What it really costs over 3 years
WordPress sites look cheap on day one. A small-business build from a local Malaysian agency usually runs RM 2,500 to RM 6,000. The expensive part shows up in year two and three, and most owners only realise it after they've already signed off.
The table below is the kind of number we walk clients through when they come to us asking to move off WordPress. It's a 6-page corporate site, 36 months, typical Malaysian SME setup.
| Cost item | WordPress (3 years) | Hand-coded (3 years) |
|---|---|---|
| Initial build | RM 3,500 | RM 4,800 |
| Hosting (shared, MY data centre) | RM 360/yr × 3 = RM 1,080 | RM 0 (edge hosting included) |
| Premium plugins (Yoast, security, backup, page builder) | RM 600/yr × 3 = RM 1,800 | RM 0 |
| Theme license + updates | RM 400/yr × 3 = RM 1,200 | RM 0 |
| Maintenance retainer (necessary in practice) | RM 200/mo × 36 = RM 7,200 | RM 0 (optional care plan) |
| 3-year total | RM 14,780 | RM 4,800 |
The line that quietly breaks the budget is the maintenance retainer. A WordPress install needs monthly core updates, plugin updates, security patches and malware scans. Skip them and the site eventually gets compromised or breaks. The pattern we keep seeing: a business runs fine for six or seven months, then the site goes down right before a Raya or Chinese New Year campaign is meant to go live.
Speed — why WordPress is slower
A WordPress site on the kind of shared hosting most Malaysian SMEs use will usually load in around 4.5 to 7 seconds on a 4G connection. The same kind of site, hand-coded, comes in at 0.8 to 1.8 seconds. That gap isn't a detail — it's the difference between a customer waiting and a customer leaving.
There are three structural reasons WordPress runs slower. PHP rendering is the first: WordPress generates the HTML on the server every single time someone visits. A hand-coded static site doesn't — the HTML is built once and served straight from edge servers in Singapore or Kuala Lumpur (via Cloudflare or Vercel). No server-side work, no waiting.
The second is plugin weight. A small-business WordPress site will commonly load somewhere around 12 to 25 JavaScript files and another 8 to 15 stylesheets. A clean hand-coded build usually sits at 2 to 4 of each. Every extra file is a separate DNS lookup, TCP handshake and parse cycle the browser has to chew through before the page actually appears.
Third is the database. Every WordPress page hits MySQL — often 30 to 80 queries per load. A static site served from the edge has no database to hit, so that whole layer just disappears.
Google's Core Web Vitals (LCP, INP, CLS) feed directly into ranking in 2026. A sub-2-second LCP is now the bare minimum for getting onto page one of google.com.my, and on mobile, most WordPress sites don't make it.
Security & maintenance burden
Wordfence, the largest WordPress security firm, recorded an average of 4.4 billion attacks per month blocked against WordPress sites in 2024. The attack surface is enormous because WordPress runs on PHP, exposes a public /wp-admin/ login page, and depends on 20 or more third-party plugins — any one of which can become a vulnerability when a plugin author stops shipping updates.
Hand-coded static sites have no admin panel to attack, no database to inject into, no PHP server to exploit. The attack surface is effectively zero. There is no monthly patching cycle because there's nothing to patch.
The trade-off: when you want to change content, you (or your developer) need to edit the source and redeploy. Which is exactly why most SMEs reflexively reach for WordPress — and exactly why that reflex often costs them money. Read on.
Editing content (without a developer)
This is the single strongest argument for WordPress. If your team needs to publish five or more articles per week, run promotional campaigns at short notice, swap homepage hero images monthly, or have non-technical staff manage a product catalogue — WordPress's admin panel is genuinely hard to beat. It's the reason the platform still powers about 40% of the public web.
For a hand-coded site, you have two reasonable options:
- Send edit requests to your developer. Fine if the site changes once a quarter — most service-business sites, law firms, clinics, restaurants and consultancies fit here.
- Pair the hand-coded site with a headless CMS (Sanity, Decap, Contentful, or a custom lightweight admin). Your team still gets a friendly admin interface, but the site itself stays hand-coded and fast. Typical add-on cost: around RM 1,500 at build time, plus a free or near-free hosted CMS tier for most small teams.
