What Is a CMS? WordPress, Headless & Hand-Coded Compared
A CMS, or content management system, is software that lets you create, edit, and publish website content through an admin dashboard instead of editing code. WordPress is the best-known example, powering roughly 43% of all websites. A CMS separates your content — text, images, products — from your design, so staff can update pages without a developer. The main alternatives are headless CMS setups and fully hand-coded sites, each with different speed, security, and maintenance trade-offs.
- WordPress market share
- Roughly 43% of all websites run WordPress (W3Techs)
- Share of CMS-built sites
- WordPress holds about 60% of the CMS market (W3Techs)
- Plugin ecosystem
- 59,000+ free plugins in the official WordPress directory (WordPress.org)
- Where vulnerabilities live
- The large majority of new WordPress vulnerabilities are found in plugins, not WordPress core (Patchstack)
What does a CMS actually do? #
A CMS stores your content in a database and assembles pages from templates. When you write a blog post, the text lives in a database row, not in an HTML file, and your theme controls how it looks — so redesigning the site does not mean rewriting every page. A good CMS gives you four things: 1) an editor non-technical staff can use, 2) user roles, so the front desk can update hours but cannot delete the site, 3) media management for images and documents, and 4) plugins or modules that add features like contact forms and SEO fields. The practical payoff for a small business is independence. You can fix a typo, post a promotion, or change holiday hours in two minutes without emailing a developer and waiting two days. That editing convenience, more than any technical feature, is why content management systems took over the web.
WordPress: the market reality #
WordPress powers roughly 43% of all websites, and it is the default answer for a reason. The ecosystem is enormous: tens of thousands of plugins, themes for every industry, and support from nearly every hosting company. Any competent developer you hire later will know it, so you are never locked into one agency. The trade-offs are just as real. Popularity makes WordPress the biggest target for automated attacks, and most reported vulnerabilities come from third-party plugins rather than the core software. A neglected WordPress site running 30 plugins is a liability, not an asset. There is also a huge quality spread: two WordPress sites can share nothing but the login screen. One might be a lean, fast, custom-coded theme; the other a bloated template dragging a dozen plugins it does not need. When we run sites through our free Website Grader, plugin bloat is one of the most common speed problems we find.
Page builders vs proper themes #
Page builders like Elementor, Divi, and WPBakery let you design pages by dragging blocks around. They are genuinely useful for owners who want visual control, and for simple sites they work fine. The cost is weight: builders load their own scripts and styles on every page, which slows the site down, and they lock your content into builder-specific markup. If you ever remove the builder, pages often collapse into shortcode soup. A properly built theme takes the opposite approach — a developer codes your layouts once, and you edit content through clean fields: headline here, photo there, button text here. The result is faster, harder to break, and easier for staff to use because they cannot accidentally drag the layout apart. Our rule of thumb: builders suit sites that change layout constantly; a proper custom theme suits businesses that change content often but design rarely, which describes most local businesses we work with.
What is a headless CMS? #
A traditional CMS handles both jobs: storing content and rendering the pages visitors see. A headless CMS does only the first job. It stores content and serves it as raw data — usually JSON — over an API, and a separate front end (often a fast, prebuilt site) displays it. Popular examples include Contentful, Sanity, Strapi, and WordPress itself running in headless mode. The upside is speed and flexibility: the same content can feed your website, a mobile app, and a digital menu board. The downside is cost and complexity, because you are now paying to build and maintain two systems instead of one. For most single-location small businesses, headless is overkill. It earns its keep for multi-location brands, content-heavy publishers, and businesses that need the same content in several places at once.
{
"title": "Summer HVAC Tune-Up Special",
"slug": "summer-hvac-tune-up",
"price": "$129",
"body": "Beat the Texas heat with a 21-point inspection...",
"heroImage": "/media/tune-up-hero.webp",
"updatedAt": "2026-07-01"
}When hand-coded wins #
A hand-coded site skips the CMS entirely: a developer writes the HTML, CSS, and JavaScript directly, and the finished files are served to visitors as-is. For sites that rarely change — a 5-to-10-page site for a law office, contractor, or clinic — this approach wins on the two things Google and visitors care about most. Speed: there is no database query, no plugin overhead, and no render step, so pages load in a fraction of the time. Security: there is no admin login to brute-force and no plugin to exploit, which shrinks the attack surface to almost nothing. Maintenance drops to near zero, too — no weekly updates, no compatibility breakage. The trade-off is that every content change goes through a developer. If you update your site twice a year, that is a feature. If you post weekly, it is a bottleneck, and a CMS makes more sense.
