WordPress, Payload CMS, or Code with AI — What's Worth It in 2026?

Two years ago the question was simple: WordPress or custom development. In 2026 there are three fundamentally different ways to build a website — and for the first time in years, WordPress market share is declining. Developers are voting with their feet.

Option 1: WordPress or a website builder. Everyone knows this one. Option 2: Payload CMS — a headless CMS with TypeScript and its own frontend. Option 3: Purely static sites, written directly in code, with AI tools like Claude Code as a development partner. ZenML migrated 2,224 pages in one week from Webflow to Astro this way. StackOne rebuilt their marketing website in a few evenings.

This post compares all three approaches — with concrete numbers, real project experience, and an honest assessment of which option suits which project.

Overview: Three Approaches, Three Philosophies

	WordPress / Builder	Payload CMS	Static with AI
Concept	GUI-based, plugin ecosystem	Code-first headless CMS	Pure code files, no CMS
Language	PHP (WordPress) / proprietary	TypeScript	TypeScript / Astro / MDX
Content management	Browser-based admin panel	Admin panel (React)	MDX files in Git
Database	MySQL	PostgreSQL / MongoDB	None
Hosting	Shared from €3/month	Node.js from €5/month	Cloudflare/Vercel: €0
Security updates	Monthly (required)	npm update	None needed
Attack surface	High (plugins, login, xmlrpc)	Medium (admin panel, API)	Zero (static HTML)
Typical TTFB	400–800 ms	20–100 ms (SSG)	10–50 ms
Who manages content?	Anyone with a browser	Editors in admin	Developer in code
Ongoing costs/year	€1,200–3,600	€60–500	€0–240

The numbers deserve context. That’s what the rest of this post is about.

Option 1: WordPress and Website Builders — The Familiar Choice

WordPress powers 43% of all websites worldwide. Add Squarespace, Wix, Webflow, and Jimdo to the mix. The strength of these systems: anyone can get started. Pick a template, type in your content, publish.

The costs come later.

A typical WordPress site has 20 to 30 active plugins. Each plugin is third-party code with access to the database and filesystem. WordPress is the most attacked CMS in the world — the vast majority of security vulnerabilities come from plugins and themes, not the core.

Performance is a structural issue. WordPress must run through the full PHP boot sequence on every page request — including all plugins. Typical TTFB without caching: 400 to 800 ms. With WP Rocket, Redis, and a CDN you can get down to 100 to 200 ms. That’s three additional plugins to solve a problem that simply doesn’t exist with a static architecture.

Ongoing costs of a typical WordPress project:

• Managed hosting: €20–50/month
• Premium plugins (ACF Pro, Yoast, WP Rocket): €200–500/year
• Maintenance (updates, backups, monitoring): €50–150/month
• Total: €1,200–3,600/year — before a single piece of content changes

When WordPress makes sense: When non-technical editors need to publish content daily, the budget is under €2,000, or an e-commerce store with WooCommerce is planned. WordPress has 20 years of ecosystem momentum — that’s real.

Option 2: Payload CMS — Headless, but Structured

Payload CMS is an open-source headless CMS in TypeScript that defines data structures in code, automatically generates REST and GraphQL APIs, and includes a React-based admin panel — all version-controlled in Git. License: MIT, no hidden costs.

The fundamental difference from WordPress: content structure lives in code, not in the database. A collection looks like this:

const Projects = {
  slug: 'projects',
  fields: [
    { name: 'title', type: 'text', required: true },
    { name: 'client', type: 'relationship', relationTo: 'clients' },
    { name: 'status', type: 'select', options: ['Draft', 'In Progress', 'Live'] },
  ],
}

Three lines. Full IDE support, compile-time checks, versioned in Git. When someone changes a field, you see it in the pull request — not after your production site starts throwing errors.

Since Payload 3.0, the CMS runs directly inside a Next.js app: admin panel, API, and frontend in one project, one deployment. The attack surface is significantly smaller than WordPress — no xmlrpc.php, no public /wp-admin, no plugin code from unknown third parties. Access control works down to the field level.

Ongoing costs:

• Hosting (Cloudflare/Vercel + database): €5–40/month
• Plugins: €0 (everything is code)
• Maintenance: minimal — automated deployment via Git push
• Total: €60–500/year

When Payload makes sense: When the project has complex data structures (relationships between content types, multilingual content, workflows), when multiple editors need an admin panel, and when there are TypeScript developers on the team. Payload is the right step away from WordPress — when you actually need a CMS.

The question is: do you need one at all?

Option 3: Static Sites with AI — Code as CMS

This third option only exists in its current form since mid-2025 — since AI coding tools like Claude Code and Cursor became powerful enough to understand entire projects. The idea: no database, no admin panel, no CMS. Content lives as MDX files and Astro components directly in the code repository. Changes happen in the editor — or via AI assistant in the terminal.

That sounds like a step backwards. The numbers say otherwise.