The point is: needing easy content editing does not mean you need WordPress. It just means you need some editor — and the editor doesn't have to drag the whole site's speed down with it.
SEO impact in Malaysia
On google.com.my, hand-coded sites consistently rank ahead of WordPress sites in the same industry — that's the pattern across the projects we've migrated, and it lines up with what most SEO practitioners working in this region see. The gap is widest on competitive local terms like "website design kuala lumpur" and "网页设计 马来西亚", where the top of page one tends to be dominated by sites that load fast.
A few things drive it. Core Web Vitals is the obvious one — hand-coded sites generally clear Google's mobile LCP threshold, while WordPress sites on shared hosting often don't. Since Google indexes mobile-first, failing there pushes you down a tier before content quality even enters the picture.
Crawl efficiency matters too. Static HTML is just easier for Googlebot to process than pages that rely on PHP rendering and plugins. On a larger site, this usually means Google ends up indexing more of your pages in a given crawl budget.
And then there's structured data. A hand-coded site can ship exactly the JSON-LD Google's docs ask for — LocalBusiness, Service, FAQPage, BreadcrumbList — and nothing else. WordPress SEO plugins frequently emit overlapping or contradictory schema, which Google quietly ignores rather than trying to untangle.
None of this means a WordPress site can't rank. It can. But getting one there usually takes a premium SEO plugin, careful configuration, and ongoing discipline. With a hand-coded site, most of that work is already done at build time.
When WordPress is the right choice
We are not anti-WordPress at 666. There are real scenarios where it's the right answer, and we'll tell prospective clients so directly. WordPress wins when:
- The team publishes 5 or more new articles per week and the editorial workflow is the bottleneck
- There is a dedicated marketing person who is on the site daily, comfortable with WordPress, and treats it as their primary workspace
- A specific WordPress plugin is genuinely required — for instance, WooCommerce Subscriptions paired with a Malaysian payment gateway integration that doesn't exist outside the WordPress plugin ecosystem
- The project is taking over an existing WordPress install with significant historical content and migration costs would outweigh the speed gains
- The client explicitly wants the editing experience, fully understands the trade-offs, and chooses it deliberately rather than by default
When hand-coded is the right choice
Hand-coded is the better answer when the site is:
- Mostly stable content — services, about, contact, portfolio, case studies, team page
- Reliant on speed for conversion (most Malaysian SMEs fall here, especially e-commerce)
- Run by an owner or small team without a dedicated marketing seat
- Expected to keep total cost of ownership low over a 3+ year horizon
- Competing for organic Google rankings in any meaningful way
- Handling customer data where security matters (lead forms, bookings, payments)
This combination covers roughly 80% of the Malaysian SME market — restaurants, clinics, law firms, accountancies, agencies, manufacturers, e-commerce stores under 500 SKUs, service consultancies, and B2B suppliers.
How to decide — 5-question checklist
If you're stuck, answer these five questions honestly. They reflect what we ask in discovery calls before recommending a stack.
- How many content updates do you make per month?
More than 20 → WordPress. Fewer than 5 → hand-coded. Between 5 and 20 → hand-coded with a headless CMS. - Does the site need user accounts or login?
No → either approach. Yes → you don't need a website, you need a web app or SaaS platform. - Is RM 200+/month for ongoing maintenance comfortable?
Yes → WordPress works. No → hand-coded saves you the line item. - Does Google ranking matter to your business?
Yes → hand-coded wins on Core Web Vitals and schema. "Not really" → either approach is fine. - Will your team publish content without developer help?
Yes, often → WordPress or hand-coded + CMS. Yes, occasionally → hand-coded with email-based edit requests is fine.
If three or more answers point to hand-coded, that's almost certainly the right call. If three or more point to WordPress, build it on WordPress — but budget for the maintenance retainer from day one.
