Table of Contents
wordpress open source is the freely licensed WordPress software that lets your team inspect, modify, extend and self-host the codebase under the GPL, with no vendor lock-in on core files, data or hosting choice. A good implementation gives you documented custom code, clean content models, controlled plugin dependencies, measurable Core Web Vitals and a repeatable release process; a bad one hides decisions inside page builders, bundled themes and undocumented server changes.
What You Are Actually Buying in 2026
The software costs nothing. The invoice covers judgement. You are buying discovery, information architecture, theme engineering, plugin selection, integration work, content migration, performance budgets, accessibility checks, security hardening, QA and post-launch ownership. Ask a bidder to separate those line items. A single figure such as “website: $12,000” tells you nothing about who owns the child theme, who maintains the composer manifest, or who rolls back a failed update at 02:00.
Open source also changes the risk profile. Your vendor can fork a plugin, patch a core-adjacent bug, or move the site to another host. That freedom only has value if the repository, database exports, environment variables and deployment credentials are handed to you at launch. Request all four in the contract, not in a friendly email. Our 2026 vendor evaluation guide on open-source licensing explains the GPL obligations that apply to distributed themes and plugins, including the parts agencies often gloss over in proposals.
Decision makers should compare deliverables, not adjectives. “SEO-friendly” is not a deliverable. An XML sitemap, canonical rules, schema mapping, 301 redirect matrix, editable meta fields, image compression preset and a Largest Contentful Paint target under 2.5 seconds on mobile are deliverables. “Secure” is not a deliverable. Two-factor enforcement, least-privilege roles, disabled file editing, signed webhooks, WAF rules, daily off-site backups and a 30-minute restore test are deliverables.
Budget bands vary by integration depth. A brochure site with 12 templates and no CRM typically lands between $6,000 and $14,000 in 2026. A multilingual publishing platform with 40 content types, SSO, headless components and editorial workflow commonly runs $28,000 to $75,000. Ongoing care is separate: expect $250 to $1,800 per month for updates, monitoring, uptime response and a fixed number of change hours. If a quote includes “unlimited revisions”, check the change-control clause. It usually is not unlimited.
Vendor Options and What the Price Really Includes
Use the table below as a screening tool. It is not a ranking. It maps common vendor types to the artefacts you should receive. Ask every bidder to mark each cell as included, excluded or priced as an option. Ambiguity here becomes change orders in week six.
| Vendor type | Typical 2026 range | Code and repo ownership | Security and performance evidence | Best fit |
|---|---|---|---|---|
| Freelance generalist | $3,000–$9,000 | Often informal; request a Git transfer and theme inventory | Plugin updates and caching only; ask for before/after Lighthouse JSON | Small sites with one editor and no integrations |
| Template reseller | $1,500–$6,000 | Bundled commercial theme; license tied to vendor seat | Minimal; demo bloat often adds 1.2–2.8 MB of unused CSS/JS | Temporary landing pages with a 6–12 month horizon |
| Specialist WordPress agency | $14,000–$60,000 | Custom theme, composer file, CI config and docs in your repo | Hardening checklist, restore drill, Core Web Vitals budget, REST API review | Revenue sites, multilingual content, CRM or commerce hooks |
| Enterprise platform team | $75,000–$250,000+ | Monorepo, multisite or headless architecture, formal handover | Pen test, SLOs, staged rollouts, audit logs, 24/7 incident rota | Regulated sectors, multiple brands, 99.95% uptime targets |
Three questions expose most gaps. First: “Which files will you write, and which files will you configure?” Second: “Show me the rollback command for the last release you shipped.” Third: “What happens if we terminate after month three?” A credible answer names paths, branches, tickets and export formats. A weak answer returns to portfolio screenshots.
