WordPress vs Custom Website: How to Choose for a Mumbai Business in 2026

A situation I see every few weeks: a clinic or a trading company in Navi Mumbai has a WordPress site built four years ago. It has 30-odd plugins, nobody remembers the admin password, the contact form stopped sending emails some time last year, and the developer who built it has moved on. The owner asks me one question: should we rebuild it on WordPress again, or go custom this time?

It is the right question, but usually for the wrong reason. The site above did not fail because it was WordPress. It failed because nobody owned its upkeep. A custom site left alone for four years can fail just as badly. In this piece I will lay out where each approach genuinely wins, what the 2026 data says about speed and security, and how I would decide for a typical small business in Mumbai.

1. What you are actually choosing between

People say “WordPress vs custom” as if it were two products. It is really a spectrum, and it helps to name the points on it before comparing.

• WordPress with a ready-made theme and page builder. Fastest to launch, easiest for staff to edit, and the most likely to collect plugins over time.
• WordPress with a custom-coded theme. Same editing screen your staff already know, but the front end is written for your site, with only the plugins you need.
• A custom site with a content system attached (often called “headless”): pages built in code, with an editing panel for the parts your team changes.
• Fully custom code with no general-purpose CMS: best when the site is mostly an application, such as a booking system, a dealer portal or a calculator-driven quote tool.

WordPress itself is free software, released under the GPLv2 or later licence. You pay for design, development, hosting, premium plugins and upkeep, not for the platform. Custom development has no licence cost either; the cost is the engineering time. So the real comparison is about effort now versus effort later, and who carries it.

2. Who will edit the site, and how often?

This is the question I ask first, because it decides more than anything else. If your team will add a blog post every week, update course batches every month, or post new property listings every day, an editing screen they can use without calling a developer is worth a lot. That is WordPress’s home ground.

Its reach also helps. W3Techs reports WordPress on 39.5% of all websites and 58.3% of websites whose content system it can identify, as of 29 October 2026. In practice, that means a new hire who has used WordPress before is common, help articles exist for almost everything, and if you part ways with your developer, another one can pick up the site.

If the site changes twice a year, the picture flips. A lean custom site where your developer makes the occasional edit can be cheaper to live with than a full CMS you rarely log into, because the CMS still needs updating whether you use it or not.

See also: if the whole site is a few pages that rarely change, also read Wix vs a custom website for the hosted-builder option.

3. Speed: the build matters more than the platform

Speed is where custom sites have a reputation, and the data partly supports it. Google measures real-user experience through its Core Web Vitals: main content should appear within 2.5 seconds (LCP), the page should respond to a tap within 200 milliseconds (INP), and the layout should not jump around (CLS of 0.1 or less), all measured at the 75th percentile of visits.

The HTTP Archive’s 2025 Web Almanac CMS chapter shows how CMS-built sites fared on mobile.

Source: HTTP Archive Web Almanac 2025, CMS chapter. Global data from Chrome real-user measurements; the chapter gives mobile figures only.

So more than half of WordPress sites miss Google’s targets on phones. The same chapter hints at why: the median WordPress mobile page weighed about 2,894 KB, carried about 638 KB of JavaScript, and around 60% of WordPress sites used a page builder, with Elementor alone on 43% of mobile WordPress sites. Heavy themes and builders, plus a plugin for every small feature, are the usual culprits.

My reading: this is a statistic about how most WordPress sites are built, not a ceiling. A WordPress site with a hand-coded theme, sensibly sized images and a short plugin list can pass Core Web Vitals easily. A custom site that loads five tracking scripts and a giant hero video can fail them. What custom code does give you is control: nothing loads that you did not decide to load.

See also: for the fixes that move these numbers on any platform, see how to speed up your website.

4. Security and upkeep: where the real cost sits

WordPress is the biggest target on the web simply because it is the biggest platform. But the data shows exactly where the risk lives, and it is not WordPress core.

Source: Patchstack, State of WordPress Security in 2026. Patchstack is a security vendor; figures cover vulnerabilities reported to and tracked by it.

Two practical conclusions follow. First, every plugin you add is a piece of someone else’s code you are trusting with your site, so the number of plugins is a security decision, not just a feature decision. Second, the window between a bug being published and being attacked is measured in hours, so “we update every quarter” is not a maintenance plan.

WordPress has made this easier. Since WordPress 5.5, administrators can switch on automatic updates plugin by plugin and theme by theme, and WordPress checks for them twice a day. The same page recommends regular automatic backups first, so you can roll back if an update breaks something.

