When is WordPress right?
Where the site mainly publishes content — corporate pages, a blog, news, announcements — WordPress does it well. Content management comes ready, teams already know it, and finding someone to take it over is easy.
If the budget is limited and the site’s job is to inform, commissioning a custom build is not money well spent. There is nothing to be embarrassed about in that decision.
Where do you reach the limit?
When the site has to do something beyond publishing. A form that calculates, a multi-step application flow, a per-user panel or a connection to an existing system — each gets solved with a plugin.
That is where the trouble starts: a site with fifteen plugins has taken on the maintenance of fifteen separate pieces of software. One left un-updated leaves a hole; one updated breaks another.
Who carries the maintenance and security?
Because WordPress is the most used system in the world, it is also the most attacked. That does not make it insecure; it means it becomes exposed quickly when it is not kept current.
The question to ask when deciding: who will keep this site updated? If the answer is nobody, the choice that was cheap in year one becomes a mess to clean up in year two.
Is the speed difference real?
Real but overstated. A well-built WordPress site can be fast; what slows sites down is not the system but stacked plugins and heavy themes.
The advantage of a custom build is that you decide what the page loads. In a world where search engines measure speed, that difference gets paid for wherever competition is tight.