Why we do not build on templates: cost, security and licences

The short answer

We write the code we sell, so we can change it when you ask. A studio that bought the theme has to answer „the theme does not do that“. A studio that wrote the code answers with a price. That difference shows up in year two, not in the quote.

This is not an argument against WordPress. WordPress is a capable system, its own project claims it runs 43% of all sites, and plenty of honest studios do good work on it. The problem is one specific sales practice: a marketplace theme described as a custom design, invoiced at several thousand, followed by a monthly fee that mostly covers pressing Update. The tool is fine. The description and the price are not.

How to find out whether yours is one

We will not set it all out here, because we have a separate article for it. The fastest route is to put your address into our free website audit: the report names the system, the version if the site gives it away, the theme and the plugins it can recognise, with their versions. It takes about a minute, needs no registration and installs nothing.

If you want to check it by hand in the page source, four searches and what to look for in each are in our article Template sold as a custom website: how to spot it. The rest of this article assumes you already know what your site runs on, and deals with what matters more: what that means for cost, security and licences.

What that offer actually costs to produce

A WordPress theme on a marketplace costs tens of dollars. We are not going to print a precise range, because the marketplace blocks automated checks and we could not re-verify one at the time of writing. The order of magnitude is the point, and you can confirm it in a minute by searching the theme name yourself.

What is verifiable is how the market prices the two kinds of work. Clutch lists standard custom web design in the United States at 100 to 149 dollars an hour, and website builder work, naming Wix, WordPress, Squarespace, Webflow and Shopify, at 25 to 49 dollars an hour. Roughly a quarter, for the same calendar time.

Published hourly rates in Europe sit in a similar spread, although here the sourcing is weaker and we will say so: the figures that circulate for the United Kingdom, around 75 to 200 pounds, and for Germany, around 90 to 150 euro, come from suppliers' and marketplaces' own pricing guides, not from an independent survey. Treat them as asking prices, which is what they are.

So the gap inside an inflated theme quote is not the licence, which costs tens of dollars. It is hours billed at a custom rate and spent on configuration. One line in the quote settles it: the licence cost of every paid component, and the hours, split between design, build and content entry. A supplier who will not itemise that has told you something.

A public codebase comes with a public list of its holes

Open source cuts both ways, and the second way rarely appears in the quote: because the code is public, so is the research on it. In 2025 Patchstack recorded 11 334 new vulnerabilities across the WordPress ecosystem, 42% more than in 2024. Of those, 91% were in plugins and 9% in themes. Six were in WordPress core itself, and all six were low priority.

Three further numbers from the same report matter more than the headline. 1 983 of the reports concerned premium or freemium components, which are exactly the paid plugins a theme build leans on, and 59% of those were high priority. 46% of vulnerabilities had no patch available at the moment they were publicly disclosed. And in Patchstack's own testing, standard hosting defences blocked 12% of WordPress specific vulnerability attacks, and 26% of attacks in a broader test.

Now put that beside what the audit just told you about your own site. An attacker does not need to probe you to learn what you run: the page says it, and the vulnerability databases are free to search. Our audit reads the same thing from the same place, which is the whole point of showing it to you. In 2024, 1 614 plugins and themes were removed from the WordPress.org repository over unpatched security issues, which is the polite way of saying their authors stopped answering.

The update trap

The mechanism is always the same: the site depends on a plugin that does not support the new version of the system, the update breaks the booking form or the store, and the owner chooses between a broken site and a site with a known hole. What happens on the supplier's side, and why the worst ending is the one where the plugin author quits, we cover in our article Template sold as a custom website. Here we are after something else: how many sites this affects.

The scale is visible in WordPress's own published statistics. The figures below are our own calculation, summed from the official WordPress.org APIs on 7 October 2026, and you can repeat it.

• 16,5% of WordPress installations run PHP 7.4, which stopped receiving security fixes on 28 November 2022.
• Adding everything older brings it to 22,3% on PHP 7 or below.
• Adding PHP 8.0, end of life on 26 November 2023, and PHP 8.1, end of life on 31 December 2025, brings it to 37,2% of WordPress sites running a PHP version with no security support at all.
• On the core side, 60,5% run the current 7.1 branch, which leaves roughly 30% two or more major versions behind.

