A true data-driven, real-world breakdown of Craft CMS vs WordPress from the implementation experts who build it.
Reviewed October 2026 · 184 criteria · 10 categories · View methodology →
Choose Craft CMS for a bespoke, structured site or a small portfolio of related sites, built by developers who want schema as code, GraphQL in every edition and a perpetual license. Choose WordPress for speed to launch, marketer-built landing pages, the strongest SEO plugins and the deepest hiring pool. Neither gives you personalization, approval workflows or compliance certifications from the vendor. The choice depends on whether you value a disciplined content model or an off-the-shelf ecosystem, and on who will own patching.
A high-level view of how the two platforms compare across key areas.
| Area | Craft CMS | WordPress |
|---|---|---|
| Content modeling | Nestable Matrix entries, conditional field layouts and per-field translation rules, with the whole schema committed to git as YAML. | Custom post types plus ACF fields in an unenforced key-value store, with localization added through WPML or Polylang. |
| Ecosystem and talent | About 1,300 plugins, a verified partner network and a helpful Discord community, but a niche hiring pool. | Roughly 60,000 free plugins, the most requested CMS skill in job postings and agencies at every price point. |
| Pricing model | Perpetual per-project license: Solo free, Team $279, Pro $399, optional $99 yearly renewal; Craft Cloud costs $130 to $260 monthly. | Free under GPLv2; you pay for hosting from about $5 a month and per-site premium plugin subscriptions. |
| Marketer tooling | No theme marketplace or page builder; SEO, forms and redirects come from plugins such as SEOmatic and Formie. | Yoast or Rank Math plus Elementor and other drag-and-drop builders let marketers ship pages without developers. |
| Operations and security | Craft Cloud removes most operations, while self-hosted installs never auto-update and saw several critical vulnerabilities in 2026. | Core security fixes auto-apply within hours, but plugins carried 91 percent of 11,334 ecosystem vulnerabilities logged in 2025. |
| Compliance paperwork | No SOC 2 or ISO 27001, but a published accessibility conformance report on the VPAT 2.4 template. | No certifications at the software level and no current accessibility conformance report; certifications come from your host. |
Craft CMS sells a perpetual license per installation. Solo is free forever for one user account, Team costs $279 for up to five users and Pro costs $399 with unlimited users. Each includes a year of updates, renewal is then an optional $99 a year, and a lapsed renewal is never back-billed. Craft Cloud hosting runs $130 a month for Team and $260 for Pro, with small annual discounts. Enterprise, which carries SAML single sign-on, is quote only.
WordPress has no license at all. The real costs are hosting (about $5 to $35 a month), per-site premium plugins such as ACF Pro at $49 a year, Yoast Premium at $99 and WPML at $99, and a maintenance retainer that commonly runs $50 to $500 a month.
Over several years the gap narrows. Craft builds are bespoke because there are no themes, but practitioners report only half a day to a day of senior developer time a month for upkeep. WordPress starts cheaper and builds faster, while plugin renewals, conflict testing and security monitoring recur every year. Adding a site costs no CMS fee on either.
Both are PHP applications on MySQL, and Craft also supports PostgreSQL. Craft can be self-hosted or run on Craft Cloud, which binds each git branch to an environment with its own database and preview domain. WordPress is self-hosted only. You choose shared hosting, a VPS, containers or a managed WordPress host, and no CDN, monitoring, SLA or support comes with the software.
Craft suits a developer-led build. The schema lives in Project Config YAML and moves between environments with one command, and official starters cover Next.js, Nuxt and Astro. Every site is bespoke; practitioners quote two to six weeks for a custom marketing site. WordPress launches fastest from themes and page builders, but configuration is spread across the database and plugin screens, and schema changes on live content need custom tooling.
Day to day, Craft never auto-updates, so someone must watch its critical-releases feed. WordPress core fixes apply automatically, but plugins install with no lockfile, so staging tests and a firewall are effectively mandatory. Craft 5 is supported through 2031, so the Craft 6 move to Laravel is optional.
WordPress gives marketers more on their own. The block editor, the Site Editor and builders such as Elementor or Bricks let them assemble landing pages without a developer. Yoast or Rank Math cover meta tags, sitemaps, structured data and redirects, and form plugins such as Gravity Forms feed CRMs. Craft editors work inside developer-defined Matrix and Content Block components, with Live Preview and shareable draft links, and rely on SEOmatic and Formie for SEO and forms.
Neither has native personalization, segmentation or analytics. WordPress has more plugin options: If-So and Logic Hop for targeting, Nelio for testing and Site Kit to show GA4 data in the admin. Craft relies on an external engine such as Croct and small community plugins.
Craft is stronger for multi-site and multilingual work. One Pro license runs any number of sites with per-field translation rules, and its media library adds focal points and on-the-fly image transforms. WordPress Multisite shares one codebase across brand sites, but translation works at document level through WPML or Polylang, and media folders and focal points need plugins.
Neither ships much AI for editors in its core. WordPress 7.0 added Connectors, a central vault for OpenAI, Anthropic and Google keys that any AI plugin can reuse. Plugins such as Jetpack AI, AI Engine, Yoast and Rank Math generate copy, alt text and metadata. Craft has no native AI. Plugins such as CoPilot, Lens and Multi Translator cover writing, alt text and translation, with far smaller install bases.
For agents, both offer a Model Context Protocol (MCP) server, the standard way AI assistants connect to outside tools. WordPress has an official MCP Adapter from its core AI team, built on the Abilities API and hardened in 7.1. Craft's third-party MCP server has passed 2,500 installs and exposes 55 tools. It lands every agent write as a reviewable draft under Craft's own permissions, which is a stronger governance default.
