# WordPress — DXP Scorecard

> The open-source CMS powering over 40% of the web — vast plugin ecosystem, self-managed everything.

**Category:** Traditional CMS · **Tier:** 2 · **Suite Capability:** 56/100 (ranked #31 of 45)

Source: https://www.dxpscorecard.com/platform/wordpress
Last reviewed: 2026-10-10

## Summary

WordPress is the free, GPL-licensed CMS behind more than 40 percent of the web, and its defining trade is total freedom in exchange for total responsibility. Buyers get the largest plugin ecosystem, talent pool and learning library of any platform, a predictable three-releases-a-year cadence with strong backward compatibility, and new core foundations for AI (Connectors, the Abilities API and an official MCP adapter). What they do not get is anything managed: no hosting, CDN, SLA, vendor support, compliance attestations or security scanning come with the software, and the plugin layer that makes WordPress so capable is also its dominant attack surface. It is an excellent choice for marketing, publishing and WooCommerce sites run by teams who will own operations, and a poor choice for buyers who need personalization, intranet tooling or certifications from the platform itself.

## Composite Scores

- Suite Capability: 56/100
- Cost Efficiency: 76/100
- Build Simplicity: 63/100
- Operational Ease: 54/100
- Platform Velocity: 79/100
- Compliance & Trust: 43/100
- AI Enablement: 53/100

## Use-Case Fit

- Marketing: 54/100
- Commerce: 50/100
- Intranet: 34/100
- Multi-Brand: 46/100

## Category Scores

- 1. Core Content Management: 58/100
- 2. Additional Platform Capabilities (DXP Features): 49/100
- 3. Technical Architecture: 64/100
- 4. Platform Velocity & Health: 79/100
- 5. Total Cost of Ownership: 76/100
- 6. Build Simplicity: 63/100
- 7. Operational Ease: 54/100
- 8. Use-Case Fit: 46/100
- 9. Regulatory Readiness & Trust: 43/100
- 10. AI Enablement: 53/100

## Strengths

- **The largest extension ecosystem of any CMS, with a battle-tested hook model underneath** (84.7/100) — The WordPress.org directory lists roughly 60,000 free plugins with one-click install, and the commercial market pushes the total past 90,000, so connectors for analytics, commerce, DAM, translation, AI and CDN exist for almost every vendor. The action and filter hook system exposes more than a thousand extension points across content, requests, admin UI and the API, and WordPress 7.1 (August 2026) added a filterable Abilities API lifecycle, an admin Design System and a public Icons API. For a buyer this means almost any requirement has an off-the-shelf answer, provided the team vets quality and security itself, since the directory is not curated.
- **No license, no contract, no lock-in, and it runs anywhere** (87/100) — Core is free under GPLv2 with no usage caps, no per-seat fees and no sales gate, and every real cost (hosting from about $5 to $35 a month, premium plugins such as ACF Pro at $49 a year) is published. Content lives in a standard MySQL database with a documented schema and a built-in WXR export, and the software runs on shared hosting, a VPS, containers, on-premise or any managed WordPress host. Buyers with data residency or sovereignty requirements can place everything exactly where they need it, and can leave at any time without an exit negotiation.
- **Unmatched talent, community and learning material** (89.4/100) — WordPress is the most requested CMS skill in web development job postings, with freelancers and agencies available at every price point and major systems integrators maintaining practices. WordCamp US 2026 drew more than 1,100 in-person attendees, the WordPress.org forums and Make WordPress Slack are active with core team participation, and every release triggers a wave of independent guides and courses. Hiring risk and knowledge gaps are essentially nil, which matters for long-lived sites that will outlast their original team.
- **Predictable releases that almost never break existing sites** (78.3/100) — WordPress now ships three major releases a year on published dates: 7.0 'Armstrong' arrived in May 2026, 7.1 'Mary Lou' landed on its August 19 target, and 7.2 is scheduled for December. Backward compatibility is a founding value, so plugin and theme compatibility is preserved across majors, the PHP baseline moves only after years of notice, and the immature real-time collaboration feature was held back rather than shipped broken. Each release comes with a Field Guide of developer notes, and planning happens in public on Make WordPress blogs and Trac.
- **Best-in-class SEO and landing page tooling for marketing and editorial commerce sites** (71.6/100) — Yoast SEO or Rank Math on WordPress is the most mature SEO stack in the CMS market, covering meta, sitemaps, Schema.org structured data, redirects and real-time content scoring on top of clean permalinks. Marketers can build landing pages without a developer using the block editor and Site Editor, or any drag-and-drop builder such as Elementor or Bricks, and 7.1's Notes with mentions shortens editorial review. WooCommerce, a free plugin from the same ecosystem, adds catalog, cart and checkout, and its blocks drop shoppable product grids straight into articles and buying guides.
- **A real AI foundation in core: bring your own keys, abilities and an official MCP adapter** (67.8/100) — WordPress 7.0 added Settings, Connectors, a central credential vault with featured connectors for OpenAI, Anthropic and Google plus custom services, with keys hashed in the database and reusable by any AI-aware plugin. The Abilities API gives agents a machine-readable registry of what a site can do, and the official MCP Adapter from the core AI team lets Claude, Cursor or VS Code draft, publish and bulk-edit content through it. Plugins such as AI Engine extend this to self-hosted models (Ollama, vLLM, LM Studio) for teams that cannot send content to a cloud provider, while Jetpack AI and AI Engine cover in-editor writing assistance today.

