Quick answer: If your recurring WordPress bill - managed hosting, security plugin, backups, a maintenance or care plan - is above roughly $100 a month and your site changes a few times a month rather than a few times an hour, leaving usually pays for itself within a year and removes the plugin attack surface for good. If you depend on a plugin nothing else replaces, ship new features weekly, or spend under $30 a month and patch it yourself, staying and hardening is the better call.
The question is not "is WordPress bad?"
WordPress core is fine. Six disclosed vulnerabilities in all of 2025 is a good record for software that runs a large share of the web. The question is what it costs you to keep the rest of the stack safe: the 20-odd plugins a typical business site runs, each a separate codebase on a separate maintainer's schedule.
In 2025 that ecosystem produced 11,334 disclosed vulnerabilities, up 42% on 2024 - 91% of them in plugins, roughly half of the high-impact ones exploited within 24 hours of going public, and a third with no patch available on the day they were disclosed (Patchstack, State of WordPress Security in 2026).
There are two rational responses to that. One is to pay to keep it manageable: a virtual-patching service, a security plugin, managed hosting with automatic updates, an agency care plan. The other is to move the site onto a platform that does not have a plugin layer at all. Both work. They cost differently, and they fail differently.
What "keep patching" actually costs
The stay-and-patch camp is honest about its prices, so let's use them.
| Line item | Typical monthly cost | Notes |
|---|---|---|
| Managed WordPress hosting | $25 – $400+ | Automatic core updates, daily backups, a CDN |
| Security plugin / firewall / virtual patching | $5 – $60 | Per site; the good ones are worth it if you stay |
| Backup plugin licence | $5 – $15 | Or bundled with hosting |
| Premium plugin & theme licences | $10 – $80 | Sliders, forms, SEO, page builders - renewals stack up |
| Maintenance / care plan | $0 – $500 | $0 if you patch it yourself; $100 – $500 if an agency does |
| Your own time | 1 – 4 hours/month | Updates, the occasional broken layout, the one plugin that won't update |
A small brochure site on cheap hosting with three plugins and an owner who patches it on Sunday evenings lands near $30 a month. An ordinary business site with an agency care plan lands between $150 and $400 a month. Over three years that is anywhere from $1,000 to $15,000 - for a site that has not changed, to keep it standing.
Cleanups are on top. Professional malware removal runs $150–$500 per incident, and because a cleanup does not shrink the attack surface that caused it, reinfection is common enough that cleanup vendors sell subscriptions.
What "leave" actually costs
A migration is a one-off. Published productized prices in 2026 cluster around $1,500–$8,000 for a showcase site, $10,000–$40,000 for a content-heavy site with a proper editor, and $3,000–$25,000+ for a store, depending on catalog size and how much of the design is rebuilt. (Our own floors are on the pricing section; the fixed quote comes after a free audit.)
After the switch, the recurring line is small: hosting for a pre-built site is free or a few dollars a month; a hosted content editor or store platform adds its own subscription, which any honest quote will state up front. There is no monthly patch window, because there is nothing to patch on your side.
The payback arithmetic is short. At €230 a month of cancelled subscriptions - a common figure for a business site with a care plan - a €499 showcase migration pays for itself in three months. At €50 a month, it takes about ten months. The calculator on the home page does this with your numbers.
The honest case for staying
Leaving is not always right, and anyone who tells you otherwise is selling migrations. Stay - and harden - if:
- A plugin is your business. A booking engine, a membership system, an LMS, a marketplace, an ERP integration - if it works and nothing outside WordPress replaces it cleanly, the migration cost is the cost of rebuilding that plugin, and it is rarely worth it.
- You ship features weekly and have a WordPress developer you trust. The plugin ecosystem's breadth is real. If you use it, you are getting value for the tax.
- The site is cheap and you patch it yourself. Under $30 a month and an hour on a Sunday: the tax is small, and a migration would take years to pay back.
- The site has months to live. A campaign page, an event site, a placeholder. Harden it, then let it die.
If you stay, do the four things that matter: managed hosting with automatic updates, a virtual-patching service so unpatched flaws are covered on disclosure, delete every plugin you do not use, and keep off-site backups you have actually restored once.
The honest case for leaving
Leave if:
- You pay someone to keep it patched and would rather not. A care plan is the clearest signal that the site has become a liability you are renting protection for.
- You have been hacked, flagged by Google, or shown a "deceptive site" warning. Cleanup fixes the incident. It does not fix the rate.
- The site changes a few times a month. It does not need a database, an admin login and 20 plugins on the public internet. It needs to be fast, found, and forgotten about.
- Your editors fight the admin more than they write. A content-heavy site is where a modern editor earns its subscription.
- Your store's checkout has gone down after an update. Once is enough. Commerce platforms exist so that never happens again.
What leaving does not fix
Two things people expect from a migration that it does not deliver on its own. It does not make a bad design good - a like-for-like migration moves the site you have; a redesign is a separate decision with a separate price. And it does not make hosting "unhackable"; hosting providers still patch their own infrastructure, on their schedule. What changes is that the vulnerability class behind those 11,334 disclosures stops applying to you, and nothing about it is on your calendar.
Rankings, for the record, are not a reason to stay. Done properly - every URL mapped, every redirect written before cutover, Search Console watched for 30 days after - a migration keeps them. Done badly, it loses them. How to leave WordPress without losing your rankings covers exactly what "properly" means.
A five-minute decision
- Add up your monthly WordPress bill - hosting, security, licences, care plan, your time.
- Count your plugins, and circle the ones your business could not run without.
- If the bill is over $100 and nothing is circled: get a migration quote and compare payback.
- If something is circled: price replacing that one thing before anything else. If it is not replaceable, stay and harden.
- If the bill is under $30 and you patch it yourself: stay, harden, and revisit in a year.
Want the numbers for your own site? Drop your URL and get a free audit - plugin count, known-vulnerable plugins, and what the stack costs you a month - then a 20-minute call. You leave with a fixed quote or an honest "stay and harden", whichever the numbers say.
FAQ
Is it cheaper to keep patching WordPress or to migrate? Over one year, patching is usually cheaper. Over three years, migration is usually cheaper for any site paying more than about $100 a month to stay - because the migration is paid once and the patching bill never stops.
Does migrating off WordPress lose Google rankings? Not when every URL is mapped to a 301 redirect before cutover and Search Console is monitored after it. The rankings are attached to the URLs and content, not to WordPress.
Can a migrated site still be hacked? Any site can be attacked. A migrated site has no plugin layer and no WordPress login exposed, so the class of vulnerability behind 91% of last year's disclosures does not apply. There is nothing for the owner to patch monthly; the hosting platform maintains its own infrastructure.
What if I only need a few edits a year? Then you may not need an editor at all. A pre-built site with an edit request to a developer twice a year is cheaper and safer than any admin panel. An honest quote will tell you that rather than sell you one.
Sources: vulnerability figures from Patchstack — State of WordPress Security in 2026. Price ranges for the stay-and-patch camp are the published 2026 prices of managed WordPress hosts, security/virtual-patching services and agency care plans; migration ranges are published productized prices from migration studios as of September 2026. Your numbers will differ - that is the point of the calculator.