Skip to content

Platform comparison

WordPress vs Next.js + Payload:
what actually changes.

Quick answer

WordPress is one application that both edits and serves your site, extended by plugins you keep patching. Next.js + Payload splits the two: a private editing panel for your team, and pre-built pages for everyone else. You give up installing features yourself; you stop running twenty other people's code on your public site. WordPress still wins when a plugin is your business.

· LastPatch · 8min

WordPressNext.js + Payload

WordPress

  • ~40%of all websites run WordPress, so help is everywhere
  • 91%of 2025's 11,334 WordPress vulnerabilities were in plugins

Next.js + Payload

  • $0in license or per-seat fees - Payload is MIT open source
  • 1codebase to update, tested together and deployed on purpose

Usage and vulnerability figures are for 2025. Every figure is sourced

At a glance

What you'd notice as the owner.

WordPress vs Next.js + Payload
Editing day to day

WordPress

wp-admin and the block editor - familiar to almost anyone who has written for the web, alongside the update notices and plugin banners.

Next.js + Payload

A private editing panel with exactly the fields your content has. Drafts, version history and live preview are built in, and editors never see an update nag.
What the internet can reach

WordPress

The whole application: the login page, every plugin's code and the database behind them, on the same server that shows your homepage.

Next.js + Payload

Mostly pre-built pages served from a CDN. The editing panel is still a login - one you can restrict to your team - with no third-party plugin layer behind it.
Monthly patching

WordPress

Core, theme and every plugin, each on its own maintainer's schedule. Auto-updates help, and occasionally break the site.

Next.js + Payload

No plugins updating themselves. Framework updates arrive as one dependency change a developer tests and deploys on purpose.
Speed

WordPress

Pages are assembled on every request unless a caching layer is added; heavy themes and page builders make good scores hard work.

Next.js + Payload

Pages are rendered ahead of time or cached at the edge, so most visits never touch the database. Fast is the default, not an add-on.
Recurring cost

WordPress

Free software, paid upkeep: managed hosting, security, backups, premium licenses and often a care plan - $100-$600 a month for a typical business site.

Next.js + Payload

Payload itself is free and open source. You pay for hosting the site and its database - usually tens of dollars a month for a small site - and for developer time when you want something new.
Adding a feature

WordPress

Install a plugin in minutes, often without a developer. Each one is more code to keep updated for as long as the site lives.

Next.js + Payload

A developer builds it into the site once - slower to start, and it doesn't arrive with its own update schedule and license renewal.
Ownership and lock-in

WordPress

Open source, and every host supports it. Your posts are portable; the way page builders and plugins store your layouts often isn't.

Next.js + Payload

Open source too. The code lives in your own repository and the content in your own database. Figma has owned Payload since 2025 and has said it will stay open source.
Finding help

WordPress

It runs about 40% of all websites, so freelancers, agencies and answers are everywhere - of very mixed quality.

Next.js + Payload

A much smaller pool: you need a developer comfortable with TypeScript and React, and fewer of them know Payload specifically.

Want the cost row with your own numbers? Run the WordPress tax calculator

Under the hood

For whoever signs off on the stack.

Compare the architecture, row by row
Compare the architecture, row by row
Language and extension model

WordPress

PHP. Behavior is extended through hooks and filters, mostly by third-party plugins and themes loaded at runtime.

Next.js + Payload

TypeScript end to end. Collections, fields, hooks and access rules are declared in a config inside a Next.js app, with types generated from it.
Data model

WordPress

MySQL or MariaDB. Posts, pages and custom post types share one table; custom fields are key-value rows in postmeta.

Next.js + Payload

Collections and fields you define, stored in Postgres, MongoDB or SQLite as real columns and documents.
Admin panel

WordPress

wp-admin is part of the same PHP application that renders the public site.

Next.js + Payload

A React admin mounted as a route group in the Next.js app (/admin by default), or run as a separate deployment the public site reads from.
Rendering

WordPress

Server-rendered PHP per request; full-page caching comes from the host or a plugin.

Next.js + Payload

React Server Components with static, incrementally regenerated or dynamic rendering chosen per route. Pages can query Payload in-process, with no HTTP round trip.
APIs

WordPress

REST API in core since 4.7. GraphQL needs the WPGraphQL plugin.

