespoke code in minutes, tailored exactly, with no license fee and no third-party update risk. The ecosystem’s breadth was an answer to “no one can code everything.” That constraint is dissolving.
“WordPress is open source. You own everything.”
This matters, and I won’t wave it away. The GPL, the portability of the database, the freedom from any single vendor — these are real virtues, and any WordPress successor should be judged against them. But in practice, ask what “ownership” has meant for a site built in a commercial page builder on a proprietary hosting stack with a dozen licensed plugins. The ideal was open; the lived reality for most business sites was a web of dependencies. Meanwhile, a site delivered as clean HTML and assets is the most portable artifact on the internet. It runs anywhere, forever, with nothing to license.
“WordPress is adding AI too. Why leave?”
Because there’s a difference between a platform that uses AI and a platform designed around it. WordPress 7.0’s AI framework is real and well-engineered — but it exists to help AI operate a system built for humans: navigate the dashboard, fill the fields, manage the plugins. It makes the machinery easier to drive. The AI-native question is whether most of that machinery needs to exist at all.
What comes next
I’m not going to pitch anything here. This post is about the shift, not a product.
But here’s what I believe the next few years look like. Websites become living artifacts rather than installations. You describe what you want — in a chat, pointing at an element on the page — and the change is generated, reviewed, and live. The site itself is clean, fast, static output: nothing to patch on the server, nothing to exploit, nothing to cache because there’s nothing slow to hide. The “management system” stops being a dashboard you learn and becomes a conversation you’re already fluent in. Design goes in one end — a Figma file, even a screenshot — and a working, responsive site comes out the other.
None of this is speculative. I’m building this way right now, for my own agency’s site first, and the experience is what convinced me to write this post. The friction I’d accepted as “just how websites work” for fifteen years turned out to be optional.
WordPress taught a generation of us — me very much included — that publishing belongs to everyone. That idea doesn’t retire. The software does.
Thank you, WordPress. Genuinely. You were the right answer to the right question for twenty years.
The question changed.
