WordPress has dominated this conversation for years, and understandably so. Its accessibility, enormous plugin ecosystem and relatively low barrier to entry have made it one of the most widely adopted website platforms in the world. But could some of the qualities that made WordPress so successful also be responsible for some of its biggest challenges?
Recent critical vulnerabilities in PHP, the programming language underpinning WordPress, have brought website security and technology choices into sharper focus. As an agency that works with both WordPress and Umbraco, we believe there's a bigger conversation to be had. Not simply about which CMS is better, but about how the technology behind a website affects its security, flexibility, performance and long-term value.
A timely reminder: The October 2026 PHP security vulnerabilities
On 21 October 2026, two critical vulnerabilities affecting PHP were publicly disclosed, raising urgent concerns for organisations operating PHP-powered websites. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry CVSS v4.0 severity scores of 9.2 out of 10. Successful exploitation could allow an unauthenticated attacker to execute malicious code on an affected server. The implications extend beyond any single content management system. PHP powers a wide range of websites and applications, including WordPress, Drupal and Joomla.
According to an official NHS England cybersecurity alert, researchers have demonstrated successful exploitation in PHP-integrated products, and affected organisations are being urged to update their PHP installations immediately. The Canadian Centre for Cyber Security has similarly warned that internet-facing PHP applications are at heightened risk.
Importantly, this isn't a vulnerability caused by WordPress itself. It exists within the underlying PHP runtime, meaning that a website with fully updated WordPress core files and plugins may still be exposed if its server is running an affected version of PHP. Nor does this mean every WordPress website is vulnerable. Exposure depends on factors including the PHP version, server configuration and whether appropriate patches or vendor fixes have been applied. Nevertheless, the incident illustrates something businesses don't always consider when choosing a CMS:
Your website's security depends on much more than the CMS you can see. It also depends on the technology running underneath it.
WordPress: A victim of its own success?
It's difficult to overstate the impact WordPress has had on the web. What began as a blogging platform evolved into a highly flexible CMS capable of powering everything from small business websites to sophisticated publishing platforms and online stores. Its popularity is built on several compelling advantages:
Accessibility: Businesses can launch websites without needing extensive technical expertise.
Affordability: Free themes and plugins make it possible to create functional websites with relatively modest initial budgets.
Extensibility: An enormous ecosystem of plugins provides ready-made solutions for everything from contact forms to e-commerce.
Community: A large global developer community means support, resources and expertise are widely available.
These are genuine strengths, and they explain why WordPress remains an appropriate choice for many projects. But there's another side to the story. The very characteristics that make WordPress attractive can introduce additional complexity as a website grows, particularly when it becomes business-critical.
1. Popularity makes WordPress an attractive target
Cybercriminals frequently look for opportunities to exploit vulnerabilities across large numbers of websites. A vulnerability in a widely deployed plugin or platform component can present an attractive opportunity because attackers may be able to automate attempts against many installations. This doesn't mean WordPress is inherently less secure simply because it's popular. Its large community also supports active vulnerability research, rapid disclosure and security tooling.
However, it does mean that maintaining a WordPress website requires ongoing attention to known vulnerabilities, updates and configuration. The scale of this activity is illustrated by Wordfence's Q4 2025 Threat Intelligence Report, which recorded 2,213 vulnerabilities added to its WordPress vulnerability database during that quarter. The report also documented billions of blocked malicious requests, demonstrating the scale of automated threats observed across Wordfence-protected websites. For businesses, the takeaway is straightforward: security cannot be treated as a one-off task completed when a website launches.
2. The plugin ecosystem: Convenience comes with dependencies
One of WordPress's biggest selling points is its extensive library of plugins. Need a booking system? There's probably a plugin. Want to add a form, integrate a CRM, improve search functionality or introduce an online shop? In many cases, there's an existing solution ready to install. This can dramatically reduce development time and initial cost.
