Why we don't build on WordPress (and why most Bangladesh agencies still do)

We get asked this almost weekly: “Why don’t you build on WordPress? It’s free, everyone knows it, and clients want to edit their own content.”

The short answer: WordPress is free to install and expensive to live with. The long answer is below.

The Bangladesh agency math

Walk through any agency’s site in BD and you’ll find the same pattern: WordPress core + Elementor + a multipurpose theme (Avada, BeTheme, Astra) + 12-30 plugins for forms, sliders, image optimization, SEO, security, caching, cookies, GDPR, WhatsApp chat, and a thousand other shims for features that should be built in.

Why does every agency build this way? Because:

• The tech is free to start
• Junior developers can be productive in a week
• Every requirement maps to a plugin that already exists
• Selling at ৳15,000 needs zero custom code

The problem isn’t WordPress itself. The problem is what that price point demands — a thousand plugin patches stacked on top of each other, each maintained by a different person, each loading on every page.

The performance tax

Run a fresh Lighthouse audit on any Elementor-built BD agency site. The pattern is consistent:

• 5–9 seconds Largest Contentful Paint on mobile
• 40–60 MB of total page weight
• 80–150 HTTP requests
• 300–500ms Time to First Byte
• Lighthouse Performance score: 18–45

Now compare those numbers to what Google’s algorithm actually rewards. Core Web Vitals are a ranking signal. LCP target is under 2.5 seconds. Most of these sites are 3-4x over the budget.

The owner doesn’t see this. The owner sees their site loading fine because it’s cached in their browser. The first-time visitor on a 4G phone in Mirpur sees an 8-second white screen and bounces.

The security tax

WordPress core itself is well-maintained. Plugins are not. The average WordPress site we audit has:

• 1–3 plugins with known CVEs in the current version
• 4–7 plugins whose authors haven’t pushed an update in 12+ months
• 1–2 plugins requested from third-party download sites (cracked/pirated)

The result, in production, is the BD pattern we see roughly once a week: a client messages us saying their site got “hacked.” It wasn’t hacked — a plugin XSS vulnerability got exploited, malicious JS got injected into every page, Google flagged the site, and traffic crashed.

The recovery cost (clean reinstall, malware scan, rebuild, Search Console review request) often runs 2-3x the original site cost. The brand damage is unrecoverable.

What we build instead

Static sites on Astro. Server-rendered apps on Laravel or Next.js. The choice depends on what the project needs.

For a marketing site (no logins, no transactions), Astro outputs pure HTML + CSS + a sprinkle of JS where needed. Pages load in under 1 second. No plugins to update. No database to compromise. The site sits on a CDN and serves the same HTML to everyone — fast, cheap, secure.

For an e-commerce or platform build, Laravel 12 + Livewire or Next.js 15 with a Postgres database. Hand-coded admin, hand-coded checkout, hand-coded everything. Updates ship via git push, not a plugin auto-updater that breaks half the site.

”But clients want to edit their own content”

True. We don’t argue this. The fix is a real CMS — either a hosted one (Sanity, Storyblok, Strapi) or our own Laravel-based admin. The editing experience for a content writer is better than WordPress, not worse, once it’s built around their actual workflow instead of a generic page editor.

When WordPress is actually right

Honestly: small static sites where the budget genuinely is ৳10–15K and the client will manage their own content for the next 18 months until they outgrow it. We refer those to friendly WordPress devs because that’s not our market.

For everyone else — every business that wants to grow, rank, convert, and not have a 2 AM phone call about their site being down — the WordPress route is the more expensive option, just on a longer timeline.