Those sites are not run by careless people. They are stuck. So ask two questions before you sign: which paid plugins will my site depend on, and who writes the fix when one of them blocks an update.

Licences: the risk that lands on you, not on your supplier

ThemeForest's Regular Licence is explicit: you are licensed to use the item to create one single end product for yourself or for one client. One purchase, one site. The licence can be terminated if you breach it, and you must then stop distributing the end product until the item is removed from it.

The consequence is worth stating precisely, because the loose version of this claim is wrong. If your supplier bought one licence and installed it on five client sites, the breach is theirs, not yours. What you are left with is a site whose licence you cannot produce, and a remedy that is out of your hands. That is enough of a problem without exaggerating it.

The same applies to photographs. An image taken from a search results page is not licensed, and a demand letter usually reaches the domain owner, which is normally you rather than the person who placed the file. In the United States, statutory damages run from 750 to 30 000 dollars per work, and up to 150 000 dollars where the infringement is found to be wilful, under 17 U.S.C. 504(c). Two qualifications that are routinely left out: statutory damages are available only where the work was registered in time, and only in United States proceedings. In Europe the claim is normally the licence fee plus damages, and the amounts vary enough between countries that we will not put a figure on it.

Ask for the purchase code or invoice for the theme and for each paid plugin, and for a licence record for every photograph. Ask before launch, not after a letter.

To be fair to WordPress

WordPress itself is not the weak point, and we will not pretend otherwise. Six core vulnerabilities in a year, all of them low priority, against more than 11 000 in third party plugins and themes, is a good record for a system of that size. For a content heavy site on a small budget, a WordPress build is a reasonable choice, and for a simple one page site it is often the right one.

An honest WordPress offer looks like this. It says the word WordPress. It names the theme and shows its licence. It lists the plugins the site will depend on and says who maintains them. And it describes exactly what the monthly fee buys. If all four are there, you are talking to a studio worth hiring, whatever we would have done differently.

What we do instead

We write the front end ourselves. After the price is paid in full you receive the source code and access to the repository with its history, which is written into our terms and conditions, not just into the sales conversation. For clients based outside Slovakia and Czechia the warranty is 12 months rather than six, and it covers defects that appear after browser and operating system updates.

Our export price for a custom website is from 3,900 € and that figure is hours times rate, so you can work it out yourself instead of taking our word for it. What goes into such a rate, and how to compare quotes with and without VAT, we cover in our article What a custom website costs in the West. The other prices are in our price list.

That is not a claim to be better than every alternative. It is a claim about what the number includes.

Where working with us is harder

• Time zones. London shares almost a full working day with us. New York overlaps about two hours against a nine to five, three if we work until six. San Francisco is effectively zero without one side shifting hours, and you should treat any promise to the contrary as marketing.
• Written English is stronger than spoken. Written briefs, code review and written reports are safe ground. Before you sign, have a live call with us in any case, so you can judge it for yourself.
• We are small. A small studio has no 24 hour support rota, and we are not going to invent one. If your contract needs a follow the sun desk, hire someone who has one.
• Our prices are starting points. Integrations, migrations and content work move them, which is why the price list prices them separately by the hour.
• Slovakia does not rank well on the digital indexes. 57 of 69 in the IMD World Digital Competitiveness Ranking 2025, and 48 of 139 in the WIPO Global Innovation Index 2026. We would rather tell you than have you find it. Judge the work in front of you.

Five questions to ask on top

Ten general questions for any supplier, from code ownership to governing law, are in our separate article How to vet a development partner. For a quote that rests on an existing system, add these five to them.

1. If it is a theme, which one, and may I see the purchase code?
2. Which paid plugins will the site depend on?
3. Who fixes a plugin that blocks an update, and at what rate?
4. Where are the licences for the photographs?
5. What exactly does the monthly fee cover, itemised?

A supplier who answers all seven in writing is worth a second conversation, and that includes suppliers who answer „yes, it is a theme“ to the first one. The answer that should end the conversation is the one that avoids the question.