Choose WordPress if several people will write for the site, or you want to change pages yourself without calling a developer. Choose Next.js if the site changes now and then, or needs something built to fit, like a quote calculator or a customer login. Both need security updates, so plan for them whichever you pick.
What each one is
WordPress is free, open-source software for running a website. You install it on a web host, then write and edit your pages from its dashboard. WordPress.org says people with limited tech experience can use it out of the box.
Next.js is a framework for building websites and web apps in React, made by a company called Vercel. A developer writes the site in code. The Next.js documentation assumes some familiarity with web development, and suggests being comfortable with HTML, CSS, JavaScript and React before you start.
Side by side
| Question | WordPress | Next.js |
|---|---|---|
| What is it? | Free, open-source publishing software, licensed under the GPL | A React framework for building web apps and sites, from Vercel |
| What does it run on? | A host with PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer, as WordPress.org recommends | A Node.js server for every feature, or any static web host for a static export |
| Who edits it? | Anyone you give a login, with roles that control who can publish | A developer, in code, unless a content management system is added |
| What can you add? | Over 75,000 free plugins from the WordPress.org directory | Features built into the site in code |
| How is it patched? | Security releases install themselves on most sites, and plugins and themes can be set to update too | Each major version gets security fixes until two years after its release, and a developer applies them |
When WordPress is the better choice
- Several people write for the site
- WordPress has roles built in. A contributor can write posts but can’t publish them, so their work waits for someone with the editor role to put it live.
- You want to make changes yourself
- You can try the editor before you commit. WordPress Playground runs WordPress in your browser, with no host to set up.
- A plugin already does the job
- The WordPress.org directory lists over 75,000 free plugins. If a well-kept one does what you need, you may not need to pay anyone to build it.
- Your WordPress site already works
- If it’s on a supported version and doing its job, we’d usually tell you to keep it.
Our article on whether to redesign or start again shows how to check which version of PHP your WordPress site runs on, from inside its own dashboard.
When Next.js is the better choice
Next.js suits a site that changes now and then, where you’re happy for a developer to make the changes. It also suits a site that needs something built for it, like a booking flow or a customer portal, because it’s made for web applications as much as pages.
It doesn’t need a server of its own, either. Next.js can export a site as plain files, one HTML page per route, and any web host that serves files can serve them. You give up the features that need a server, but there’s no PHP or database to keep running.
Both need updates
WordPress can do a lot of this for itself. Automatic background updates arrived in version 3.7, and WordPress’s documentation says they’re on by default for most sites. Since version 5.5 you can switch on automatic updates for each plugin and theme as well, and WordPress runs them twice a day. Its guide to those updates suggests making sure you can roll the site back before you turn them on.
The updates matter. WordPress 7.1.3, released on 6 October 2026, carried seven security fixes, and WordPress.org recommended updating immediately. Its release archive is blunt about anything older.
Primary source, verbatim
Only the most recent in the 7.1 series is safe to use and actively maintained.
Plugins are the part to watch. Each plugin’s page in the directory shows when it was last updated and the WordPress version it was tested up to. WordPress.org closes plugins over security issues and guideline breaches, and once a plugin is closed, nobody can download or install it from there.
Next.js needs updating too. Its support policy gives each major version security fixes until two years after its first release, and version 14, from October 2023, is already on the unsupported list. In December 2025 the Next.js team published a critical security advisory for apps using its App Router. It told all users to upgrade immediately, and said upgrading was the only fix.
On a Next.js site, updates are a developer’s job. Someone has to install the new version and put the site live again. Our own care plans include security patches, starting at $99 a month.
Where each one lives
WordPress needs a host that runs PHP and a database. WordPress.org recommends PHP 8.3 or newer, with MySQL 8.0 or MariaDB 10.11 or newer. It still works on some older versions, but WordPress.org says those have reached end of life and may expose your site to security vulnerabilities.
A Next.js site that uses every feature needs a Node.js server. A static export only needs a host that serves files. If you host with Vercel, the company behind Next.js, check the plan. Vercel’s free Hobby plan is for non-commercial personal use only, and a business site needs its Pro or Enterprise plan.
We haven’t put a hosting price on either. Hosts set their own prices, and they change.
Editing a Next.js site
Out of the box, changing a Next.js page means changing code. If you’ll be publishing often, a content management system (CMS) gives you somewhere to write without touching it. We add one for $500, and our $2,500 custom website includes a blog or CMS foundation.
What we couldn’t establish
We looked for a figure on how often WordPress sites get hacked, and how often a plugin is the way in. The numbers we found came from companies that sell WordPress security products, or from blogs repeating them. We didn’t find one from WordPress.org, so there isn’t one here.
We haven’t compared speed or search rankings either, because we haven’t measured the two side by side.
Sources
Every figure in this article was read at the document itself.
- Plugins
- Requirements
- About
- Releases
- WordPress 7.1.3 Maintenance and Security Release
- Upgrading WordPress
- Plugin and themes auto-updates
- Roles and Capabilities
- Plugin Developer FAQ
- WordPress Playground
- Next.js by Vercel
- What is Next.js?
- Deploying
- Static Exports
- Support Policy
- Security Advisory: CVE-2025-66478
- Hobby plan
- Fair use guidelines
- cms-wordpress example
Common questions
- Is WordPress dying?
- No. WordPress 7.1 came out on 19 August 2026, and its latest update, 7.1.3, on 6 October.
- Is Next.js better for SEO than WordPress?
- Not by itself, as far as we can tell. Either one can be fast or slow depending on how it’s built. Google’s PageSpeed Insights will show you how your own pages load.
- Can I edit a Next.js site myself?
- Not out of the box. Changes go through a developer unless a content management system is added. We add one for $500, and our $2,500 custom website includes a blog or CMS foundation.
- Can WordPress and Next.js work together?
- Yes. WordPress can hold the content while Next.js builds the pages people see, and the Next.js project publishes an example set up that way. You still have a WordPress install behind it to host and keep updated.
- Can you move our WordPress site to Next.js?
- Yes. The content comes across, and every old address gets a permanent redirect to its new page. Our article on whether to redesign or start again goes through how that move is done. If your WordPress site is up to date and doing its job, there may be no reason to move.