WordPress still powers 43 % of the world's websites in 2025. That is impressive, and it is also the problem. Such ubiquity makes it the number one target for automated attacks, the most patched platform on the web and, above all, a general-purpose tool built for everyone and therefore optimised for no one. For an SME in Geneva or French-speaking Switzerland looking for a fast, secure and genuinely distinctive website, WordPress has become a digital millstone dressed up as an easy option.
This article takes the myths apart, cites the figures and explains why Next.js (particularly in a CMS-free, custom-built approach) is the rational choice for a serious business in 2025.
The WordPress problem: figures that speak for themselves
A huge attack surface
WordPress is by far the most hacked CMS in the world. According to Sucuri's annual website security report (2024), WordPress accounts for 96.2 % of the infected CMS installations they handle. This is not because WordPress is inherently bad: its sheer popularity makes it a profitable target for attackers who automate their scans.
The real attack surface has three layers: WordPress core itself, themes and plugins. According to WPScan, their database lists more than 59,000 known vulnerabilities across the WordPress ecosystem (plugins + themes + core). The average WordPress site runs between 15 and 30 plugins. Each one is a potential way in.
In 2024, the most common attack vectors on WordPress according to Sucuri were:
This table highlights a key fact: your security largely depends on third-party vendors whose update schedule, code quality and even survival are out of your control (an abandoned plugin stays vulnerable forever).
Updates: a full-time job
A WordPress site in production needs regular updates: core, theme, plugins. Every update carries a risk of regression: an updated plugin can break the design, disable a feature or trigger PHP conflicts. That is why most WordPress site owners postpone updates, which only increases their exposure.
According to Kinsta, the average annual cost of professionally managed WordPress maintenance (updates, security monitoring, backups and fixes) is between CHF 1,200 and CHF 3,600 per year for a standard SME site. And that is before paying for any development at all.
Performance: WordPress vs Next.js in real figures
Core Web Vitals: the gap is stark
Google measures site performance through Core Web Vitals: LCP (Largest Contentful Paint), INP (Interaction to Next Paint) and CLS (Cumulative Layout Shift). These metrics have directly influenced SEO rankings since the 2021 Page Experience update.
Here is a realistic comparison based on Lighthouse audits and field data (CrUX dataset, Chrome User Experience Report 2024):
These figures are not theoretical. They reflect the results of real audits on typical WordPress sites (Divi, Elementor or Avada themes) compared with Next.js sites built with clean code.
Why WordPress is structurally slow
WordPress builds its pages in PHP on every request, queries a MySQL database, assembles templates and sends the lot to the browser. Even with a caching plugin such as WP Rocket or W3 Total Cache, this architecture has fundamental limits:
Render-blocking resources: most WordPress themes load 8 to 15 separate CSS and JavaScript files in the <head>. The browser blocks rendering until they have fully loaded.
Unoptimised images: without careful configuration, WordPress serves uncompressed JPEG/PNG images that are not resized for the viewport. A mobile user downloads a 2 MB desktop image just to display it 400 px wide.
A database that does not scale: every visit triggers SQL queries. Under load (a traffic spike, an ad campaign), the database saturates and response times explode.
Plugin JavaScript loaded everywhere: a contact form plugin loads its JS on every page, even those without a form.
Next.js solves all of these problems through its architecture, not through configuration:
- Static Site Generation (SSG) and Incremental Static Regeneration (ISR): pages are pre-generated at build time. The server responds with static HTML in a few milliseconds, from a CDN.
- Built-in image optimisation: the Next.js
<Image>component automatically generates WebP/AVIF formats, resizes for the viewport and lazy loads. - Automatic code splitting: each page loads only the JavaScript it needs.
- React Server Components (Next.js 15+): components that do not need interactivity are rendered on the server, without shipping any JavaScript to the client.
The concrete SEO impact
A site that goes from a Lighthouse score of 42 to 94 gains more than abstract performance. It gains visibility on Google. According to a Portent study (2023), a site that loads in 1 second converts 3× better than one that loads in 5 seconds. And according to Google Search Central, sites that reach the "Good" thresholds on all Core Web Vitals get a measurable ranking boost over equivalent sites below those thresholds.
For a Swiss SME whose website generates leads (quote requests, enquiries, bookings), moving from a Lighthouse score of 42 to 94 can mean +20 to +40 % more organic conversions.
The hidden costs of WordPress: the full calculation
What you really pay
The classic argument for WordPress is its low entry cost. WordPress is free, themes cost between 50 and 100 €, and any agency can handle it. That is true, at the start. Here is what the real calculation looks like over 3 years for an SME website:
The "cheap" WordPress site actually costs 2 to 3× more over time. And these figures exclude the indirect costs: hours your team loses dealing with problems, customers lost to slow loading times, or a brand image damaged by a hacked website.