The maintenance burden nobody mentions #
CMS-based sites are not fire-and-forget. WordPress core ships several updates a year, and every plugin and theme updates on its own schedule. Skip updates and you accumulate known vulnerabilities that automated bots scan for around the clock; apply them blindly and an update can occasionally break the site. A responsibly run WordPress site needs: 1) weekly or automated core and plugin updates, 2) off-site backups tested for restore, 3) uptime and malware monitoring, and 4) an occasional plugin audit to remove dead weight. Budget either a few hours a month of someone's time or $50-$150 per month for a maintenance plan. Hand-coded and static sites cut this burden dramatically, which is a big part of their lower total cost of ownership. Whatever route you choose, the mistake is pretending maintenance is optional — every hacked small-business site we have cleaned up skipped it.
How should you choose by business size? #
Match the tool to how often content changes and who changes it. Solo operators and very small teams with a simple brochure site are usually best served by a hand-coded or static site: fastest, cheapest to run, nothing to patch. Small businesses that publish regularly — blogs, menus, event calendars, staff bios — fit a well-built WordPress site with a lean custom theme and a short plugin list. Growing businesses with e-commerce, memberships, or booking flows should choose the platform around those features first and treat content editing as secondary. Multi-location brands and publishers pushing content to several channels are the genuine headless candidates. If you are not sure what your current site even runs on, our free Website Platform Detector will identify the CMS, theme, and major plugins behind any URL, which is a useful starting point before you commit to a direction.
What does a CMS cost to run? #
The software is often free; the ownership is not. A realistic WordPress budget: hosting at $10-$60 per month, premium plugins and themes at $100-$400 per year, and maintenance at $50-$150 per month if you outsource it. That commonly lands between $1,000 and $3,000 per year before you touch design or content work. Hosted builders like Squarespace or Wix bundle everything for $16-$50 per month but limit customization and portability. A hand-coded static site flips the equation: higher build cost up front, then hosting that is often free or under $10 per month with essentially no maintenance line item. Headless setups typically cost the most overall — a CMS subscription plus a developer-maintained front end. Our free Cost Calculator lets you compare these scenarios with your own numbers, including the developer hours each approach realistically consumes over three years, which is where the differences really show.
When to bring in help #
You do not need an agency to start a blog on managed WordPress hosting — the defaults are fine. Get professional help when the stakes rise: your site is slow and you cannot tell whether the theme, plugins, or hosting is at fault; you have outgrown a page builder; you have been hacked or are behind on updates; or you are choosing a platform for a site that drives real revenue. We build both sides of this decision — lean custom WordPress themes when clients need self-service editing, and hand-coded static sites through our custom web design service when they need maximum speed with minimum upkeep. A short audit usually settles the CMS-versus-hand-coded question quickly, because the deciding factors are boring and measurable: how often content changes, who changes it, and what an hour of your team's time is worth.
FAQ
Is WordPress really free?
The software is free and open source, but running it is not. You still pay for hosting, usually some premium plugins or a theme, and ongoing maintenance. A realistic all-in figure for a well-run small-business WordPress site is $1,000-$3,000 per year, separate from any design or content work.
Are Wix and Squarespace CMSs?
Yes — they are hosted CMSs, meaning the software, hosting, and templates come bundled in one subscription. The convenience is real, but so is the lock-in: you cannot move a Wix or Squarespace site to another host. You would rebuild it. That trade-off is acceptable for simple sites and painful for growing ones.
Do I need a CMS if my site rarely changes?
Probably not. If your content changes a few times a year, a hand-coded or static site is faster, more secure, and cheaper to run, and you can pay a developer for occasional edits. A CMS earns its maintenance burden only when your team edits content regularly.
Is a headless CMS worth it for a small business?
Usually not for a single-location business with one website. Headless adds a second system to build and maintain, which raises cost without much visible benefit. It becomes worthwhile when the same content must feed multiple channels — several sites, an app, in-store screens — or when publishing volume is high.
How often does WordPress need updates?
Check weekly, or automate it. WordPress core releases several updates a year, and plugins update far more often. Security patches should be applied within days, because attackers script exploits for disclosed vulnerabilities almost immediately. Pair updates with off-site backups so a rare bad update is a ten-minute rollback, not a crisis.
Can I switch CMS platforms later?
Yes, but expect a migration project, not a button click. Posts and pages usually export cleanly; designs, plugin-specific features, and page-builder layouts do not. Budget for rebuilding templates and testing redirects so you keep your search rankings. This is why we advise choosing the simplest platform that meets today's needs.
Was this helpful?