Is It Time to Move Off WordPress? A 2026 Guide for NZ Businesses
Is It Time to Move Off WordPress?
Short answer: if your WordPress site is stable, fast and cheap to run, stay put. Move if you are paying for a stack of plugin subscriptions, chasing security updates, running your email marketing and CRM in separate tools, or waiting on a developer for changes you should be able to make yourself. In 2026 the gap that matters is not design, it is what the platform does for you once the site is live, and how much of your risk sits in plugins you did not write.
WordPress is not dying, but it is slipping
Worth being accurate about this, because the numbers get exaggerated in both directions. WordPress still runs more of the web than anything else. As at 27 August 2026, W3Techs measures it on 40.7 percent of all websites, a content management system market share of 58.9 percent. It is not going anywhere.
What has changed is the direction. Twelve months ago the same survey had WordPress on 43.4 percent. It has fallen every month since, while Shopify climbed from 4.8 to 5.3 percent and the share of sites using no traditional CMS at all rose from 28.6 to 30.9 percent (W3Techs historical trends). A slow, steady drift, not a collapse.
The honest problem is not the software, it is the model. WordPress ships as a blank content system, and everything a business actually needs gets bolted on afterwards. Contact forms are a plugin. SEO is a plugin. Ecommerce is a plugin, and then payment, shipping and tax are plugins on top of that. Email marketing sits in a separate subscription. Your customer data sits somewhere else again. Each piece has its own licence, its own update cycle and its own way of breaking.
The plugin layer is where the risk lives
This is the part most business owners are never shown, and it is measurable. Patchstack's State of WordPress Security in 2026 found 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42 percent increase on 2024. 91 percent were in plugins and 9 percent in themes. Only six were in WordPress core itself, and those were low priority.
Read that again, because it settles the argument. WordPress core is well maintained and secure. The exposure comes from the extension layer, built by thousands of independent developers with no shared standard, and it grows with every plugin you install.
The same report found 1,966 of those vulnerabilities, 17 percent, were high severity, meaning likely targets for automated mass attacks. It also measured how fast attackers move: for the most heavily exploited flaws the weighted median time from public disclosure to first exploitation is five hours, and roughly half of high impact vulnerabilities are exploited within 24 hours. In a separate large scale test of popular hosting companies, Patchstack found only 26 percent of vulnerability attacks were blocked at the hosting layer.
A five hour window is the practical point here. If your site is patched monthly by a maintenance retainer, or whenever someone remembers, you are not patching ahead of the attack. You are patching after it.
What changed in 2026: the platform now does the work
The second reason this conversation has shifted is AI, and specifically AI built into the platform rather than added as one more plugin subscription.
New Zealand businesses are already there. Xero surveyed 1,081 of its New Zealand small and medium business customers between 31 March and 7 April 2026 and found 61 percent are proactively using AI, with 79 percent of those learning by self guided experimentation (Xero, May 2026). MYOB's Business Monitor puts the figure lower at 36 percent of New Zealand SMEs, rising to 64 percent for businesses with 20 or more staff and 30 percent for those with one to five. The samples differ, Xero's customers are already digital by definition, so treat the range rather than either number as the truth. Either way, a large share of Kiwi businesses are using AI and mostly teaching themselves.
That is the case for the tools being where the work already happens. Oncord, the platform we build most of our client sites on, added an AI assistant to its page editor on 24 September 2025. It writes and rewrites copy in the editor, proofreads, translates, generates SEO meta descriptions and keywords, and in chat mode it applies the change you describe in plain language by writing the underlying code itself. The design wizard uses AI to generate templates, and the help centre answers questions with AI rather than sending you into documentation.
On 22 July 2026 Oncord released the Oncord Agent. It sits on every page of the admin dashboard and behaves more like a staff member than a search box. Ask it what your top selling products were this month, have it summarise every submission of a form, ask which pages get the most traffic, or point at any element on screen and ask what it does. It queries your own data, builds the report on the spot, compares it to the previous period, and offers to make the change for you.
The reason that works is structural. Your website, customer database, sales and campaigns are in one system, so the assistant can see the whole picture. On a typical WordPress setup the same data is split across a CMS, a store plugin, a mail tool and a CRM, and no assistant can reason across four disconnected systems it cannot read.
Independent recognition, not just our opinion
On 25 November 2025 Oncord won New Zealand Small Business App of the Year at the 2025 Xero App Awards (Xero App Store). That category is judged on the difference the software makes to small businesses. For a business already running Xero it is a useful signal, and the native Xero sync means your website, orders and invoicing stop being three separate jobs.
WordPress and Oncord side by side
| WordPress | Oncord | |
|---|---|---|
| Core system | Free, self hosted | Subscription, hosting included |
| Getting to a working business site | Theme plus multiple plugins | Website, CRM, email marketing and ecommerce in one platform |
| Ongoing maintenance | Core, theme and plugin updates, plus compatibility testing | Handled by the platform, nothing to patch |
| Security exposure | Grows with every plugin added | Single maintained codebase |
| Built in AI | Third party plugins, each with its own subscription | Editor assistant and the Oncord Agent across the dashboard |
| Customer data | Usually in a separate CRM | Native, connected to the website and campaigns |
| Xero | Via plugin or middleware | Native integration |
| Best suited to | Content heavy publishing, or teams with in house developers | Businesses that want one system and less admin |
When WordPress is still the right call
We are not going to pretend this is one sided. Stay on WordPress if you have an in house developer who knows the stack well, if you depend on a niche plugin with no equivalent elsewhere, if you are running a large editorial operation with many authors and a custom publishing workflow, or if your site was built recently, performs well and costs you almost nothing to keep running. Changing platforms for the sake of it is an expensive way to end up in the same position.
What a migration actually involves
The part most people fear is losing their search rankings. Done properly that does not happen. The work is content and structure first: every existing URL is mapped, redirects are put in place, page titles and meta data come across, and the site structure is kept intact unless there is a reason to improve it. Products, customers and order history are migrated rather than retyped. You can keep your existing design and simply move the engine underneath it, or use the move as the moment to redesign. More detail on how we handle it is on our website migration page.
Common questions
Not sure whether to move
Ask us for a free in depth website audit. We will look at your current WordPress site, tell you what it is costing you in plugins and maintenance, what the speed and SEO position is, and give you a straight answer on whether moving is worth it. If the answer is stay where you are, we will say so.
Sources
- W3Techs, usage statistics and market share of content management systems, figures as at 27 August 2026.
- Patchstack, State of WordPress Security in 2026, covering vulnerabilities disclosed during 2025.
- Xero, From curious to confident: how Kiwi business owners are adopting AI, May 2026.
- Xero App Store, 2025 Xero App Awards, New Zealand.
- Oncord, AI Features Have Arrived and Introducing the Oncord Agent.
