Tomas has four units in Asheville — two in West Asheville, two closer to the River Arts District. His site was built four years ago by a freelancer who did a genuinely nice job and then, as freelancers do, moved on to other work.
When Tomas called me, the situation was this. Twenty-three plugins installed, nine of them with pending updates and three no longer maintained by their developers. A booking plugin two major versions behind, which meant it was two major versions behind on security patches. A homepage taking 7.4 seconds to become usable on a phone. A contact form that had stopped sending mail at some point in the previous year — he didn't know when, because there was no alert, just an absence of inquiries he'd attributed to a soft season. And a theme that could not be updated without breaking the custom work layered on top of it, which is the trap that ends most WordPress sites.
He'd paid $19 a month for hosting for four years and considered the site basically free. What he'd actually done was inherit a maintenance obligation nobody told him he'd signed up for, and then not perform it — which is not a criticism of Tomas. He runs four units. Nobody handed him a checklist.
WordPress deserves better than a hit piece and better than a sales pitch, so here's the honest accounting: what it's genuinely great at, what the ownership burden actually is, what it costs when nobody carries that burden, and how to decide.
What WordPress is genuinely great at
WordPress runs an enormous share of the web for good reasons, and they apply to lodging businesses too.
It's genuinely open. Your content is yours, in a database you can export, on hosting you choose, with no platform that can change its pricing or its rules and leave you with nothing to move. That's a real form of ownership and the template platforms can't offer it.
It's extensible without limit. Whatever you need to do, there is a way to do it — a plugin, a custom post type, a bit of code. Multi-property content models, complex booking logic, membership areas for repeat guests: all reachable.
The content editing experience is mature. Writing a blog post, adding a page, updating a rate table — all straightforward, and unlike a template platform, the structure underneath can be as sophisticated as your build allows.
And the talent pool is deep. You are never locked to one vendor, because there are more people who can work on WordPress than on any other system.
Done well, and maintained, a WordPress property site is an excellent thing. The two qualifiers in that sentence are where the cost lives.
The ownership burden nobody quotes you
When someone builds you a WordPress site, they hand you software. Software is not a painting; it's closer to a vehicle. It has a maintenance schedule, and skipping it doesn't save money, it defers a larger bill.
Here's the actual recurring obligation. WordPress core updates, including security releases that need applying promptly rather than eventually. Plugin updates, each carrying a small chance of conflicting with another plugin or with your theme. Theme updates, which on a customized theme frequently break the customization — the reason so many sites simply stop updating. PHP version upgrades, which your host will eventually force and which can break older plugins. Database maintenance as tables accumulate revisions and orphaned data. Backup verification, meaning actually testing that a backup restores, not just that it exists. Uptime and error monitoring, so you learn the contact form broke from a monitor and not from a quiet quarter. Security scanning, because an unpatched public site with a payment path is a target. And an annual review of whether every plugin is still maintained, since abandoned plugins are the most common way sites get compromised.
Realistically that's two to five hours a month of skilled attention, and it is not optional in the way owners treat it as optional. It's just invisible until it isn't.
Example from one composite owner's audit: 23 plugins installed, 9 with pending updates, 3 abandoned by their developers. Every plugin is code you're responsible for and a surface someone else wrote. Count yours — the number is usually higher than owners guess.
The plugin stack is the whole story
Plugins are why WordPress can do anything, and they're also the mechanism by which most WordPress sites decay. Understanding the arithmetic changes how you look at a build.
Every plugin is third-party code executing on your site, written by someone with their own priorities, their own release schedule, and their own likelihood of losing interest. A typical vacation rental site accumulates a booking plugin, a calendar sync plugin, a form plugin, an SEO plugin, a caching plugin, an image optimization plugin, a security plugin, a backup plugin, a gallery plugin, a slider, a cookie consent plugin, an analytics connector, and a page builder — thirteen before anyone has done anything unusual.
Three consequences follow, and they compound.
Performance: most plugins load their own stylesheets and scripts on every page whether that page uses them or not. Thirteen plugins routinely means twenty-plus extra requests. That's Tomas's 7.4 seconds, and it isn't his host's fault.
Fragility: each plugin can conflict with any other, so risk rises faster than plugin count. This is why owners stop updating — one bad update took the site down on a Friday, and after that "if it works, don't touch it" becomes the policy. That policy is exactly how a site ends up three years behind on security.
Abandonment: plugins get discontinued constantly. When a plugin doing something load-bearing — like your booking engine — stops being maintained, you're choosing between running unpatched code on a page that takes payment details, or a migration you didn't budget for.
What deferred maintenance actually costs
Neglect doesn't produce one dramatic bill. It produces four quiet ones.
Security
An outdated plugin on a public site is the most common way small business sites get compromised — not sophisticated attacks, just automated scanners finding known vulnerabilities in old versions. For a lodging site the exposure is worse than for a brochure site, because you have a payment path and guest personal data. If your site is compromised and guest data is exposed, you may have notification obligations. Ask your attorney what applies in your state and to your guests, because the answer varies and it is not intuitive.
Silent failures
Tomas's contact form stopped sending mail and nobody knew for months. This is the single most common WordPress failure I find in audits, and it's brutal precisely because it's invisible — inquiries don't bounce, they vanish, and you interpret the silence as market conditions. A monitored site catches it in a day. An unmonitored site catches it when someone happens to test the form.