Technical debt: the invisible problem
WordPress sites accumulate technical debt relentlessly. Every plugin added, every theme customisation, every custom shortcode or Gutenberg block creates dependencies. After 3 to 5 years, most SME WordPress sites end up in a situation where:
- Upgrading to PHP 8.x breaks unmaintained plugins
- Changing theme means starting from scratch
- The original developer has left and their code is impossible to follow
- Customisations are buried in 1,500-line
functions.phpfiles
With Next.js and TypeScript, the code is typed, version-controlled (Git), documented and modular. Any competent React developer can take over the project. Components are isolated, testable and replaceable without side effects.
Next.js: what your SME actually gains
An architecture built to last
Next.js is developed by Vercel and backed by a community of several hundred thousand developers. In 2025, Next.js 16 brings React 19, stable Server Components, Turbopack in production and unmatched build performance. It is an actively maintained technology with a public roadmap and massive adoption: Vercel reports more than 800,000 projects deployed on its infrastructure.
Unlike WordPress, which needs a PHP server and a database, a Next.js application can be deployed in several ways:
- Static (HTML/CSS/JS export): deployable on any host, zero server cost, maximum performance
- Node.js (SSR/ISR): for sites with dynamic content or APIs
- Edge Functions: for minimal latency worldwide
For a Geneva SME, this means complete freedom in hosting, including with Swiss hosts such as Infomaniak, with no lock-in to any one provider.
Technical SEO: Next.js wins on every front
Every "plugin required" in the WordPress column is one more dependency, one more potential point of failure and one more drag on performance. With Next.js, all of this is native or trivial to implement.
Complete design freedom
WordPress imposes its structure. A theme, even a "customisable" one, imposes conventions on headers, post loops and menus. A truly unique design requires either a custom theme (expensive) or CSS hacks that pile up and make the site fragile.
With Next.js and Tailwind CSS v4, every component is written from scratch, exactly as it should be. There is no generic CSS to override, no theme JavaScript to disable, no limits imposed by a page builder framework. The design you approve is exactly what gets delivered: pixel perfect, animated with GSAP where needed, fully responsive without compromise.
Common objections: the real answers
"My team doesn't know how to use Next.js to update content"
This is the most frequent objection, and it is a fair one. The answer depends on how often you update:
For brochure or corporate sites (5 to 30 pages, content that rarely changes): a Markdown or MDX file system is enough. Your team edits text files, pushes to Git, and the site rebuilds automatically. Or you hand occasional changes to your web designer under a minimal maintenance package.
For sites with frequent content (blog, news, products): a headless admin interface such as Sanity, Contentful or Directus connects your content to Next.js through an API. Your team gets a modern back office, and your site stays fast and decoupled.
Either way, you do not have to put up with WordPress's limitations to get a content management interface.
"WordPress ranks well, everyone uses it"
Rankings depend on content, backlinks, technical structure and performance. WordPress has no intrinsic SEO advantage. On the contrary, its performance shortcomings are a handicap. Google neither knows nor cares what technology your site is built with. It measures loading speed, semantic structure, content and inbound links. On every one of these, a well-built Next.js site outperforms a standard WordPress site.
"My next agency won't be able to take over a Next.js project"
This is less and less true. React is the most widely used frontend framework in the world. TypeScript has become the industry standard. Any competent web developer in 2025 can read React/Next.js code. Taking over a WordPress site with a customised child theme, conflicting plugins and an overloaded functions.php, on the other hand, is often a nightmare, even for experienced WordPress developers.
Real-world cases: what it changes for a Geneva SME
Consultancy or fiduciary firm
A consultancy needs instant credibility. Its website has to load fast, convey a strong identity and turn visitors into contacts. WordPress with a professional theme can do the job visually. But 4-second loading on mobile, Sucuri security alerts and the inability to create smooth animations without slowing the site down further are unacceptable compromises for a firm that charges premium fees.
A custom-built Next.js site for this kind of client: loads in 1.2 seconds, Lighthouse score of 95+, smooth GSAP animations with no performance hit, a secure contact form via a serverless API. All without a single WordPress plugin to maintain.
Tradesperson or local service business
For a Geneva tradesperson (plumber, electrician, carpenter), the goal is simple: rank first on Google for local keywords and get the phone ringing. A basic WordPress site can technically achieve that, but local competitors are using ever faster websites. A site that loads in 2 seconds versus one that loads in 0.8 seconds: the difference is measurable, and Google takes it into account.
Security also matters, even for a tradesperson. A hacked site displays links to online pharmacies or malicious content, instantly damaging the brand and potentially getting the site removed from Google's index.
What INFUSE offers
INFUSE is an independent web studio based in Geneva. The approach is simple: no templates, no WordPress CMS, no subcontracting. Every site is written from scratch in Next.js 16, React 19, TypeScript and Tailwind CSS v4: the stack that powers tens of millions of websites in 2025, maintained by Vercel and the React community.
The result for SMEs: sites that load in under 1.5 seconds, Lighthouse scores consistently above 90, security by architecture (no database, no PHP, no plugins), and cleanly delivered code, version-controlled in Git and easy for any developer to take over.
If your WordPress site costs you more in maintenance than it brings in leads, or if you simply want a website that matches your positioning, now is the right time to talk about a custom-built redesign.