However, every additional plugin introduces another piece of software that must be considered, maintained and potentially updated. Each plugin may have its own developer, release schedule, compatibility requirements and security vulnerabilities. A website assembled using numerous third-party plugins can therefore become dependent on a collection of software components that the business and its development agency do not directly control.
This is particularly important when a plugin becomes unsupported, introduces a breaking change or develops a security vulnerability. According to the Wordfence 2024 Annual WordPress Security Report, plugins accounted for approximately 96% of the WordPress ecosystem vulnerabilities disclosed during 2024. That statistic requires context. It describes the distribution of disclosed vulnerabilities, not the percentage of WordPress websites compromised. It also reflects the size and diversity of the plugin ecosystem. Nevertheless, it reinforces the importance of carefully managing third-party dependencies.
A plugin may be free to install, but that doesn't necessarily mean it's free to maintain.
3. Quick and cheap doesn't always mean cost-effective
WordPress makes it relatively easy to get a website online quickly. For a small business with straightforward requirements, that can be exactly what's needed. But there's a difference between the cost of launching a website and the cost of owning it. A website that begins with an inexpensive theme and several free plugins can gradually accumulate complexity as new requirements emerge. Over time, businesses may encounter:
Premium plugin subscriptions and recurring licence costs.
Compatibility issues between plugins, themes and PHP versions.
Additional development work to customise functionality that wasn't originally designed for their needs.
Performance issues caused by unnecessary functionality or poorly optimised components.
Ongoing maintenance to ensure updates don't break existing features.
None of these challenges is exclusive to WordPress, and bespoke websites have their own development and maintenance costs. However, the convenience of adding functionality through third-party extensions can sometimes obscure the long-term implications of those decisions. The real question shouldn't simply be, "How much will this website cost to build?" It should be,
"What will this website cost to operate, maintain and evolve over the next five years?"
Umbraco: A different approach to website development
Where WordPress is built primarily on PHP, Umbraco is built using C# and Microsoft's ASP.NET Core framework. Both are open-source CMS platforms, but they offer different development experiences and encourage different approaches to building websites. Umbraco is particularly well suited to projects where a website needs to be designed around specific business requirements rather than assembled from pre-existing themes and functionality.
According to Umbraco's official development documentation, the platform is designed to be flexible and extensible, allowing developers to customise both the website itself and the content editing experience. Rather than beginning with a theme that dictates how a website should work, developers can start with the business's requirements and build the appropriate structures around them. This distinction is particularly valuable for organisations with complex content, integrations, multiple audiences or ambitions to develop their digital platform over time.
1. Bespoke by design, not by workaround
One of the reasons we favour Umbraco for more complex projects is the freedom it gives us to develop genuinely bespoke websites. We can create content structures, reusable components, custom functionality and integrations around the specific needs of each client. Rather than adapting a business's requirements to fit the limitations of an existing theme or plugin, we can design the solution around how that business actually operates.
This can be especially beneficial when a website needs to integrate with external systems, support unusual content relationships or deliver a highly tailored user experience. Of course, bespoke WordPress development is entirely possible, and there are excellent WordPress developers building sophisticated custom solutions. The difference is that Umbraco's developer-focused architecture aligns particularly naturally with our preferred approach to bespoke development.
2. A structured approach to content management
A CMS isn't just about how a website looks to visitors. It's also about how efficiently the people behind the scenes can manage it. Umbraco allows developers to define structured content types and create editing interfaces tailored to the organisation. This can help content teams maintain consistency while retaining flexibility over the information they publish. For example, a business might need a consistent way to manage case studies, services, team members, locations and related content. Rather than treating each page as an isolated collection of content blocks, these elements can be modelled around their purpose and relationships. That can make content easier to manage, reuse and extend as the website grows.
WordPress also supports structured content through custom post types, fields and modern block-based development. The distinction is not that one platform can do this and the other cannot, but how naturally each fits a particular development approach.
