WordPress

WordPress usually means the self-hosted software from WordPress.org, which you install on your own hosting. WordPress.com is a separate commercial hosting service that runs the same software for you with its own plans and limits. The software itself is licensed under the GPL, so it is free to use and modify; costs come from hosting, premium themes, plugins and the people who maintain it.

WordPress is a CMS, not a design. Two WordPress sites can look and perform completely differently depending on the theme, the plugins and how carefully they were built, which is why "it's a WordPress site" says little about quality.

How it works

WordPress stores content, settings and users in a MySQL or MariaDB database and runs on PHP. When someone visits a page, PHP loads WordPress, the active theme and every active plugin, queries the database and builds the HTML. A caching plugin or the host usually stores finished pages so this does not happen on every visit.

Editors write in the block editor, where each paragraph, image or button is a block. The theme controls layout and styling; plugins add everything else, from contact forms and SEO settings to full shops through WooCommerce. Thousands of free and paid plugins exist, of very uneven quality.

Updates arrive for WordPress itself, for themes and for each plugin. Minor security releases can install automatically; larger updates are best tested first. Most WordPress hacks come not from the core software but from outdated or poorly written plugins and themes, and from weak or reused admin passwords.

Example

A family-run restaurant's WordPress site has a theme, a menu plugin, a booking plugin, a gallery plugin and two overlapping SEO plugins. Pages take several seconds to load on a phone. A clean-up removes the duplicates and the gallery plugin, replaces it with the built-in gallery block, compresses the photos and adds page caching; the site keeps every feature it actually uses.

The owner then checks the dashboard's Site Health screen, which flags outdated software and configuration issues, and the plugins list, which shows any plugin awaiting an update. A monthly half hour with those two screens, plus a backup before updating, covers most of the routine care. Anything the screens cannot tell her, such as whether a plugin is still maintained, shows on its listing page: the date of the last update and the WordPress versions it has been tested with. A plugin untouched for a long time is a candidate for replacement before it becomes a problem.

Why it matters for your business

WordPress is a sensible choice when staff need to publish often, when you want many hosting and developer options and when you may need features such as a shop or memberships later. Its weakness is maintenance: every plugin is a dependency that must be updated and can break or be exploited. Budget for ongoing care or a maintenance plan. For a small, rarely changed site, a simpler approach may cost less over its lifetime. WordPress is also flexible about where it runs, so you are not tied to one host or one agency, which is a real advantage over closed website builders if the relationship with a supplier ends.

Common mistakes

• Installing a plugin for every small feature until updates become risky and pages slow down.
• Buying a heavy multipurpose theme and using a fraction of it.
• Leaving the admin username as admin with a weak password and no two-factor authentication.
• Updating plugins on the live site without a backup or a test on a staging copy.

Questions people ask

Is WordPress free?

The software is free and open source. You still pay for hosting, a domain and often premium themes or plugins, plus the time or service needed to keep everything updated. Those running costs, not the software, decide what a WordPress site really costs.

Is WordPress secure?

The core software is actively maintained and patched. Most compromised WordPress sites are caused by outdated or poorly maintained plugins and themes, weak passwords or neglected hosting. Keep everything updated, limit plugins, use two-factor authentication and keep backups, and WordPress is as safe as most alternatives.

What is the difference between WordPress.org and WordPress.com?

WordPress.org distributes the free software you install on your own hosting, with full control over themes and plugins. WordPress.com is a hosted service that runs WordPress for you, with plans that set what you can install and change. Both use the same core software.