Ownership clauses to check
Insist on four clauses. Custom PHP, CSS, JS and block patterns are assigned to you on payment. Third-party licenses are listed with renewal dates and the buying entity. The database, media library and environment configuration are exportable within 48 hours of request. The vendor may not reuse your custom modules in another client project without written consent. These clauses matter more than a warranty paragraph.
Get a Quote
Email + requirement + budget range — we reply with a quote within 24 hours.
Plugin and theme governance
A healthy 2026 build usually runs 12–25 active plugins, not 45. Each plugin needs a named owner, a reason, an update channel and an exit plan. Prefer first-party or actively maintained code with releases in the last 90 days. Ask for a dependency review against the official WordPress developer documentation when a vendor proposes custom hooks, block registration or REST routes. For template-heavy bids, our 2026 guide to choosing a template vendor lists the licence and bloat checks worth running before design begins.
Security and API surface
Open source means attackers can read the same code you can. That is an advantage only when exposure is managed. Require an inventory of public REST routes, nonce and capability checks, rate limits on form and search endpoints, XML-RPC status, admin URL policy and file permission values. If the site feeds a mobile app or a CRM, read our WP REST API security brief and make its controls part of acceptance testing, not a post-launch add-on.
How to Run the Vendor Selection Step by Step
- Write a one-page brief with 3 business goals, 5 user tasks, top 20 URLs, current traffic, integration list, editor count, languages, accessibility target and a hard launch date. Attach analytics exports and 3 competitor URLs.
- Send the same brief to 4 vendors. Ask for a fixed-scope proposal with a work breakdown, named roles, plugin list, hosting assumptions, 3 milestones, acceptance criteria and a priced 12-month care option. Discard any response without a repository handover statement.
- Run a 45-minute technical review. Ask the lead developer to share a screen, open a recent theme folder, show the deploy script, explain one custom hook and demonstrate a rollback. Do not accept a sales-only call.
- Score evidence on a 100-point sheet: 25 for code ownership, 20 for security controls, 20 for SEO and performance budgets, 15 for content editor usability, 10 for support SLA, 10 for price transparency. Require a minimum of 75 to proceed.
- Pilot one thin slice before full build: one content type, one template, one form, one tracking event, staged deployment and a measured mobile Lighthouse run. Cap the pilot at 40 hours and pay for it separately.
- Sign with a defect window of at least 30 days, a 10% retention until handover, a documented backup restore test, and a 2026 maintenance calendar with update windows, quarterly dependency review and an incident contact.
Technical Due Diligence Before You Sign
Ask for a staging URL from a comparable project and test it yourself. Create a draft page, upload a 4 MB image, resize the browser to 375 px, run a keyboard-only pass through the menu and submit a form with an invalid email. You will learn more in 12 minutes than from a 40-slide deck. Check whether the editor sees named fields or a wall of shortcodes. Check whether image alt text is required or optional. Check whether a 404 returns the right status code.
Performance needs numbers tied to a device and network. Set a budget: mobile Largest Contentful Paint under 2.5 s, Interaction to Next Paint under 200 ms, Cumulative Layout Shift under 0.1, total initial JS under 180 KB compressed, and a 200 ms server response on a throttled 4G profile. Ask the vendor to record the test tool, device profile and commit hash. A screenshot without a commit hash is not evidence.
SEO architecture is a build decision, not a plugin install. Define custom post types, taxonomy depth, canonical behaviour for filtered archives, pagination rules, breadcrumb schema, hreflang pairs and redirect ownership before visual design starts. Retrofitting 600 URLs after launch costs more than modelling them in week one. If the proposal mentions an SEO plugin but no URL map, the vendor is outsourcing structure to defaults.
Content migration deserves its own acceptance sheet. Count pages, posts, media items, authors, categories, tags, featured images, embedded iframes and shortcodes. Sample 30 records manually. Require a redirect map with 301s, a diff report of missing metadata and a signed approval from your content owner. For broader scope and sequencing, the 2026 vendor guide to building with WordPress gives a practical work breakdown you can paste into an RFP.
