Thinking of jumping ship from WordPress?

Right, I'm not going to address the elephant in the room. There's been a lot of drama, and I don't want to get dragged into it. I do want to give my opinions on WordPress after being a developer for over 10 years, a good few of which were spent working with WordPress.

What is WordPress?

A lot of you are probably on WordPress right now. It's the most popular CMS in the world, and supposedly makes up over 40% of all websites. I don't know if that's true, but it's probably close.

To be fair to WordPress, it was a very good tool compared to what was around when I started. From my perspective, it was far better than Joomla, Drupal, and even Typo3.

Still, not many people drive a horse and carriage anymore. That said, it can still be the right call for a small site: our WordPress rebuild for St Mary's Church in Nottingham has run on the same setup since 2018, and parish staff edit it themselves.

Why consider a change?

Before I get to my hot take on which route you should take, here's why you might want to look at alternatives to WordPress.

Plugins

Plugins are useful, but they're a big security risk. They're also the reason the one WordPress website we still maintain (a family friend's) just stopped working.

They're non-standard, they're not designed for a modern tech stack, and they're a maintenance nightmare. The moment you stop updating WordPress, your plugins will stop working, and the more plugins you have, the more likely you are to get this:

Security

Have you ever seen a website or hosting account that has been utterly hacked? We've only seen it once. Guess what it was running.

This week gave us a better example than our anecdote. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4 9.2. They allow unauthenticated remote code execution on any PHP install that serves web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, and the affected code goes back to PHP 5.4. Reports differ on whether attackers are using it yet.

The PHP project fixed both on October 21, 2026, the day they were disclosed, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 to 8.1 get source backports only. PHP 5.4 to 7.3 get no fix at all.

WordPress itself isn't the bug, and WordPress.org says no WordPress update is planned. A bug in the PHP runtime exposes every PHP site at once, and nothing you do inside WordPress fixes it. Updating core and pruning plugins both miss it. The fix is your host updating PHP, so on this one your site's safety depends on how fast your host moves.

Does going headless remove this?

It doesn't if WordPress is still the backend. Headless WordPress still runs PHP, so it needed the same patch as any other WordPress install. Moving the frontend to Next.js doesn't change what runs your CMS.

If security is why you're looking at WordPress alternatives, ask one question of each option: does it run PHP on a server that you or your host have to patch? We recorded our take on PHP2Shell in Is WordPress safe after PHP2Shell?.

No spam, only good stuff

Subscribe, for more hot takes

Only god knows why anybody would purposefully subscribe themselves to a newsletter that moans about development. These poor souls did though

Email address

Subscribe

What should I change to?

If you have a website that's under $10k, you're probably better off using something like Framer or Webflow. Above $10k, it's time to look at a tool like Sanity, Next.js and Vercel.

I'll cover Framer and Webflow quickly. They're basically the same drag and drop website builders, but Framer gives you a bit more control over the code, and from our testing it typically performs better. I recommend them under $10k because they're easy to use, you can get a website up and running quickly, and the result is pretty good for what you pay. They won't necessarily scale, but they're a good way to get something live fast.

With a bigger budget, Sanity is where I'd go. Here's why.

Key features

1. Sanity is headless. It separates the content backend from the frontend, so you pick the frontend you want to use. That's much nicer than hacking plugins on top of WordPress to get it to do modern development. I'm looking at you, Timber.
2. The content studio is customizable. You don't have to look at the regular WordPress dashboard, because you build your own editing environment around your team's needs, including a full editing flow where content gets signed off at every stage.
3. Collaboration is real-time. You and a colleague can edit the same document at the same time and watch each other's cursors move around it.
4. Sanity has its own query language, GROQ. If you're comparing query languages right now, this is the one I'd pick. It's essentially GraphQL, but better, and it scales well.
5. Sanity keeps version history. We've broken our own website a number of times and been able to revert to a previous version. You shouldn't have to worry about making changes to key pages.
6. Content modeling is flexible. The old "measure twice, cut once" advice applies to content models, so think about how you'll scale them, how you'll enrich them with other documents, and how you'll reuse the content.
7. It's API-first. You access your content through APIs, which suits multi-channel publishing. A mobile app, email automation, or an RSS feed is an API call away from your tech stack.

There are a lot of buzzwords here. What does it actually mean?

As far as we're concerned, it's the best editorial experience on the web. You can drag and drop content and get near instant feedback. You can scale it, customize it, and make it do basically anything you want. But you have to build it right.

That's where the real work is, and you'll need a good team for it. Ask them these questions:

1. Are you using the latest version of Sanity and Sanity Presentation?
2. Are you using the latest version of Next.js and the app router?
3. Are you using Tailwind CSS?
4. Are you using TypeScript?

If any of these are no, run. If they're all yes, you're probably in a good place.

Why is a good team more important than ever?

WordPress is a monolithic framework and Sanity is a headless CMS. You can botch together a WordPress site with a few plugins and get something working. You can't do the same with Sanity and Next.js.

That isn't a bad thing, but it's worth knowing going in. The trade-off is that it's very resilient, and you can build and integrate basically anything you want. For perspective, we built a website when we first set up our business 7 years ago. It's fully functional, still scores in the late 80s to 90s on Lighthouse, and we've never had to touch it.

WordPress cheat sheet

Here's a quick reference for common WordPress features and their Sanity equivalents.

Moving to a headless stack is a bigger shift than a one-to-one feature swap, but you get better performance and a better editing experience for it. If the site is mostly articles and landing pages, Astro is often the lighter frontend to land on. When you're ready, our post on how to migrate from WordPress to Sanity fast walks through the process step by step, and our CMS migration service covers it end to end if you'd rather hand it off. There's also a guide per platform if WordPress isn't the only system in the mix.