WordPress is a content management system with a website attached. Next.js is a framework for building the website, with content management attached to whatever you choose. That difference decides almost everything else: what the site costs to run, how fast it is before anyone optimizes it, how much of it can be broken by an update you did not make, and whether it can grow into an application later without being rebuilt.
We build on Next.js. This site is one, and the numbers in it are measured rather than quoted.
The comparison
| WordPress | Next.js | |
|---|---|---|
| Default rendering | PHP on every request | Pre-rendered HTML at build |
| Speed without tuning | Slow, then cached back to acceptable | Fast before anyone optimizes it |
| Attack surface | Database, admin login, plugin code | Static files, no admin, no database |
| Third-party code you run | Typically 15–30 plugins | The packages you chose |
| Breaks from updates you did not make | Common | Does not apply |
| Ownership | Themes and plugins under their licences | Your repository, your code |
| Becoming an application | Fights you | Already is one |
| Editing by non-technical staff | Strong out of the box | Needs a CMS choosing |
| Hosting cost at scale | Rises with traffic | Close to flat |
Speed is the default, not a project
A WordPress page is assembled per request: PHP runs, the database is queried, the theme renders, plugins add their work on top. Every serious WordPress site then buys that time back with a caching layer, an image plugin, a script optimizer and a CDN — four more pieces of software to configure, pay for and keep working, to reach the speed a Next.js site starts at.
Next.js renders pages at build time. What reaches the browser is finished HTML. There is nothing to execute and nothing to query.
On this site, measured on a production build: 378 pages, largest contentful paint between 0.09 and 0.26 seconds, cumulative layout shift of 0.000, and no blocking time on the main thread. No caching plugin is involved because there is nothing to cache back.
That matters commercially rather than technically. Core Web Vitals are a ranking input, and page speed is the first thing a visitor judges you on, before a word of your copy has been read.
The security surface is mostly absent
Most WordPress compromises do not come through WordPress. They come through plugins — third-party code, written to varying standards, running with full access to your site and database, updated on somebody else's schedule. A typical business site runs twenty or more. Each is a maintained dependency and an entry point, and the ones that go unmaintained are the dangerous ones, because a plugin that stops being updated does not stop being installed.
Add to that a public login page at a well-known URL, credentials that staff reuse, and a database holding everything.
A statically rendered Next.js site has no admin panel to find, no login to brute-force and no database to reach. Forms post to a server function that does one job and validates its input. There is far less to attack, so far less to defend.
You stop paying the maintenance tax
WordPress maintenance is not optional and it never finishes. Core updates, plugin updates, PHP version upgrades, and the periodic morning where a plugin update breaks the layout and nobody can say which one. Firms sell monthly retainers for exactly this, which is the clearest evidence of how much work it is.
A Next.js site has dependencies too, and they need updating. The difference is that they are libraries used at build time, not code running in production against your database, so an out-of-date package is a task rather than an incident. When something does break, it breaks in the build, before it reaches anyone.
The site can become an application
This is the argument that decides it for most of our clients.
A marketing site stops being a marketing site. It gets a customer portal, a quoting tool, a booking flow, a dashboard, a login. On WordPress each of those is a plugin, a form builder, or a bolted-on subsystem that shares a database with your blog and was designed for someone else's business.
On Next.js the site is already an application. Adding a portal is adding routes. Adding a pricing tool is adding a component. Our own assessment tool, Devin, lives on this site as a set of routes and server functions — it is not integrated with the website, it is part of it. Nothing was rebuilt to allow that.
The cost of this is usually invisible until it is not. Businesses that build the marketing site on WordPress and then need software end up running two systems, or paying to migrate the first one.
What you own afterwards
A WordPress site is your content inside somebody else's theme, extended by plugins under their licences and their roadmaps. If a plugin author stops shipping, that is your problem on their timetable.
A Next.js site is a repository. The code is yours from the first commit, it runs on any host, and any competent engineer can read it. There is no vendor with a say in what you do next.
Where WordPress still wins
There is one place, and it is worth stating plainly, because a comparison that finds no fault in its own answer is not a comparison.
If a non-technical person needs to edit page layouts daily, and the site will never be more than pages, WordPress is genuinely good at that and has been for twenty years.
Next.js closes the gap by adding a content system — Sanity, Contentful, Payload — which gives editors a proper interface while the site stays fast and separate from it. That is a decision to make rather than something you get for free, and it adds setup cost at the start. For a site that is edited weekly and will grow, it repays quickly. For a five-page brochure nobody will touch again, WordPress is fine and we will tell you so.
How we would decide
Choose WordPress if the site is content only, will stay content only, and editing frequency matters more than everything else.
Choose Next.js if the site is a commercial asset. If speed affects conversion, if security matters because you are handling enquiries or customer data, if you expect to add functionality, or if you intend to own what you paid for.
Most businesses asking the question are in the second group and have not yet been told the first is a choice with consequences.
If you want that decision made against your actual situation rather than in the abstract, Devin asks a few questions and returns a costed short list, or you can book a call and we will go through it directly.
- nextjs
- wordpress
- comparison
- performance
- custom-software
- procurement