## Weaknesses

- **No compliance attestations exist at the software level** (28/100) — WordPress.org holds no SOC 2 report, no ISO 27001 certificate, no FedRAMP authorization and signs no Business Associate Agreement for healthcare data. WordPress VIP's FedRAMP Moderate belongs to that separate managed product and is not inherited, and mainstream hosts such as WP Engine and Kinsta will not sign a BAA. Every certification a procurement team asks for must come from the chosen host and the operator's own controls, which rules out buyers who need the platform vendor to carry that paper.
- **The plugin layer is the web's most attacked surface, and the operator owns all of it** (49/100) — Core itself is well patched (Patchstack counted only six low-priority core vulnerabilities in 2025, and security minors auto-apply within hours), but the ecosystem logged 11,334 new vulnerabilities that year, 91 percent of them in plugins, with roughly half of high-impact bugs exploited within 24 hours. June 2026 saw six actively exploited critical flaws at once plus supply-chain compromises of popular plugins. Plugins are installed ad hoc with no lockfile, so a web application firewall, staging tests before updates and either a maintenance retainer (commonly $50 to $500 a month) or a dedicated owner are effectively mandatory.
- **Nothing is managed: no CDN, monitoring, SLA or vendor support ships with the software** (46.8/100) — Self-hosted WordPress has no bundled edge cache, so API and page performance depend entirely on the caching plugin, object cache and CDN the team configures. There is no uptime guarantee, no central status page and no first-party support queue; help is bought from a host, an agency or individual plugin vendors with quality tied to each contract. Core's Site Health screen is the only built-in observability, so real production monitoring and alerting are assembled from external services.
- **No personalization, segmentation or experience analytics in the product** (33.3/100) — Core has no visitor profiles, segment builder, content variants or decision engine. Rule-based targeting comes from plugins such as If-So and Logic Hop, A/B testing from Nelio, and even those fight with full-page caching on commodity hosting. Content performance reporting is Google Analytics surfaced in wp-admin through Site Kit or MonsterInsights rather than a native view of content health or author productivity. Buyers expecting a digital experience platform's marketing layer will be assembling it from a dozen independent vendors.
- **Weak fit for intranets and employee portals** (33.9/100) — WordPress was never designed as an employee portal. There is no people directory or org chart, no read receipts or acknowledgment tracking for internal communications, no policy expiry or approval workflow, and no onboarding journeys or adoption analytics. BuddyBoss, LMS plugins and knowledge-base plugins can approximate pieces of this, but a production intranet still needs substantial theming and custom work, with no federation across SharePoint, Confluence or Google Drive for search.
- **Enterprise editorial governance and typed headless delivery are assembled, not built in** (46.3/100) — Core offers draft, pending, scheduled and published states and five roles, but no workflow engine, no field-level or locale-level permissions, no SCIM provisioning and no declarative cross-field validation; approval routing comes from PublishPress or Oasis Workflow. Localization has no model in core at all, so sites choose between WPML, Polylang or one Multisite site per language, none with fallback chains. On the developer side there is no outbound webhook service with signing and retries, no official SDKs beyond PHP and JavaScript, and no TypeScript types generated from the content model without a WPGraphQL plus codegen setup.

