Choosing a content management system: WordPress, custom or headless

Two businesses can ask for the same website and need completely different software behind it. A boutique that posts three offers a month and a news site publishing twenty stories a day have almost nothing in common once you look past the home page. That is why choosing a content management system is less about feature lists than about honest answers to two questions: who will edit this site, and who will look after it a year from now.

This article compares the three routes most Indian small businesses actually consider, with the trade-offs that only show up after launch.

What the three options really mean

A ready-made CMS such as WordPress

Software you install on your own hosting, with a large ecosystem of themes and plugins. You get an editing interface, user roles, media handling and a blog on day one. WordPress is the most common example, and platforms like Joomla or Drupal sit in the same family.

A custom-built admin

Your developer builds the website and an admin panel shaped around your content. There is no plugin marketplace; every feature exists because someone wrote it for you.

A headless CMS

The content lives in one system with no front end of its own, and the website (or app, or both) fetches it through an API. Editors work in a clean content tool while developers build the display separately.

Cost over three years, not three months

Comparing quotes for the build alone is misleading. Think in terms of what you will spend by year three.

• Ready-made CMS: lowest starting cost, especially with a commercial theme. Ongoing costs are hosting, annual licences for premium plugins, and someone to apply updates.
• Custom: highest starting cost because everything is written for you. Ongoing cost is your developer's time for changes, with no plugin licences.
• Headless: usually a middle to high build cost, since the front end is built from scratch. The CMS itself may be a monthly subscription that grows with users or API calls.

Also price the small changes. If adding a new page type means a developer every time, budget for that. If you can do it yourself in an afternoon, that has real value.

Who edits the site matters more than you expect

Ask who will actually be typing. If it is a non-technical colleague between other duties, the editing experience decides whether the site stays current or goes stale.

Ready-made systems give a familiar editor but often let editors break layouts, especially with page builders that expose hundreds of settings. Custom admins can be shaped precisely: a form with the exact fields a product or article needs, and no way to wreck the design. Headless tools tend to have tidy, structured editors, but the editor cannot see the finished page unless a preview was built for them.

A good test before committing is to sit your least technical colleague in front of a demo and ask them to add a product with an image and publish it. Watch where they hesitate.

Flexibility and where each option strains

Every approach is comfortable in a certain shape of content and awkward outside it.

• A ready-made CMS handles pages, blogs and standard stores easily. It strains when your data is unusual, such as a booking system with complicated availability rules, and you end up stacking plugins.
• A custom build handles unusual workflows well because it was designed for them. It strains when you want a common feature quickly, since even a contact form variant needs developer time.
• Headless suits content reused in several places, such as a website plus a mobile app. It strains for a simple brochure site, where you have added moving parts for no gain.

A practical warning sign for ready-made systems is plugin count. When one site needs fifteen or twenty plugins to function, each with its own update cycle and possible conflicts, the "cheap" option has quietly become an expensive one.

Security and upkeep: the part people skip

Popular software is attacked more often, not because it is badly built but because one working exploit reaches thousands of sites. If you run a ready-made CMS, updates are not optional. That means core, theme and plugin updates applied promptly, on a schedule someone owns.

Custom code attracts far less automated attack traffic, but it gets no community security patches either. Its safety depends on the quality of the developer's work and on keeping the underlying framework and server packages updated.

Headless setups reduce the attack surface of the public site, since the front end may be static or server-rendered with no admin login exposed. You still depend on the vendor's security if the CMS is hosted for you.

Whatever you choose, three things stay constant: automated backups you have actually restored once as a test, HTTPS with a valid certificate, and two-factor authentication on admin accounts.

A short way to decide

Answer these in order and the shortlist usually narrows to one.

1. How often does content change, and who changes it? Rarely and by an agency points to almost anything; daily and in-house points to a strong editor.
2. Is your content standard (pages, posts, products) or genuinely unusual? Unusual leans custom.
3. Will the same content feed an app or another channel? Yes leans headless.
4. Who applies updates every month, and are you paying them? No clear answer means avoid a plugin-heavy setup.
5. What happens if your developer disappears? Prefer options where another professional can pick up the work, which usually means mainstream technology and documented code.
6. Can you export your content in a usable format? Check this before signing anything.

Making the call for your business

Write down your answers to those six questions and share them with whoever will build the site. A developer who recommends the same platform regardless of the answers is recommending what they like, not what you need.

If you want a second opinion on which route fits your content and team, our team is happy to talk it through; see how we approach business website development and what different builds cost.

Frequently asked questions

Can I move from WordPress to a custom system later?

Yes. Content can usually be exported and imported, and URLs can be preserved with redirects. The work is in rebuilding the design and any plugin-driven features, so plan it as a project rather than a switch.

Is WordPress secure enough for a business website?

It can be, provided updates are applied regularly, plugins come from reputable sources and admin accounts use two-factor authentication. Neglected maintenance, not the software itself, causes most compromises.

Do I need a CMS at all for a five-page site?

If the content changes once a year, a simple hand-built site is cheaper and faster. Add a CMS when you expect to edit content yourself without calling anyone.

What does headless actually cost to run?

It varies widely. Some content platforms have free tiers for small teams and charge as users, records or API requests grow, and you still pay for hosting the front end. Check the pricing tiers against your expected growth before committing.