Both keep you on your own keys, including self-hosted models through Ollama. Neither has AI personalization in core, though WordPress has more vector search and recommendation plugins to choose from.
These are independent products from different camps: Craft CMS comes from Pixel & Tonic, a small commercial vendor, and WordPress from an open-source project. Both run on PHP, so hosting skills transfer, but little else does.
Moving from WordPress to Craft means rebuilding the content model as sections, entry types and Matrix fields, rewriting the theme in Twig or a JavaScript front end, and replacing each plugin with a Craft equivalent. Content can be loaded with Feed Me, Craft's first-party importer. Moving from Craft to WordPress starts with Craft's native CSV, JSON or XML export, then maps nested Matrix content onto blocks, custom post types and ACF fields. That flattens structure and loses per-field translation rules.
Sites built heavily in Elementor or Divi need extra cleanup, since their shortcodes do not port. Do not move to Craft if marketers depend on page builders or the plugin catalog. Do not move to WordPress if your value sits in a deep content model or a portfolio of related sites.
Use the detail to test the tradeoffs that matter to your team.
Content Modeling, Authoring, Collaboration & Governance, Content Delivery
“Assets live in volumes and folders with per-volume field layouts, translatable alt text, focal points, a built-in image editor and named or ad-hoc transforms (crop, fit, letterbox) with WebP and AVIF output, exposed…”
“Core generates responsive srcset sizes on upload, supports WebP and AVIF (with 7.1 extending modern format and HDR handling), and stores alt text and captions.”
Personalization & Experimentation, Search & Discovery, Commerce, Analytics & Insights, Multi-site & Global Operations, Digital Asset Management, Page Building & Site Delivery, Marketing & Engagement, Platform Services
API & Integration, Security & Compliance, Infrastructure & Reliability, Developer Experience
Release Cadence, Ecosystem & Community, Market Signals
Licensing, Implementation Cost Signals, Operational Cost Signals
Learning Curve, Implementation Complexity, Team & Talent
Upgrade & Patching, Operational Overhead, Support & Resolution
Marketing Sites, Commerce, Intranet & Internal, Multi-Brand / Multi-Tenant
Data Privacy & Regulatory, Security Certifications, Data Governance, Platform Accessibility
AI Content Creation, AI Workflow Automation, AI Search & Personalization, AI Platform & Extensibility
Every score on this page is backed by written reasoning and cited evidence. Open any criterion to read it. Scores follow public evidence only; vendor membership never affects them.
Partly. Craft Solo is free forever with unlimited entries, sites and GraphQL, but only one user account. Team ($279) and Pro ($399) are one-time per-project licenses with an optional $99 yearly renewal. WordPress core is free under GPLv2 with no user limit, so you pay for hosting and premium plugins instead.
Not on the vendor's paper. Pixel & Tonic holds no SOC 2, ISO 27001, HIPAA or PCI DSS attestation, and its Acceptable Use Policy bars protected health information and cardholder data. WordPress software carries no certifications either, and mainstream hosts such as WP Engine and Kinsta will not sign a Business Associate Agreement. Regulated buyers usually look at WordPress VIP or Acquia.
Neither is safe without an owner. Craft patches fast through a funded disclosure program, but self-hosted installs saw several critical vulnerabilities in 2026 and never auto-update. WordPress core applies security fixes within hours, yet plugins accounted for 91 percent of 11,334 ecosystem vulnerabilities in 2025. Craft Cloud, or a managed WordPress host with a firewall, reduces the burden on either.
No. Craft 5 is a long-term support release with active support through 2030 and security fixes through 2031. Craft 6 moves to Laravel, and a Yii 2 adapter is meant to keep Craft 5 plugins running on it. WordPress has no forced migrations either: it ships three releases a year with strong backward compatibility.
WordPress, by a wide margin. It is the most requested CMS skill in web development job postings, with freelancers and agencies at every price point. Craft developer listings number in the dozens on Glassdoor and Indeed, and there is no certification program, though the Craft Partner Network verifies agencies by reviewing their code and interviewing their clients.
Craft CMS and WordPress are level on overall suite capability (55 vs 56). Craft CMS wins 4 of the 10 scoring categories and WordPress wins 5, with 1 too close to call. Choose Craft CMS for a bespoke, structured site or a small portfolio of related sites, built by developers who want schema as code, GraphQL in every edition and a perpetual license. Choose WordPress for speed to launch, marketer-built landing pages, the strongest SEO plugins and the deepest hiring pool. Neither gives you personalization, approval workflows or compliance certifications from the vendor. The choice depends on whether you value a disciplined content model or an off-the-shelf ecosystem, and on who will own patching.
WordPress scores higher on total cost of ownership (76 vs 70), which weighs licensing, implementation cost and running cost; a higher score means lower cost for what you get. Confirm current pricing with each vendor.
Craft CMS scores higher on build simplicity (68 vs 63), which covers the learning curve, implementation complexity and how easy it is to hire for. Craft CMS scores higher on operational ease (59 vs 54), which covers upgrades, day to day overhead and vendor support.
WordPress scores higher on fit for marketing sites (54 vs 42), which looks at how well each platform serves campaign pages, landing pages and editor self-service.
WordPress scores higher on AI enablement (53 vs 42), which covers AI content creation, workflow automation, AI search and personalization, and how open the platform is to your own AI tools.