3 年下来到底花多少钱
WordPress 网站表面上很便宜。本地中介公司给中小企业建站，一般报价大约在 RM 2,500 到 RM 6,000 之间。贵的部分要看第二、第三年——大多数老板都是签完字之后才发现。
下面这张表，是我们帮客户从 WordPress 转手编代码时，会一起看的那种数字。一个 6 页的企业网站，36 个月，本地中小企业一般的配置。
| 开销项目 | WordPress（3 年） | 手编代码（3 年） |
|---|---|---|
| 初次建站 | RM 3,500 | RM 4,800 |
| 主机托管（本地共享主机） | RM 360/年 × 3 = RM 1,080 | RM 0（已含 Edge 部署） |
| 付费插件（Yoast、安全、备份、页面构建器） | RM 600/年 × 3 = RM 1,800 | RM 0 |
| 主题授权 + 更新 | RM 400/年 × 3 = RM 1,200 | RM 0 |
| 月度维护（实际上必须） | RM 200/月 × 36 = RM 7,200 | RM 0（可选护理计划） |
| 3 年总计 | RM 14,780 | RM 4,800 |
悄悄把预算吃掉的，是月度维护这一项。WordPress 每个月都要更新核心、更新插件、打安全补丁、扫描木马。没做的话，网站迟早被入侵或出问题。我们一直看到一个规律：生意先顺顺利利跑了六七个月，然后网站就在开斋节或新年促销活动准备上线那几天挂掉。
速度——为什么 WordPress 比较慢
大部分马来西亚中小企业用的那种共享主机上的 WordPress 网站，4G 下加载通常要 4.5 到 7 秒。同样规模的网站，手编代码做出来，大概 0.8 到 1.8 秒 就开了。这不是小事——这是顾客愿意等和顾客转头就走的差别。
WordPress 跑得慢，结构上有三个原因。第一个是 PHP 渲染：每次有人访问，服务器都要现场生成 HTML。手编代码静态网站完全不用——HTML 建好一次，从新加坡或吉隆坡的 Edge 服务器（Cloudflare 或 Vercel）直接送出来，没有等待。
第二个是插件累赘。一个中小企业的 WordPress 网站，通常要加载 12 到 25 个 JavaScript 文件、再来 8 到 15 个样式表。手编代码网站一般就 2 到 4 个。每多一个文件，浏览器就多一次 DNS 查询、TCP 握手、解析——页面才能真正显示出来。
第三个是数据库。WordPress 每一页都要查 MySQL，一次加载常常就有 30 到 80 个查询。Edge 部署的静态网站根本没有数据库要查，整层就消失了。
Google 的 Core Web Vitals（LCP、INP、CLS）在 2026 年直接影响排名。LCP 在 2 秒以内，现在已经是想排到 google.com.my 第一页的最低门槛。而手机上，大部分 WordPress 网站达不到。
安全与维护负担
WordPress 最大的安全公司 Wordfence 统计，2024 年平均每个月拦截 44 亿次针对 WordPress 网站的攻击。攻击面很大，因为 WordPress 跑在 PHP 上、有公开的 /wp-admin/ 登录页、还要靠 20 多个第三方插件——任何一个插件如果作者不再更新，都可能变成漏洞。
手编代码静态网站没有后台可以攻击、没有数据库可以注入、没有 PHP 服务器可以利用。攻击面基本上是零。也没有月度打补丁的周期——因为根本没什么要打。
缺点是：要改内容，您（或您的开发者）就得改源代码、重新部署。所以很多中小企业一想到要建网站，就反射性地想到 WordPress——也正是这个反射，让他们多花了不少冤枉钱。接下来谈这一点。
编辑内容（不靠开发者）
这是 WordPress 最强的一个卖点。如果您的团队每个星期要发 5 篇以上文章、要临时跑促销活动、每月换首页主图、或者有不会写代码的员工要管理产品目录——WordPress 的后台真的很难被取代。这也是为什么这个平台到今天还撑着全球大约 40% 的网站。
如果是手编代码网站，您有两个比较实际的选择：
- 把修改要求发给开发者。适合一季才更新一次的网站——大部分服务型生意、律师楼、诊所、餐厅、顾问公司其实都属于这一类。
- 给手编代码网站配一个 Headless CMS（Sanity、Decap、Contentful，或一个轻量级的自家后台）。您的团队照样有友好的后台用，但网站本身保持手编代码的速度。建站时一般加约 RM 1,500，加上小团队基本免费的 CMS 托管方案，就有了。
重点是：需要方便地编辑内容，不等于一定要用 WordPress。意思是您需要一个编辑器——而这个编辑器不用拖累整个网站的速度。
在马来西亚的 SEO 影响
在 google.com.my 上，同行业之间比较，手编代码网站通常都排在 WordPress 网站前面——这是我们做过的迁移项目都看到的规律，也跟本地大多数做 SEO 的人观察到的情况一致。「website design kuala lumpur」「网页设计 马来西亚」这种竞争激烈的本地关键词，第一页的前几名几乎都是加载快的网站。