When the scope includes tailored themes, SEO-ready architecture and security hardening as one accountable package, Custom WordPress Development is the cleanest procurement route: end-to-end website development with tailored themes, SEO-ready architecture and security hardening, delivered against a single specification instead of three disconnected suppliers.
Common Mistakes
- Buying a demo instead of a system. A polished theme demo hides 60 unused shortcodes, 14 bundled sliders and a licence that expires with the vendor seat. Avoid it by requiring a fresh install, a plugin inventory and a page built from your own content during the pitch.
- Confusing GPL freedom with zero maintenance. Core, PHP, MySQL and plugin releases keep moving in 2026. Avoid downtime by funding a monthly update window, a staging clone, automated backups and one restore drill per quarter.
- Letting the agency own the repo and the domain. This turns a routine vendor change into a negotiation. Avoid it by creating the Git organisation, registrar, CDN, analytics and payment accounts under your company email before kickoff, then granting scoped access.
- Accepting “SEO-ready” without a URL model. Default permalinks, duplicate archive indexes and unmanaged parameter URLs dilute crawl budget. Avoid it by approving a sitemap matrix, canonical rules and a 301 table before template coding.
- Skipping editor training until launch week. Editors then paste styled text from documents, break layouts and inflate image weight. Avoid it by scheduling two 60-minute role-based sessions, a 6-page field guide and a 10-task sign-off in staging.
Contract, Pricing and Handover Checks
Price clarity is a vendor-quality signal. Ask for a table of hours by discipline: discovery 8–16%, design 15–20%, front-end 20–25%, back-end 20–30%, QA 10–12%, migration 8–15%, project management 8–10%. Percentages that omit QA or migration are not a discount. They are a future invoice. Our breakdown of WordPress site cost in 2026 helps you test whether a quote is lean or simply missing work.
Split payment against evidence: 20% on signed specification, 25% on approved design system and URL map, 25% on staging feature complete, 20% on production launch, 10% after 30 days of defect resolution and handover. Tie each tranche to an artefact, not a calendar date. Include a rate card for out-of-scope hours so a new landing page does not become a renegotiation.
Handover is a folder, not a meeting. Require: repository with README and .env.example, database dump, media export, composer.json and lock file, theme build command, plugin licence register, hosting diagram, DNS zone notes, redirect CSV, analytics and Search Console access, admin credentials in your password manager, incident runbook and a 2026 update log. Verify one item yourself: clone the repo, build it locally, import the dump and load the homepage. If that takes more than 90 minutes, the documentation is not finished.
Support terms need units. “Priority support” is meaningless. Write: P1 site down, 15-minute acknowledgement, 4-hour mitigation target; P2 checkout or form broken, 1-hour acknowledgement, 1 business day; P3 content or styling, 1 business day, scheduled in the next release. Add 6–20 change hours per month, monthly core/plugin updates on a named Tuesday, uptime monitoring from three regions and a quarterly report with Core Web Vitals, 404s, failed logins and backup restore results.
FAQ
Is wordpress open source really free for a commercial site?
Yes. Core is GPL-licensed and free to use, modify and host commercially. You pay for hosting, premium extensions, design, engineering, migration, security work and ongoing maintenance in 2026.
Who should own the code after launch?
You should. Keep the Git organisation, domain, CDN and cloud accounts in your company name. Require custom code assignment, licence records, database exports and deploy documentation before the final 10% payment.
How many plugins is too many in 2026?
There is no magic number, but 12–25 well-maintained plugins is a common healthy range. Judge overlap, release recency, capability checks, query load and an exit plan for each one, not the count alone.
Next Step
Shortlist two vendors, send the same brief, and score the replies against the 100-point sheet above. If you want a fixed-scope build with repo ownership, measurable performance budgets and a documented security handover, talk to our team. Bring your URL list and integration notes. We will return a work breakdown, a 2026 timeline and the artefacts you will own at launch.
