A longtime WordPress developer published a piece this week tearing into the platform after 15 years inside it. I read it twice. Almost everything he said lines up with what I see every week when a Hawaii small business calls me because their site just broke, slowed to a crawl, or started redirecting customers to a casino in another country.
His manifesto is written from the inside, from a developer's chair. Mine is written from yours. You own a shop in Kailua, a clinic in Pearl City, a restaurant in Chinatown, or a nonprofit in Kapolei. You did not sign up to run a content management system. You signed up to run a business. Here is what the WordPress fight actually looks like from your side of the counter, and what I recommend instead.
"40% of the Web" Is Not a Reason
You have probably heard the pitch. WordPress runs 40% of the web, so it must be the safe choice.
Most of that 40% is throwaway blogs, abandoned directory sites, and half-finished projects. Popularity is not quality, and it sure is not security. It just means bots know exactly what to attack. When every bad actor on the planet has a script ready for your platform, "everybody uses it" stops being comforting and starts being the problem.
Core Is Not Ready For Your Business, Out of the Box
Here is the part that surprises most owners. A fresh, clean, fully updated WordPress install is not a safe website. It is a starting point that needs a pile of plugins just to reach the baseline your customers already expect.
You need a plugin for real SEO. In 2026. Search engine optimization, the single most important thing for your visibility, is not built in.
You need a plugin to turn off the old remote interface that bots hammer from minute one. You need another plugin for a real login firewall. Another for two-factor authentication. Another for backups. Another to actually send email reliably from your contact form. Another to make images load at a reasonable size.
Each one of those plugins is a door. Each door has a lock. Every lock eventually needs a new key. And the day you forget to rotate one of them, you find out the hard way.
"Free" Is the Most Expensive Word in Web Hosting
WordPress itself is free. That is the part of the pitch that is actually true. Everything around it is not.
A working WordPress site for a small business typically carries hosting, a domain, a premium theme, and somewhere between six and ten paid plugin subscriptions. A page builder. A form builder. A booking tool. A security suite. An SEO suite. A backup service. A caching layer. A newsletter integration. Each one sixty bucks a year, most on auto-renew, all silently stacking up on your credit card.
"Just cancel the ones you do not need" sounds easy until one of those plugins stops getting updates and a new vulnerability gets published. Then your choices are pay the renewal or wait for the attack. Neither is a good option.
On top of the subscriptions, most owners end up paying a maintenance retainer to somebody who can keep all those plugins from fighting each other. The free CMS becomes hosting plus domain plus eight subscriptions plus a monthly retainer. Let us stop pretending that is free.
You Are Paying for Someone Else's Turf War
Zoom out. WordPress is a platform where the theme developers, the plugin developers, the hosting companies, and the parent company all have overlapping and sometimes competing interests. That turf war ends up inside your site.
I have opened client sites where custom CSS lived in five different places. The theme. Three plugins. A builder. All of them overriding each other, none of them documented, one of them breaking the mobile menu every time the others got updated. That is not a bug. That is the architecture.
You are the one who ends up paying for it when the homepage quietly stops looking right on iPhones for three weeks and you do not notice until a customer mentions it in a review.
What Actually Matters to You: Speed, Reliability, Security
Forget the developer drama. From your side of the counter, a website has exactly three jobs.
It needs to be fast, because a slow site loses customers before they ever read your menu, your hours, or your phone number. Google has said this out loud for years. Every second of load time on mobile costs you bookings.
It needs to be reliable, because nothing is worse than a tourist searching for your shop on Kuhio Avenue, tapping your link, and getting a "database connection error" page right before they walk into your competitor's store.
It needs to be secure, because your website is often the front door to your reputation, your email, and your customers' data. A defaced or infected site can undo years of trust in a single afternoon.
WordPress can technically do all three. Keeping it doing all three, all the time, is a full-time job that most small business owners never signed up for.
The Stack I Actually Build On
This is the part where I put my own name on the line. Here is what I build for Hawaii small businesses in 2026, and why.
Cloudflare Pages for the Site
Cloudflare Pages serves your website as prebuilt static files from more than 300 data centers around the world, including right here in the Pacific. Static means there is no database, no PHP, no plugin chain running every time a visitor shows up. The server just hands the page over and gets out of the way.
The speed is not a marketing number. A well-built site on Pages typically renders in under a second from anywhere in Hawaii, on any phone, on any network. The reliability is quiet and boring in the best way. There is almost nothing to break, and if one data center has a bad night, another one serves your visitors automatically.
The security is the biggest win. A static site has almost nothing to attack. No admin login to brute force. No database to inject into. No PHP plugin to exploit. The attack surface collapses to near zero, and what little remains sits behind Cloudflare's enterprise edge network.
R2 for Media, Menus, and Downloads
R2 is Cloudflare's file storage. Photos, videos, PDFs, menus, brochures, whatever you need to serve.
The killer feature is that R2 does not charge you egress fees. Most storage services, including the famous ones, charge you every time a file leaves their network. That is how a viral Instagram post can turn into a surprise bill at the end of the month. R2 does not play that game. You pay to store, and that is it.
If your food truck gets featured on a local news segment and two thousand people download your catering menu in an afternoon, you are not going to hear from your accountant. You are going to hear from two thousand potential customers.
D1 for the Few Things That Really Need a Database
Not every site is purely static. You might want contact form submissions stored somewhere, a simple booking calendar, an inventory list, a gated members area. That is where D1 comes in. D1 is Cloudflare's serverless SQL database, living right next to your site on the same edge network.
Serverless is the key word. You are not paying for a database server to sit idle at 3 a.m. You pay for the handful of queries your site actually runs. And because D1 lives on Cloudflare's network, your data is close to your visitors instead of halfway across the ocean.
For the vast majority of small business needs, this stack is the whole answer. Speed, reliability, and security come built in, not bolted on with a stack of paid plugins.
What You Give Up, Honestly
I will not sell you a perfect world. Here are the real trade-offs.
You give up the WordPress admin dashboard as you know it. Most small business owners edit their own site once or twice a quarter, so for them I set up a simpler editing flow. For clients who post weekly or run a blog, I can plug in a modern headless editor that feels familiar without any of the WordPress baggage.
You give up the plugin marketplace. Most of those plugins exist to patch problems WordPress created in the first place, so on Cloudflare Pages most of them are either built in or unnecessary.
You give up the false comfort of "everyone uses it." That comfort has cost a lot of Oahu business owners a lot of sleepless nights. I would rather build you something that just works.
Revolution or Collapse, Your Version
The developer who wrote the original manifesto ended his piece saying WordPress either has to reform or collapse. I agree with him, but I am going to add one line for you.
You do not have to wait for either one to happen. You do not owe WordPress your loyalty, and you do not owe the plugin ecosystem your subscription fees. Your business comes first. If your current site is slow, fragile, or constantly on the edge of breaking, you are allowed to walk away from it and build something better.
That is the whole reason I do this job.
If your WordPress site has been giving you trouble, or you are just tired of wondering whether today is the day it breaks, let's have a real conversation about what a modern website looks like for your business. Head over to https://www.dahawaiiwebsiteguy.com/contact, tell me what you are working with, and I will give you a straight answer. No pressure, no jargon, and no subscription traps.