原因有几个。Core Web Vitals 是最明显的一个——手编代码网站手机版的 LCP 一般都能过 Google 的门槛，而本地共享主机上的 WordPress 网站常常过不了。Google 现在是「手机优先索引」（mobile-first indexing），手机版不达标，还没轮到看内容质量，就已经被降一级了。
抓取效率也有影响。静态 HTML 让 Googlebot 处理起来比要靠 PHP 和插件渲染的页面省事得多。大型网站尤其明显——同样的抓取预算，Google 一般会愿意收录更多您的页面。
还有结构化数据。手编代码网站可以精准只提供 Google 文档里要求的那些 JSON-LD——LocalBusiness、Service、FAQPage、BreadcrumbList——其他不要。WordPress 的 SEO 插件经常输出重叠或互相冲突的 schema，Google 看不懂索性直接忽略。
这不代表 WordPress 排不上去。能。但要排上去通常需要一个付费的高级 SEO 插件、细心的设置、加上长期的维护纪律。手编代码网站，这些东西在建站时就已经做好了。
什么时候应该选 WordPress
666 不是反 WordPress。有些场景 WordPress 真的就是对的答案，我们也会直接告诉客户。WordPress 在以下情况胜出：
- 团队每星期要发 5 篇以上新文章，编辑流程是瓶颈
- 有专门的市场推广员工天天在网站上工作，已经用惯 WordPress，把它当作主要工作环境
- 必须用某个特定的 WordPress 插件——例如 WooCommerce Subscriptions 配合某个只在 WordPress 插件生态里才有的本地支付网关
- 项目是接手一个现成的 WordPress 网站，有大量历史内容，迁移成本会超过速度上的好处
- 客户明确想要那种编辑体验，完全清楚相应的取舍，而且是有意识地选，不是默认地选
什么时候应该选手编代码
下面这些情况，手编代码是更好的答案：
- 网站大致是稳定内容——服务、关于我们、联系、作品集、案例、团队介绍
- 转化率靠速度（大部分马来西亚中小企业都是，尤其是电商）
- 老板或小团队在管，没专门的市场推广岗位
- 3 年以上要把整体成本控制低
- 需要在 Google 排名上有实质表现
- 会处理客户数据，安全很重要（询问表单、预订、付款）
这个组合覆盖了大约 80% 的马来西亚中小企业市场——餐厅、诊所、律师楼、会计师楼、中介公司、制造商、500 个 SKU 以下的电商、顾问公司、B2B 供应商。
怎么决定——5 题清单
如果还在犹豫，老实回答下面 5 题。这就是我们在咨询会议上，建议技术方案之前会问的问题。
- 每个月更新内容几次？
超过 20 次 → WordPress。少于 5 次 → 手编代码。5 到 20 次之间 → 手编代码 + Headless CMS。 - 网站需要用户注册/登录吗？
不需要 → 两种方案都可以。需要 → 您要的不是网站，而是 Web App 或 SaaS 平台。 - 每月 RM 200 以上的维护费用可以接受吗？
可以 → WordPress 行得通。不行 → 手编代码帮您省下这一项。 - Google 排名对生意重要吗？
重要 → 手编代码在 Core Web Vitals 和 schema 上都占优。「不太重要」→ 两种方案都行。 - 团队会自己发布内容，不靠开发者吗？
会，常常 → WordPress 或 手编代码 + CMS。会，偶尔 → 手编代码 + 邮件提修改要求就够。
如果 3 题以上的答案指向手编代码，那基本上就是对的选择。如果 3 题以上指向 WordPress，那就用 WordPress 建——但请从第一天起，就把月度维护费用列进预算。
Frequently asked questions常见问题
Can I migrate from WordPress to a hand-coded site later?以后可以从 WordPress 迁移到手编代码网站吗？
Yes. We've moved more than ten Malaysian SME sites off WordPress so far. Content transfers cleanly via standard WordPress exports, 301 redirects preserve your existing Google rankings, and SEO performance usually improves within 30 to 60 days after launch — mainly because of faster load times and cleaner structured data.
