WordPress or custom build? Choosing a platform for a nonprofit or public-sector website

Most website RFPs from nonprofits and public bodies ask the same question in different words: should we stay on WordPress, move to a hosted platform, or have something built for us? There is no universal answer, but there is a reliable way to decide. Start from the three things that matter most for an organization with a small team and a public mandate: who will maintain the site, what it must comply with, and what it costs over five years rather than at launch.

The three options

WordPress runs about forty percent of the web. It is familiar, inexpensive to start and easy to hire for. Its weaknesses are the ones that come with scale: a site that has grown for years usually carries dozens of plugins, each with its own update schedule, and page builders that get heavier and less consistent over time.

Hosted or software-as-a-service platforms (including the municipal website products) remove most maintenance. In exchange you accept licence fees, limited design flexibility, and often data stored outside Canada.

A purpose-built site, typically on an open-source framework such as Next.js with a simple admin panel, is fast and accessible by design, has a small attack surface and no licence fees. Its risk is perceived vendor lock-in, which is addressed by using standard open-source technology, giving the organization ownership of the code and accounts, and documenting everything.

What to compare

Accessibility is the deciding factor more often than people expect

Ontario's AODA requires public websites of designated organizations to meet WCAG 2.0 Level AA. In practice, accessibility failures on WordPress sites rarely come from WordPress itself; they come from themes with poor heading structure, sliders with text baked into images, and forms built by plugins that do not label their fields. If you keep WordPress, budget for an accessibility audit of the theme and every plugin. If you build custom, insist that accessibility is tested on every release, not audited once at the end.

Security is about attack surface, not brand names

Public-sector guidance in 2026, including advisories from Ontario's Cyber Security Centre of Excellence and the Canadian Centre for Cyber Security, focuses on reducing attack surface and retiring components nobody maintains. A WordPress site with thirty plugins depends on thirty vendors' patch schedules. A purpose-built site with no third-party plugins removes that class of risk. Neither approach is secure by itself; both need firewalls, encryption, backups and monitoring.

A practical way to decide

1. Count the plugins and integrations on the current site and how many are still needed.
2. List the audiences and the three tasks each must complete in three clicks or fewer.
3. Decide where data must live and who must be able to edit pages without a developer.
4. Price five years, not one: licences, hosting, support hours and a redesign cycle.
5. Ask any vendor how you would leave them: who owns the code, the content and the hosting account?

If the answers point to a small team, strict accessibility and privacy needs, and a site that should last, a purpose-built platform usually wins on total cost and on risk. If the organization already has WordPress skills in house and modest requirements, a disciplined WordPress rebuild with far fewer plugins can be the right call. We build both, and we will tell you which one fits before you commit.