Custom sites need upkeep too

A custom site has a smaller attack surface because there is no public plugin ecosystem for attackers to scan. It is not maintenance-free. The language and framework underneath still need updates. Take PHP, which both WordPress and many custom sites run on: php.net lists only 8.2 to 8.5 as supported as of October 2026, and PHP 8.2 loses security fixes on 31 December 2026. WordPress recommends PHP 8.3 or greater, MySQL 8.0 or MariaDB 10.11 or greater, and HTTPS.

Source: PHP.net, Supported Versions, checked 29 October 2026. Versions 8.1 and older no longer receive security fixes.

A custom site written for an old framework version can be harder to update than WordPress, because there is no one-click update; a developer has to do it. The difference is that you choose when, rather than reacting to a plugin alert.

5. SEO: the platform does not rank you

I am often asked whether Google prefers custom sites or WordPress. It does not prefer either. Google’s own SEO Starter Guide does not favour any platform; if anything, it notes that a CMS can handle some jobs for you, saying most CMSes can automatically turn the titles you write into a title element, and some will generate a sitemap automatically.

That is WordPress’s practical SEO advantage: titles, descriptions, sitemaps and clean URLs come almost for free with a reputable SEO plugin, and your staff can edit them. A custom site can do all of this as well, but someone has to build each piece and give you a way to change it. I have seen custom sites where every page title is the company name, because no one built an editing field for it.

What actually moves rankings is the same on both: useful pages for each service and area you serve, speed on phones, a properly set up Google Business Profile, and links from relevant sites.

See also: what SEO is and how it works, and if a site you already have is invisible, why your website is not showing on Google.

6. Features: when the website is really an application

This is where custom earns its place. Plugins are excellent at common jobs: contact forms, galleries, blogs, simple shops, appointment requests. They struggle when your feature is specific to how your business works.

Typical examples I see in Mumbai: a manufacturer whose dealers log in to see their own price list and place repeat orders; a coaching institute that wants batch allotment, fee reminders and test results in one place; a real estate developer whose inventory changes daily from a spreadsheet the sales team already uses. You can force these into WordPress with several plugins and custom glue code, but at that point you have a custom application with a CMS bolted on, and the plugin updates become a source of breakage.

A good middle path is common: a WordPress marketing site for the pages your team edits, and a separate custom application (on a subdomain or behind a login) for the business logic.

7. Ownership and data: get both in writing

Whichever route you choose, ownership is decided by your contract, not the platform. Under Section 17 of the Copyright Act, 1957, the author of a work is its first owner. Section 19(1) says an assignment is valid only “in writing signed by the assignor”; if the period is not stated it is deemed to be five years, and if the territory is not stated it is presumed to be India only. So a custom theme or custom application belongs to whoever wrote it until they assign it to you properly. I am not a lawyer; have yours check the clause on a large project.

Your enquiry forms also collect personal data. The government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, with an eighteen-month phased compliance period. The explainer says the highest penalty, up to ₹250 crore, applies to a Data Fiduciary that fails to keep reasonable security safeguards. A form plugin that emails leads in plain text and stores them forever in the database, or a custom form with no access control, is a risk either way.

8. Where this advice breaks down

• The data is global. The Web Almanac and Patchstack figures cover sites worldwide. I have not found a reliable India-only breakdown, so treat them as direction, not as a measurement of Mumbai sites.
• Patchstack sells security services. Its counts are carefully documented, but a security vendor has a reason to stress risk. The plugin-versus-core split is the useful part.
• Platform averages hide wide ranges. “45% of WordPress sites pass” includes abandoned sites and cheap template builds. A specific developer can be much better or much worse than the average.
• Custom is only as good as the team. A custom site from a freelancer who disappears can leave you with code nobody else understands. WordPress at least gives the next developer a familiar starting point.
• Hosted builders exist. For a five-page brochure site, Wix or a similar builder may beat both options on effort; the Almanac numbers suggest they have improved a lot on speed.

9. A simple way to decide

Here is the rule of thumb I use with clients. It is an opinion based on the projects I have seen, not a law.

• Pick WordPress (ideally with a custom-coded theme) if your staff will publish content weekly, your features are standard, and you want the freedom to change developers later.
• Pick custom if the site is mostly an application, you need logins and business logic, page speed is a competitive edge, or you want the smallest possible attack surface and rarely edit content.
• Pick the hybrid if you need both: WordPress for marketing pages, a custom app for the logic.
• Pick neither yet if no one is named to own updates and backups. Solve that first.

See also: for budgeting, see how much a website costs in Mumbai and how to choose a web design company.

Checklist before you sign

The clinic from the opening did not need a new platform as much as it needed an owner for the one it had. Decide who that owner is first, and WordPress versus custom becomes a much easier call.