可以。到目前为止，我们已经帮十几个本地中小企业把网站从 WordPress 搬出来。内容通过 WordPress 标准的导出可以完整搬过去，301 重定向能保留您现有的 Google 排名，SEO 表现一般在上线后 30 到 60 天内就会变好——主要是加载更快、结构化数据更干净的关系。
Will Google penalise a hand-coded website for not being on WordPress?Google 会因为我的网站不是 WordPress 而惩罚我吗？
No. Google has no CMS preference. Its ranking systems reward sites that load quickly, are easy to crawl, provide useful content, and have clean structured data — regardless of how they were built. Hand-coded sites typically score better on all four.
不会。Google 对 CMS 没有偏好。它的排名系统奖励的是加载快、容易抓取、内容有价值、结构化数据干净的网站——跟用什么工具建无关。而手编代码网站这四项通常都表现得更好。
Can I run an e-commerce store on a hand-coded site instead of WooCommerce?手编代码网站可以做电商吗？还是只能用 WooCommerce？
Yes, for catalogues up to roughly 500 SKUs we typically pair a hand-coded storefront with a headless commerce backend (Stripe + Sanity, or Snipcart). Above 500 SKUs or for complex variant management, Shopify or WooCommerce may still be the better fit.
可以。500 个 SKU 以下，我们通常给手编代码前台配一个 Headless 电商后端（Stripe + Sanity，或 Snipcart）。SKU 超过 500 或者商品变体非常复杂，那 Shopify 或 WooCommerce 可能还是比较合适。
Will my Malaysian payment gateway (iPay88, Billplz, FPX) still work?能跟我现有的本地支付网关（iPay88、Billplz、FPX）整合吗？
Yes. iPay88, Billplz, Stripe and direct FPX integration all expose standard REST APIs and webhooks. Hand-coded sites integrate cleanly — often with less friction than retrofitting them into WordPress plugin ecosystems.
可以。iPay88、Billplz、Stripe 以及直接 FPX 整合，都提供标准的 REST API 和 webhook。手编代码网站可以干净地接进去——通常比硬塞进 WordPress 插件生态里还顺。
Can my non-technical team still update the site without a developer?我那些不懂技术的同事，可以不靠开发者自己更新网站吗？
Yes, with an optional headless CMS add-on (around RM 1,500 at build time). Your team gets a familiar admin interface — write blog posts, change hero images, update product copy — but the website itself stays hand-coded and fast. The CMS only handles content; it never touches the rendered site's performance.
可以。加一个 Headless CMS 模块就好（建站时大约多 RM 1,500）。您的团队会有一个熟悉的后台——写博文、换首页主图、改产品文案都行——但网站本身保持手编代码的速度。CMS 只管内容，从来不会影响网站的性能。
If hand-coded is better in most cases, why doesn't 666 just recommend WordPress to everyone for the easy money?如果手编代码在大部分情况下更好，那 666 为什么不干脆推荐每个人都用 WordPress，赚轻松钱？
Because we don't earn ongoing licence fees, plugin commissions, or hosting kickbacks. Our recommendation reflects what we'd build for our own business: a site that's cheap to run, fast for customers, and doesn't break when nobody's looking. WordPress only beats that combination in a narrow set of cases — and when it does, we'll tell you.
因为我们不赚长期授权费、不赚插件佣金、不赚主机回扣。我们推荐什么，就是我们自己生意会用什么：跑起来便宜、顾客感觉快、没人看着的时候也不会出问题。WordPress 只在很有限的几种情况下能打败这个组合——如果真的是那几种情况，我们会直接告诉您。
