Get off WordPress.
Keep the site.

The bill is the pile

WordPress core is free. The cost is the theme, the page builder, the managed host, the security suite, the SEO plugin, the form plugin, the cache plugin, and the freelancer who is the only person allowed to update them. A WooCommerce store adds subscriptions, shipping, tax, and a checkout plugin on top. Mid-market sites quietly spend five figures a year keeping a stack that still cannot ship a landing page on a Tuesday. The license line is zero. The tax is everything around it.

Security you cannot actually apply

Most WordPress compromises start in a plugin, not in core. A flaw in a form plugin, a page builder, or an add-on the author abandoned shows up with a working exploit while the last safe update is still sitting on a staging site nobody finished. Updating one plugin can break checkout, a membership gate, or the homepage the builder owns. If the site has not had a clean update in a quarter, you are already the target. That is the operator's bind: stay unpatched, or risk the site.

The builder owns the page

Elementor, Divi, WPBakery, Bricks, Oxygen, or a stack of Gutenberg block plugins. Marketing was promised they could edit. What they got is a layout that breaks on the next builder release, pages that weigh more than the catalog, and markup nobody else can touch. The site is slower than the company that has to sell on it, or publish on it, this week.

Every change is a specialist ticket

A landing page, a redirect, a form, a shipping rule, a new payment method. Each one lives in a different plugin, and the person who knew which one has rotated off the account. The agency that wrote the child theme is gone. The people who run the company cannot operate their own site. That is the actual problem. A redesign will not fix an unowned stack.

What ranks, and what sells, is trapped

Years of posts, landing pages, and product URLs are the asset. They are also stored as post meta, custom fields, and shortcodes that only render inside this theme. An export is not a migration. If you sell, WooCommerce plus subscriptions, bookings, bundles, and a checkout plugin is doing a commerce platform's job, held together by WP-Cron and an automation account. Leaving feels dangerous because Google, and the register, depend on it. The overhaul has to carry both.

Traffic that arrives decided

Built around the way you publish and sell

WooCommerce and the catalog

When the site sells, the catalog comes with you. Simple, variable, grouped, and downloadable products. Subscriptions, whether that is WooCommerce Subscriptions or a recurring plugin a developer wrote. Bookings. Bundles, composites, and product add-ons. Wholesale and role-based price lists. Points, gift cards, and store credit. The order statuses operations actually uses, including the ones a plugin invented. High-performance order storage and custom checkout fields are read in discovery, because that is often where the register actually lives.

Payments, tax, and the books

WooPayments, Stripe, PayPal, Square, Authorize.net, and Braintree. Klarna, Affirm, and Afterpay. Apple Pay and Google Pay through the gateway you already use. Invoices and packing slips. B2B terms when a plugin or a standing process already grants them: net-30, purchase orders, pay by invoice. Tax finance can defend: WooCommerce Tax, Avalara, or TaxJar, with exemptions where resellers already have them. Payouts and invoices into QuickBooks, Xero, or the ERP, often through MyWorks, Webgility, or the export finance still runs. Multi-currency (WOOCS, Aelia, or YayCurrency) where you already take more than one.

Shipping, warehouse, and inventory

Live rates and the table-rate rules the shipping plugin accumulated. UPS, FedEx, USPS, DHL, ShipStation, Pirate Ship, Flexible Shipping, and Table Rate Shipping. Free thresholds, local pickup, local delivery, and methods that exist only for one customer role. Inventory across the shop, a second warehouse, and drop-ship vendors, including ATUM or the stock-sync plugin that was keeping WooCommerce honest. Kits that decrement components. Labels, tracking on the order, and the customer email that fires when the carton is scanned.

ERP, when WordPress was never the ledger

Orders, customers, and stock in both directions. QuickBooks and Xero are the common case. NetSuite, SAP, Dynamics, Sage, Cin7, or the internal system, usually through a connector or through Zapier, because WooCommerce was never the system of record. Multi-entity when one brand sells and another company invoices. Discovery settles which system owns price and which owns quantity. The site sells. The books record.

Content the theme is holding

Posts, pages, landing pages, and custom post types. Advanced Custom Fields, Pods, Meta Box, or Toolset, where the real content lives in fields the theme knows how to print. Builder markup from Elementor, Divi, WPBakery, Beaver Builder, Bricks, Oxygen, Kadence, or a pile of Gutenberg blocks. Classic editor leftovers and shortcodes. The media library, including files offloaded to S3. WPML, Polylang, or TranslatePress when the site is more than one language. Multisite when one install is several brands that cannot be updated on the same day.

SEO, redirects, and the URLs that rank

Yoast, Rank Math, All in One SEO, or SEOPress: titles, descriptions, and the schema you already earn rich results with. The Redirection or Pretty Links table. Permalink structure and the XML sitemap. Every URL that already ranks has to resolve on the new site. Operators are right to treat this as the risky part. It is in the assessment, with the redirects, before anything is cut over.

Forms, CRM, email, and the glue

Gravity Forms, WPForms, Formidable, Fluent Forms, Contact Form 7, or Ninja Forms, including conditional logic and the form that takes a payment. HubSpot, Salesforce, Mailchimp, Klaviyo, ActiveCampaign, ConvertKit, or Brevo receiving the submission and the customer. Abandoned checkout and replenishment when the site sells. WP Fusion, Uncanny Automator, Zapier, or Make, which on a serious WordPress site is the integration bus. SMTP (WP Mail SMTP, Post SMTP, or FluentSMTP) so the mail the business depends on actually leaves.

Memberships, courses, bookings, and gates

MemberPress, Restrict Content Pro, Paid Memberships Pro, or Wishlist Member. LearnDash, LifterLMS, or Tutor LMS. BuddyBoss, BuddyPress, or a forum that is part of the product. The Events Calendar, Event Tickets, Amelia, or Bookly. GiveWP when the site takes donations. Access rules, drip schedules, and the customer who has already paid for a term. Those entitlements come with the customer. A new site that forgets who already paid is not a cutover.

Search, reviews, analytics, and the long tail

SearchWP, Relevanssi, or Algolia, because native WordPress search could not carry the catalog or the library. Judge.me, Yotpo, or Stamped on the product page. MonsterInsights, Site Kit, PixelYourSite, GA4, the Meta pixel, and Google Ads. Tidio, Intercom, Gorgias, Zendesk, or LiveChat with the order or the member in view. And functions.php, the must-use plugin, and the one integration operations runs every Monday. That last one is usually where the real cutover risk sits.

Security and speed, as hosting

Wordfence, Sucuri, Solid Security, WP Rocket, LiteSpeed Cache, W3 Total Cache, Smush, ShortPixel, and the Redis object cache were how WordPress stayed up and stayed fast. Discovery still reads them, because they hide the real page weight and the real admin workflow. On the new site, patching, caching, images, and the firewall belong with whoever hosts it. They are no longer a plugin you are afraid to update.