shouldiuse.io

VERDICT

Should I use WordPress?

Not disclosed - wordpress.stackexchange.com

Depends. Buy it if you run a content-heavy site and will personally handle updates, backups, and security. Skip it if you want a simple site with zero maintenance — a hosted builder is the better fit.

Confidence

High. Based on ~40 public sources; most snippets were truncated, so exact prices and review scores are unconfirmed.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Free (WordPress.com)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Self-hosted (WordPress.org)Free software; hosting costs vary

Best for

  • Bloggers and content-heavy sites
  • Small businesses wanting a full website
  • Teams comfortable self-hosting and patching
  • Agencies building client sites

Not for

  • Non-technical users wanting zero maintenance
  • Simple one-page sites — use a hosted builder
  • Anyone unwilling to patch core and plugins promptly
  • Buyers expecting hands-off managed hosting on the cheap

Gotchas - check before you buy

high

Self-hosting means you own patching; miss a core update and wp2shell-class exploits hit you

high

Plugins are attack surface: one migration plugin flaw exposed 3M+ sites

medium

Reddit users warn specifically against paying for hosting

medium

Core is free; real cost is hosting, premium themes, plugins, and ongoing maintenance

Pros and cons

Pros

  • Free, open-source core
  • Massive plugin ecosystem for extending functionality
  • Powers almost 40% of websites; huge talent pool
  • Scales from hobby blogs to WordPress VIP enterprise
  • Free plan available on

Cons

  • Critical 2026 core RCE (wp2shell) allowed full site takeover
  • Self-hosted security is your job; thousands of sites hacked
  • Plugin and theme subscriptions quietly add up
  • paid hosting heavily criticized; BBB complaints exist
  • Some developers call it more trouble than it's worth

Sources & method

Analyzed 9/21/2026 - 12 sources - Multiple critical 2026 vulnerabilities including unauthenticated remote code execution in core; active exploitation reported.

official x2review x4security x4news x2
  • wp2shell — unauthenticated RCE and full site takeover in WordPress core (CVE-2026-63030), Critical remote code execution chain in core, patched July 2026; real-world attack data documented.
  • CVE-2026-60137, WordPress core vulnerability tracked in the National Vulnerability Database, July 2026.
  • Migration plugin vulnerability affecting 3M+ sites, High-severity plugin flaw left over three million sites exposed, September 2026.

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 3/5. Free core, but plugin and hosting subscriptions add up
  • Ease of use: 3/5. Flexible but maintenance-heavy; sentiment is mixed
  • Feature depth: 5/5. Huge plugin ecosystem; VIP enterprise tier exists
  • Support quality: 2/5. BBB complaints and critical Reddit hosting reviews
  • Security posture: 1/5. 2026 critical core RCE; mass site hacks
  • 2,717 G2 reviews WordPress.com on G2
  • 4,155 Trustpilot reviews wordpress.com
  • Yes Free tier WordPress.com free plan
  • ~40% Web market share Powers almost 40% of websites

Pricing

Free (WordPress.com)

$0

  • Basic site
  • Free plan available
  • Paid plans start above it

Self-hosted (WordPress.org)

Free software; hosting costs vary

  • Full control
  • You manage security and updates

Security

Multiple critical 2026 vulnerabilities including unauthenticated remote code execution in core; active exploitation reported.

  • wp2shell — unauthenticated RCE and full site takeover in WordPress core (CVE-2026-63030)Critical remote code execution chain in core, patched July 2026; real-world attack data documented.¹
  • CVE-2026-60137WordPress core vulnerability tracked in the National Vulnerability Database, July 2026.
  • Migration plugin vulnerability affecting 3M+ sitesHigh-severity plugin flaw left over three million sites exposed, September 2026.³

What users say

Reviews are polarized: praise for flexibility and the plugin ecosystem, recurring complaints about maintenance burden, security, and WordPress.com hosting.

Alternatives

Compare WordPress with each alternative.

  • Ghost

    Cleaner, blogging-focused platform with less maintenance

  • Wix

    Simpler hosted builder for non-technical site owners

    WordPress vs Wix

  • Drupal

    More structured CMS for complex, enterprise-grade builds

Full analysis

Based on ~40 public sources; most snippets were truncated, so exact prices and review scores are unconfirmed.

Free CMS that runs ~40% of the web, but you inherit patching, plugin risk, and subscription creep.

Methodology

Based on ~40 public sources; most snippets were truncated, so exact prices and review scores are unconfirmed.

Sources

  1. wp2shell — Unauthenticated RCE in WordPress Corebusinessinsights.bitdefender.com
    security
  2. Rapid7: CVE-2026-63030 wp2shellrapid7.com
    security
  3. Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerabilitysecurityweek.com
    security
  4. Thousands of Hacked WordPress Sitesresearch.checkpoint.com
    security
  5. Is WordPress more trouble than it's worth? (Reddit)reddit.com
    review
  6. Never, EVER, pay for WordPress.com hosting (Reddit)reddit.com
    review
  7. WordPress.com on G2g2.com
    review
  8. WordPress.com on Trustpilottrustpilot.com
    review
  9. WordPress.com Pricingwordpress.com
    official
  10. WordPress Statisticswpzoom.com
    news
  11. The 10 Best WordPress Alternativestooltester.com
    news
  12. Ghost vs WordPressghost.org
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.