ZenML migrated 2,224 pages, 20 CMS collections, and 2,397 images from Webflow to Astro in one week — with Claude Code. The developer used Playwright to screenshot the old Webflow site and had Claude Code reconstruct the layouts through visual analysis. Complex Webflow animations were recorded as video, broken into frames, and rebuilt as CSS animations.

A UK web developer documented: “4–6 hours of development time instead of 4–6 weeks.” Features that previously took 2–3 hours were done in 12–18 minutes. Debugging time dropped from 25% of the day to 10%. Astro has since published official documentation on “Building Astro sites with AI tools” — the workflow has become that mainstream.

Here’s what the workflow looks like: A client sends an email: “Please update the phone number on the contact page and add a new case study entry.” In WordPress: open the admin panel, navigate, find the fields, save, clear the cache. Duration: 10–15 minutes. With Claude Code in the terminal: one instruction, two file changes, git push, deployed in 30 seconds. Done.

This website — paulmill.com — runs exactly this way. Astro generates static HTML from .astro components and MDX files. Blog posts like this one are MDX files with YAML frontmatter. No admin panel, no database, no server. Cloudflare Pages delivers the files — for free, worldwide, with a TTFB under 30 ms.

What AI Tools Change About the Workflow

Claude Code, Cursor, GitHub Copilot — these tools have removed the “developer must write every line themselves” bottleneck. A new blog post comes together like this:

1. Brief: I describe the topic, audience, and tone in natural language
2. Draft: Claude Code generates the MDX file with frontmatter, structure, and initial copy
3. Review: I read, correct, and add my own experience and data
4. Images: AI generates images via API (Gemini, DALL-E) directly into the public/ folder
5. Deploy: git push — Cloudflare builds and deploys automatically

Total time for a 2,000-word post: 30 to 60 minutes instead of half a day. The AI handles the grunt work — structure, frontmatter, schema markup, SEO scaffolding. I bring the substance: real experience, concrete project numbers, a point of view.

The same applies to design changes. “Make the hero section responsive and add an animation sequence” — that’s a prompt Claude Code translates into working Astro and CSS code in 2 minutes. Including Tailwind classes, CSS custom properties, and IntersectionObserver. Without a single plugin.

StackOne goes even further: everyone on their team now makes website changes in natural language — not just developers. They’ve defined Claude Code skills (design guidelines, writing style) that automatically ensure consistent quality. The marketing team changes copy and CTAs directly in the terminal, without going through a CMS admin panel.

The Architecture Behind It

┌─────────────────────────────────────────────────┐
│  Content & Code (Git Repository)                │
│                                                 │
│  src/content/blog/*.mdx    ← Blog content       │
│  src/components/*.astro    ← UI components      │
│  src/pages/*.astro         ← Page structure     │
│  public/                   ← Images, fonts      │
│                                                 │
│  Editing: Claude Code / Editor / IDE            │
├─────────────────────────────────────────────────┤
│  Build: Astro SSG (bun run build)               │
│  Output: static HTML + CSS + JS                 │
├─────────────────────────────────────────────────┤
│  Hosting: Cloudflare Pages (€0)                 │
│  CDN: automatic, worldwide                      │
│  SSL: automatic                                 │
│  Attack surface: zero (static files only)       │
└─────────────────────────────────────────────────┘

No database that can be hacked. No PHP that needs patching. No admin panel subject to brute-force attacks. The entire “application” consists of HTML files on a CDN. This is the most secure website architecture that exists.

Ongoing costs:

• Hosting: €0 (Cloudflare Pages Free Tier)
• Domain: €10–15/year
• AI tool (Claude Code / Cursor): €20–100/month (paid by the developer, not the client)
• Maintenance: €0 — there’s nothing to maintain
• Total: €10–15/year for the client

What Does Each Approach Cost?

Total cost of ownership over three years — a more realistic perspective than just the build price:

Cost category	WordPress	Payload CMS	Static + AI
Build	€1,500–5,000	€4,000–12,000	€3,000–10,000
Hosting (3 years)	€720–1,800	€180–1,440	€0–30
Plugins/licenses (3 yrs)	€600–1,500	€0	€0
Maintenance (3 years)	€1,800–5,400	€360–1,200	€0
Content changes	Client self-service (€0)	Client self-service (€0)	Developer (billed by time)
3-year TCO	€4,620–13,700	€4,540–14,640	€3,000–10,030

The surprise: the static approach with AI support is the most affordable long-term option — despite higher upfront costs than WordPress. The reason: zero ongoing costs for hosting, plugins, and maintenance. The savings compared to WordPress typically amount to €1,500 to €4,000 over three years.

The caveat: content changes require a developer. For a business website updated 2–3 times per month, this isn’t a problem — 10 minutes per change with Claude Code. For a news blog with daily articles from rotating editors, it would be a bottleneck.

