WordPress is software used to build and manage websites. It’s one of the most popular website platforms in the world — somewhere around 40-45% of all websites run on it.
Think of it like the operating system for your website. It lets people create pages, post blogs, and manage content without writing code.
But here’s the part that matters: WordPress isn’t automatically good or bad. A well-built WordPress site can perform extremely well. A poorly maintained one can become slow and insecure.
What WordPress actually is
WordPress started in 2003 as a blogging tool. It became a full content management system over the next decade. The core is open-source, free, and maintained by a global community. Thousands of companies build themes, plugins, and hosting on top of it.
A “WordPress site” means:
- The core software is installed on a server.
- A theme controls how it looks.
- Plugins add functionality (contact forms, SEO tools, sliders, inventory feeds, etc.).
- The database holds all the content — pages, posts, user accounts, settings.
The dealer (or the team managing the site) logs into a web-based admin panel at yourdealership.com/wp-admin, makes changes, clicks publish, and the changes go live.
Why “it’s a WordPress site” isn’t enough information
The same words can mean completely different things:
- A dealership running WordPress on WP Engine, with 12 carefully chosen plugins, an active maintenance plan, and a security team. The site is fast and safe.
- A dealership running WordPress on a $9.95 shared host, with 47 plugins (12 of them abandoned by their developers), a WordPress core that hasn’t been updated in three years, and an admin password that’s “Dealer123.” The site is a security incident waiting to happen.
Same platform. Vastly different outcomes. The platform isn’t the variable. The maintenance is.
What can go wrong with a WordPress site
The pattern at most dealerships is the same:
- The site launched in 2017. It was fast and secure.
- Five years later, the original developer is gone. The theme is from a vendor that no longer exists. There are 38 plugins installed, and the marketing team has been adding more to “fix things” over the years.
- WordPress core is two major versions behind. PHP is end-of-life. The host has been auto-renewing the cheapest plan.
- A plugin with a known vulnerability gets exploited. The site starts serving spam, or redirects to a phishing page, or just goes down.
The recovery usually involves a rebuild, not a repair. The cost is meaningful.
What you should know without becoming a developer
You don’t need to know what PHP is. You do need to know four things:
- Is our site WordPress, and if so, what version? (You can check at
yourdealership.com/wp-adminor by viewing page source for the generator tag.) - Who maintains it? (An in-house person, a vendor, an agency, the original freelancer. Find out.)
- When was it last updated? (Core, theme, plugins. If “we don’t know” is the answer, the answer is probably “not recently.”)
- How many plugins are installed, and what do they do? (Fewer is better. A plugin that hasn’t been updated in over a year is a yellow flag. A plugin that hasn’t been updated in two years is a red flag.)
The fix isn’t switching platforms. It’s maintaining the one you have.
If you’re on WordPress and it’s been well-maintained, the answer isn’t to switch to something else. The answer is to keep it that way.
- Updates. Core, theme, and plugins updated on a regular cadence. Most managed WordPress hosts do this for you, on a staging environment first, then production.
- Backups. Daily, off-host, retained for at least 30 days, tested for restore.
- Security. A web application firewall (Cloudflare, Sucuri, or the host’s built-in), strong admin passwords, two-factor authentication on the admin panel, and limiting who has admin access.
- Plugin hygiene. Every plugin is a dependency. Every dependency is a maintenance obligation. Fewer plugins, all from active developers, all updated regularly.
- Hosting. A managed WordPress host (WP Engine, Kinsta, Pressable, etc.) is meaningfully different from a generic shared host. The cost is higher. The result is fewer incidents.
The bottom line
WordPress isn’t the problem. An unmaintained WordPress site is the problem. Most dealerships that have a “bad WordPress experience” actually have a “we forgot to maintain it” experience.
You don’t need to be dangerous with the platform. You need to be dangerous about asking who maintains it, how often, and what happens when something goes wrong.
Next in the series: “What is a CMS, and how is it different from WordPress?”
Part of the Just Enough to Be Dangerous infrastructure series from VCTRS. For the technical version to hand your IT team or vendor, read WordPress for Car Dealerships: A Technical Reference.