Next.js + Payload

REST, GraphQL and a server-side Local API are all part of core.
Access control

WordPress

Roles and capabilities, site-wide. Per-field or per-document rules come from plugins or custom code.

Next.js + Payload

Functions per operation at collection, global and field level - "editors can update only their own posts" is a few lines.
Configuration and version control

WordPress

Much of the setup - plugin settings, widgets, menus - lives in the database, so it is hard to review, diff or roll back.

Next.js + Payload

Schema and behavior are code in git. SQL adapters generate migration files, so a schema change is reviewed and deployed like any other commit.
Hosting

WordPress

Any PHP host, from shared plans to managed WordPress platforms.

Next.js + Payload

Anywhere Node.js runs, usually with managed Postgres. Cloudflare Workers has an official template, on a paid Workers plan, with its D1 adapter still in beta.
Security updates

WordPress

Core, themes and plugins patch independently. Patchstack counted 11,334 new vulnerabilities in the ecosystem in 2025, 91% of them in plugins.

Next.js + Payload

One dependency tree, updated and tested together. Fixes still happen - React Server Components had a critical one in December 2025 - so someone has to own them.
License

WordPress

GPLv2 or later.

Next.js + Payload

MIT.

The honest part

When WordPress is still the right call.

  • A plugin is your business.

    Bookings, memberships, courses, a marketplace - if one plugin runs it and nothing replaces it cleanly, rebuilding it rarely pays back.

  • You add features every week.

    If your team genuinely uses the directory's 60,000-plus plugins, that flexibility is worth its upkeep.

  • The site is cheap and you patch it yourself.

    Under about $30 a month and an hour on a Sunday, a migration takes years to pay for itself.

  • Marketers rebuild pages on their own.

    Page builders let non-developers redesign layouts. Payload can offer drag-and-drop blocks, but a developer builds the blocks first.

And when we wouldn't pick Payload either

  • The site changes a few times a year.

    It doesn't need an editing panel at all. Pre-built pages with no login anywhere are simpler and cheaper still.

    Better fitA static site

  • Several people edit one document at once.

    Sanity's real-time co-editing suits that team better. WordPress doesn't have it either - it was pulled from 7.0 before release.

    Better fitSanity

  • It's an online store.

    A commerce platform handles payments, card compliance and checkout uptime, which a CMS shouldn't have to.

    Better fitA commerce platform

The full stay-or-leave decision, with the math: Should I keep patching WordPress, or leave?

FAQ

WordPress vs Payload, straight answers.

  • The software is: Payload is open source under the MIT license, with no per-seat or per-document fees. You still pay for hosting the site and its database, and for whoever builds and maintains it.

  • Yes. Writing, images, drafts, scheduled publishing and version history all happen in the editing panel. What needs a developer is changing what the site can do - a new kind of page, a new feature - the things that would have been a plugin on WordPress.

  • Yes, though not with a one-click importer - there isn't an official one. We export posts, pages, authors, categories and media, map them onto the new collections, and import them with a script we run against a copy first. Every old URL gets a redirect.

  • Not if every URL is mapped to a 301 redirect before cutover and Search Console is watched after it. Rankings follow your URLs and content, not the CMS behind them.

  • Anywhere that runs Node.js with a database: a serverless platform with managed Postgres, a plain Node server, or Cloudflare Workers on a paid plan. The quote names the host and what it costs a month.

  • Your site keeps running: the code is in your repository and the content in your own database, not in a vendor's account. Payload is MIT-licensed, and Figma, which bought it in June 2025, has said it will remain open source. A license on code you already run can't be taken back.

  • It removes the plugin layer, which is where 91% of 2025's WordPress vulnerabilities were. It doesn't make a site untouchable: the framework still ships security fixes, and the editing panel is still a login to protect. The difference is one codebase your developer controls instead of twenty on other people's schedules.

Sources (9)

Facts checked 11 September 2026.

Free audit · 20-minute call · No obligation

Make this the last patch
you ever install.

Drop your URL. You'll see your plugin count, known-vulnerable plugins and what the stack costs you a month - then pick a time to go through it together. You leave with a plan either way: a fixed quote, or honest advice to stay put.

See how it works