## Ideal For

- Marketing and publishing teams whose site lives or dies on organic search and fast content production (fit 86/100) — Yoast or Rank Math give the strongest SEO tooling of any CMS, the block editor and page builders let marketers ship landing pages without a developer, and brief-to-publish in under an hour is realistic with patterns and 7.1's review Notes.
- Small and mid-sized businesses, startups and nonprofits with tight budgets (fit 88/100) — There is no license fee and no contract, hosting starts at a few dollars a month, the famous five-minute install produces a working site the same day, and a solo developer or a two to three person team routinely ships production sites.
- Merchants blending editorial content with a WooCommerce store (fit 76/100) — WooCommerce runs about a third of the world's online stores by count, and on WordPress it is the native commerce engine, so buying guides, lookbooks and product grids share one authoring surface and the block-based checkout is editable from wp-admin.
- Organizations that must keep content on their own infrastructure or in a specific jurisdiction (fit 78/100) — WordPress runs on any PHP and MySQL environment including on-premise and air-gapped setups, imposes no vendor data flows or sub-processors, and plugins such as AI Engine can point AI features at self-hosted models so nothing leaves the building.
- Agencies and groups running many brand or regional sites from one install (fit 66/100) — Multisite shares one codebase, user base and plugin set across a network with a Network Admin, theme.json and block locking constrain brand sites, and adding a site adds hosting rather than license cost.

## Look Elsewhere If

- Regulated enterprises that need the platform vendor to hold SOC 2, ISO 27001, FedRAMP or sign a BAA (fit 18/100) — None of these exist for the WordPress software; they must be sourced from a host and the operator's own program, and most mainstream managed hosts will not sign a healthcare BAA. WordPress VIP or Acquia are the natural alternatives.
- Teams that want a zero-ops platform with an SLA and a vendor to call (fit 26/100) — Hosting, patching, backups, monitoring, caching and support are all the operator's job or a separate paid arrangement, and the plugin update treadmill demands ongoing attention from someone.
- Marketers who expect built-in personalization, a customer data platform and experimentation (fit 28/100) — Core has no segments, variants, decision engine or testing surface. Everything comes from third-party plugins with premium tiers and has to be reconciled with page caching, so platforms such as Optimizely, Sitecore or HubSpot fit far better.
- Companies building an employee intranet or frontline worker portal (fit 30/100) — There is no directory, org chart, acknowledgment tracking, onboarding journey, enterprise search federation or adoption analytics, and the plugin workarounds still leave a heavy custom build.

## Alternatives

Looking for alternatives to WordPress? The DXP Scorecard analyst team rates 9 replacement platforms in "Best WordPress Alternatives in 2026" (https://www.dxpscorecard.com/editorials/wordpress-alternatives), with a recommendation on who should move and who should stay. Ratings updated 2026-10-16.

## Implementation Partners

Agencies, development shops and systems integrators listed on The DXP Scorecard as implementation partners for WordPress: SCube, Envative, HT Blue. The partner network is sponsored: Premier and Featured placements are paid, Listed placements are free. Partner listings are never read by scoring and do not affect WordPress's scores or rank. Listing: https://www.dxpscorecard.com/platform/wordpress#partners

- **SCube** (Implementation Partner, free listing) · https://www.scube.co/
- **Envative** (Implementation Partner, free listing) · https://envative.com
- **HT Blue** (Implementation Partner, free listing) · https://www.htblue.com/dxp-cms-ai-platforms/wordpress · Website: https://www.htblue.com

---
Scored by The DXP Scorecard — an independent site; scorecards and platform inclusion are unsponsored, while the implementation partner network is sponsored and never read by scoring. Reproduce with attribution (CC BY 4.0). https://www.dxpscorecard.com