Performance in Direct Comparison

Same content, different architectures — measured on a real 7-page project (service business, no animations, 6 images):

Metric	WordPress	Payload + Astro	Static (Astro)
TTFB	480 ms	45 ms	28 ms
LCP	2.8 s	0.9 s	0.7 s
Total JS	340 KB	12 KB	0 KB
Lighthouse Score	68	97	100
CWV passed	No (INP)	Yes	Yes

The purely static variant delivers zero JavaScript to the browser — because none is needed. No jQuery legacy, no React hydration, no analytics SDK. Astro renders on the server and sends clean HTML — 40% faster load times than comparable Next.js sites and 90% less JavaScript. It doesn’t get faster than this.

If you’d like to understand what load time means for your conversion rate: Performance Calculator.

Security: Fewer Layers, Less Risk

Attack surface correlates directly with the number of running processes:

WordPress: PHP interpreter, MySQL database, 20+ plugins, login page, xmlrpc.php, REST API, cron jobs. The vast majority of WordPress vulnerabilities come from plugins and themes. A hacked WordPress site costs on average €200–2,000 to recover.

Payload CMS: Node.js server, database, admin panel behind auth. Significantly smaller than WordPress, but still a running application with network endpoints. No third-party plugin code — which eliminates the largest attack vector.

Static: No running application. No database. No login. No server process. Just HTML files on a CDN. The only attack surface is Cloudflare itself — and they have a larger security team than any SMB. A DDoS attack against static files on a CDN is like throwing water at a rock.

Which Approach for Which Situation?

The decision isn’t a matter of ideology — it’s a question of requirements:

Choose WordPress / a website builder when:

• Non-technical editors need to publish content daily
• E-commerce with WooCommerce is planned
• Budget is under €2,000 for the entire website
• No developer will be available long-term

Choose Payload CMS when:

• Complex data structures with relationships are needed (e.g. products → categories → manufacturers)
• Multiple editors need an admin panel
• Multi-channel output is required (website + app + API)
• A TypeScript team is maintaining the project

Choose static with AI when:

• The website has 3–15 pages and changes infrequently
• Performance and security are priorities
• Zero ongoing costs are desired
• A developer (or agency) handles maintenance
• Content is clearly defined (business site, portfolio, landing pages)

In my projects, about 60% of clients end up with the static approach. The reason: most SMB websites are rarely updated after launch — maybe a phone number, a new project in the portfolio, one blog post per month. Running a CMS with a database, login, and monthly updates for that is like renting a truck to mail a letter.

What Does the Claude Code Workflow Look Like in Practice?

A real example — a client sends an email: “We have a new team member. Please add them to the team page. Here’s their photo and bio.”

In WordPress: Log into admin → open the “Team” page → scroll to the right section → upload image → enter text → format → preview → save → clear cache. Duration: 15 minutes.

With Claude Code: Open terminal. “Add a new team member to src/components/Team.astro: Max Mueller, Senior Developer. Photo is at public/team/max-mueller.webp.” Claude Code reads the file, understands the existing structure, adds the entry consistently. git push. Deployed in 40 seconds. Duration: 2 minutes.

This isn’t a hypothetical scenario — this is how I’ve been working since early 2025. Claude Code understands the project’s context: Tailwind classes, component structure, naming conventions. Changes are consistent because the AI uses the existing code as a template — not a template from a plugin database.

It works the same way for blog posts. This article is an MDX file with YAML frontmatter. Claude Code created the basic structure — frontmatter, H2 outline, tables, JSON-LD schema. I provided the substance: project experience, numbers from real projects, my perspective. The result is a text that is technically sound and professionally deployed — without me having to write a single line of markup by hand.

Common Objections to the Static Approach

“The client can’t make changes themselves.” True — but there’s a middle ground. Git-based CMS tools like TinaCMS or Sitepins scan the src/content folder and automatically generate editing forms. The client edits content through a visual interface, and the CMS writes standard MDX files directly to the repository. No server, no database — but still an admin panel.

And even without this middle ground: how often do clients actually change things? In my experience, 1–3 change requests come in per month after launch. That’s 5–10 minutes of work with Claude Code. Compared to the €100+/month maintenance costs for a CMS, it’s cheaper — and every change is immediately quality-checked in the Git history.

“What happens if you as the developer become unavailable?” The project is a standard Astro repository. Any developer with frontend experience can take it over — bun install, bun run dev, done. There’s no proprietary plugin architecture, no database migration, no undocumented hooks. The project IS the documentation.

“Does this scale to 100+ pages?” For content pages with clear structure: yes. Astro builds 500 static pages in under 90 seconds. For dynamic content with daily updates and multiple authors: no — Payload CMS is the better choice there.

The Bottom Line

The three approaches aren’t competitors — they’re tools for different problems. WordPress solves the problem “I need a website quickly and want to manage it myself.” Payload CMS solves the problem “I need a type-safe content system with API and admin panel.” The static approach with AI solves the problem “I need a fast, secure website with zero ongoing costs.”

In most SMB projects, the third option is the most economical — not despite its lack of complexity, but because of it. No CMS is more secure than no CMS. And no plugin is faster than no plugin.

If you’d like to know which approach suits your project, use the Cost Calculator for an initial estimate — or write to me directly.