I've used WordPress for 20 years, and I've stopped recommending it

After two decades building websites, including more than 1,500 commercial WordPress sites, agency owner Ajay Chavda no longer recommends WordPress. He argues that routine maintenance has become risky and costly: plugins share unrestricted access to site files and data, updates can break functions without triggering automatic rollback, and agencies often troubleshoot failures manually. The piece cites 11,334 newly recorded ecosystem vulnerabilities in 2025, mostly in plugins and themes; a survey in which 65% of agencies named updates a major challenge; and performance data showing fewer than half of WordPress sites passed Core Web Vitals. It also criticizes the dashboard’s promotional clutter, the unpopular block editor, missing built-in features such as backups and webhooks, and governance concentrated in one person, pointing to the 2024 dispute with WP Engine.

Chavda contends these weaknesses stem from WordPress’s foundational design and cannot be solved by layering on more plugins, staging tools and maintenance services. Hosted alternatives, he says, address some problems but can bind businesses to a single vendor and are not designed for AI-driven publishing. He introduces Hatamoto as a CMS intended to provide the essentials - editing, news, forms, menus and caching - without the same fragility. Its built-in MCP server lets AI agents work through individually permissioned keys; agent-created content remains a draft, passes validation, is logged, and can be restored through revisions. The larger argument is that modern CMS platforms must be secure, dependable and ready for controlled automation.