When someone from the world of web design or development hears that you still use WordPress in 2025, there are two possible reactions. The first is a knowing nod: "us too, what can you do". The second is a slight frown that says "still?". At BAI we have been thinking about this for a while and we have reached a conclusion that may unsettle both sides: WordPress is not surviving in spite of its problems. It is surviving precisely because of them.
I explain what I mean.
The problem nobody wants to admit about the alternatives
Webflow is extraordinary for design projects where the client has budget, time and doesn’t need anyone from the team to touch the site after delivery. That is, for a small fraction of the real projects handled by an agency working with SMEs.
Framer is spectacular if the client is a tech startup with an in-house designer. Astro and Next.js are the right option when there is a developer who will maintain the project. Squarespace is perfect if the client wants something that works today and does not give them more work than they already have.
The problem is that most clients are none of those things. They are businesses of between ten and a hundred employees that need a website the marketing manager can update (who is sometimes the same person as the director), that has a contact form that works, that can be connected to the CRM they already use, that their hosting provider’s technician knows how to maintain, and that in three years can be adapted without starting from scratch.
For that profile, WordPress remains the best answer. Not because it is the best CMS. But because it is the most widely known, the most documented, the most compatible, and the one most people can use without specialist training.
The ecosystem that has no rival
There are more than 60.000 active plugins in the official WordPress repository. That is not a technical advantage —many plugins are dreadful— but it is an operational reality. When a client needs to integrate their website with sector-specific management software, their company’s CRM, a regional payment gateway, or a particular analytics tool, the likelihood that a documented integration exists for WordPress is far greater than for any alternative.
And when the integration doesn’t exist, there’s the WordPress REST API. It’s mature, well documented, and any experienced developer can use it to build whatever is needed.
This has a value that design purists systematically underestimate: the total cost of ownership of a website is not just what it costs to build it. It is what it costs to maintain it, modify it, integrate it, and find someone who knows how to do it when the original developer is not available.
When we don’t use WordPress
Honesty demands it. There are projects where WordPress is the wrong choice, and we know it before we start.
If the project has extreme performance requirements —applications with millions of visits per day, shops with catalogues of hundreds of thousands of products, platforms with complex business logic— WordPress is not the right tool. Its architecture is not designed for that, and forcing it in that direction creates more problems than it solves.
If the project requires a very specific design with complex interactions and the client has the budget to do it properly, Webflow or clean code are better options.
If the client is technical and wants full control over their infrastructure, we prefer to build in Astro or Next.js and hand over something they understand how it works.
But if the client is a mid-sized Basque company that needs a reliable corporate website, well ranked on Google, that their team can update and that won’t cause problems over the next five years, WordPress remains the right answer.
The elephant in the room: security
"But WordPress has security problems." Yes. It does. And so does any software with millions of active installations on the internet. The attack surface is proportional to popularity.
90% of WordPress security problems come from three sources: outdated plugins, abandoned themes and weak passwords. All three are maintenance problems, not architecture problems. A well-configured WordPress, with decent hosting, automatic updates enabled and a basic security plugin, is as secure as any alternative on the market for the type of projects described in the previous paragraph.
What we have changed
The way we work with WordPress in 2025is radically different from 2018.We use the native block editor instead of heavy page builders. We use lightweight base themes instead of all-in-one themes with two hundred options. We measure Core Web Vitals from day one of the project, not as an afterthought. We deploy on hosting specifically optimised for WordPress, not on generic shared servers.
The result is that a well-built WordPress in 2025 can achieve speed scores similar to those of supposedly more modern alternatives.
The uncomfortable conclusion
The web design industry has a problem with technological snobbery. The tool used by 43% of all websites on the planet cannot be as bad as some people make it out to be. It may not be the most elegant. It may not be the favourite of developers with aesthetic sensibilities. But it works, it scales, it has support, it has a community, and it solves the real problems of real clients.
We still work with WordPress because our clients don’t hire us to use the coolest tool. They hire us to make sure their websites work, rank on Google, can be managed by their team, and don’t cause problems. And for that, WordPress remains hard to beat.