3. The advantages of the .NET ecosystem
Umbraco's foundations in C# and .NET are another important consideration. The .NET platform provides developers with a mature ecosystem of frameworks, libraries, tooling and established development practices. C# is a statically typed language, which can help developers identify certain classes of programming errors during development rather than discovering them at runtime. The .NET ecosystem also provides strong support for automated testing, dependency injection, application monitoring and integration with enterprise systems. These capabilities are not exclusive to .NET. Modern PHP supports strong typing features, professional testing frameworks and sophisticated software architecture. But for development teams already experienced in Microsoft technologies, Umbraco can provide a consistent and familiar foundation.
Umbraco also aligns its long-term support release strategy with .NET, helping organisations plan platform upgrades alongside the underlying framework's support lifecycle. For businesses investing in a website intended to evolve over many years, having a clear approach to platform maintenance and upgrades is an important advantage.
Is Umbraco more secure than WordPress?
This is where the comparison needs careful consideration. It would be misleading to claim that Umbraco is automatically more secure simply because it uses C# and .NET rather than PHP. Both ecosystems have experienced vulnerabilities. Both require ongoing updates, secure hosting, responsible development and appropriate monitoring. A poorly developed or maintained Umbraco website can be vulnerable, just as a carefully engineered WordPress website can be highly secure.
However, the way a website is architected can influence its overall security exposure. For example, a WordPress website relying on numerous third-party plugins may introduce more independently maintained components than a bespoke implementation with a smaller, carefully controlled set of dependencies. That doesn't automatically make the bespoke implementation safer. Custom code can contain vulnerabilities too, and established plugins may benefit from extensive testing and security review. But it does change the way dependencies are managed and the degree of control developers have over the application.
For us, the appeal of Umbraco isn't a promise of perfect security. It's the opportunity to build websites using a development approach where architecture, dependencies and ongoing maintenance can be considered deliberately from the outset. The recent PHP vulnerabilities reinforce why these decisions matter.
Security isn't simply a feature of your CMS. It's the result of your entire technology stack, how it's developed and how it's maintained.
WordPress vs Umbraco: Which is right for your business?
Despite our preference for Umbraco on bespoke projects, we don't believe every business needs a fully custom-developed website. WordPress remains an excellent option in the right circumstances. If a business needs a relatively straightforward website, has a limited initial budget or can achieve its goals using a small number of reputable, well-maintained extensions, WordPress can provide a practical and cost-effective solution. It also benefits from an established publishing ecosystem and familiar content management experience.
Umbraco becomes particularly compelling when the requirements are more complex. For businesses that need custom functionality, structured content, integrations with other systems or a digital platform designed to evolve over time, its flexible architecture and .NET foundations can offer significant advantages. There are trade-offs. Bespoke Umbraco development can require greater upfront investment and specialist development expertise. It isn't automatically the cheapest or fastest option, and it still needs regular maintenance.
Ultimately, the right choice depends on the organisation's requirements, budget, technical resources and long-term objectives.
Looking beyond the initial build
The recent PHP security incident is an important reminder that websites are not static products. They are living software systems built on frameworks, libraries, hosting infrastructure and dependencies that change continuously. A CMS that seems inexpensive or convenient at launch may require more investment as requirements evolve. Equally, a bespoke platform that offers greater flexibility may not justify its initial cost for a simpler website. The important thing is understanding those trade-offs before making a decision. At the human tech agency, we work with both WordPress and Umbraco because we recognise that different businesses have different needs.
However, when a project calls for a genuinely bespoke digital experience, we often favour Umbraco. Not because WordPress is inherently bad, or because PHP is fundamentally insecure, but because Umbraco's architecture, flexibility and .NET ecosystem align closely with the way we approach custom website development. WordPress helped make professional websites more accessible than ever before. That's an achievement worth recognising. But as businesses become increasingly reliant on their digital platforms, perhaps it's time to look beyond convenience and consider the bigger picture.
The best CMS isn't necessarily the one that gets you online the fastest. It's the one that gives your business the right foundation for what comes next.