Speed decay
Sites get slower over time as plugins accumulate and images pile up. Slow costs you rankings and it costs you guests, particularly on phones. It also degrades so gradually that nobody notices — you're comparing today's site to yesterday's, and yesterday's was only slightly faster.
Emergency rates
The bill you eventually pay is an emergency bill. A developer untangling four years of deferred updates on a site with a customized theme charges rush rates for unpleasant work, and the number is routinely several times what a maintenance arrangement would have cost across the same period. This is the least discussed and most reliable cost of "free."
Test your own contact form today. Fill it out as a guest, from a phone, using an email address that isn't the one it sends to. If nothing arrives within five minutes, you've been losing inquiries for an unknown length of time — and that's the highest-return fifteen minutes available to you this week.
The honest comparison
Compare total cost of ownership rather than build price, because build price is the smallest number in the equation.
| Cost line | WordPress, unmaintained | WordPress, professionally maintained | Built to be low-maintenance |
|---|---|---|---|
| Build | One-time, often low | One-time | One-time |
| Hosting | Cheap shared hosting | Managed hosting, higher | Modest |
| Plugin licenses | Free tiers, quietly expiring | Annual renewals across the stack | Few or none |
| Monthly skilled attention | Zero, which is the problem | Two to five hours, billed | Minimal |
| Security posture | Degrades every month | Actively managed | Small attack surface by design |
| Speed over time | Degrades with every addition | Managed, still framework-bound | Stays fast |
| Failure detection | You find out from a quiet quarter | Monitored | Monitored |
| Three-year outcome | Emergency rebuild | Healthy site, ongoing spend | Healthy site, minimal spend |
The middle column is a legitimate, professional way to run a website. It's what agencies that specialize in WordPress provide, and if that's your path, hire one and pay for the care plan. What doesn't work is the first column, which is what most owners actually have — a professional build handed over with no maintenance arrangement, decaying quietly from day one.
Who should choose WordPress anyway
WordPress is the right answer for some property businesses, and I'd rather say so than pretend otherwise.
You should choose it if you publish a lot — a genuine content operation with weekly posts, guides, and a large editorial footprint you manage in-house. WordPress's editing and content tooling is excellent for that, and the maintenance cost is easier to justify when the site is a publishing platform and not just a booking front end.
You should choose it if you have unusual functional requirements — a membership area, a complex custom workflow, an integration with something niche. Extensibility is the reason WordPress exists.
You should choose it if you already have in-house technical capacity, or you're happy to pay for a care plan and you actually will. Maintained WordPress is a good outcome. It's the maintenance, not the platform, that decides.
You should not choose it — or more precisely, you should not inherit it and neglect it — if you're an owner-operator with a handful of units who wants a site that ranks, takes bookings, and doesn't ask you for anything. That's a different tool for a different job, and the mismatch is where Tomas's four years went.
How we approach it at Cavmir
We build property sites to be low-maintenance by design, because for the owners we work with, the maintenance burden is the real cost and the build price is the visible one.
A Cavmir direct booking website is a one-time build you own. It doesn't ship with a stack of third-party plugins you're quietly responsible for patching, which means there's no monthly ritual of updates that might break the booking page, and no abandoned dependency sitting on the page where guests type card numbers.
Booking is integrated with your property management system so availability is real and double-bookings aren't possible. SEO structure is built into the architecture rather than delegated to a plugin. Speed is a build requirement, which is easier to hold when the page isn't loading twenty extra files it doesn't use. Privacy policy, cookie consent, and accessible markup are part of the build, not an add-on you install later and forget to configure.
For owners who want someone watching the site rather than trusting it, we offer ongoing care and consulting — monitoring, content updates, and the quarterly attention that catches a dead contact form in a day instead of a quarter. Current scopes and pricing are on our pricing page, and every engagement is quoted to your actual portfolio, with a written proposal back within 48 hours.
If you have a WordPress site right now
Don't panic and don't rebuild reflexively. Run this triage in order.
Test the contact form and the booking path from a phone, today. Confirm mail arrives and a test booking completes. This is where money is leaking right now if it's leaking.
Take a full backup and verify it restores somewhere. If you can't restore it, you don't have a backup, you have a file.
Inventory the plugins. For each one, check the last update date. Anything untouched by its developer for a year or more is a liability — replace it or remove it.
Check whether core and PHP are current. If you're several versions behind, get a professional to do the update, on a staging copy, with a rollback plan. Do not do this yourself on the live site on a Friday.
Then decide, with real numbers: what does a care plan cost annually, versus what does a rebuild cost once? For a site that's fundamentally sound, the care plan usually wins. For a four-year-old site with a customized theme that can't be updated, 23 plugins, and a booking system two majors behind, the honest answer is usually that you're maintaining something you'd never choose to build today.
Common questions
Is WordPress a good choice for a vacation rental website?
Maintained WordPress is a good outcome. Unmaintained WordPress is the most common bad outcome in this industry. The platform is genuinely capable — open, extensible, portable, with a deep talent pool. The cost is a recurring maintenance obligation nobody quotes you: core and plugin updates, PHP upgrades, backup verification, monitoring, and security scanning. Roughly two to five hours a month of skilled attention. If you will pay for that, WordPress is fine. If you will not, it decays on schedule.
How much does WordPress maintenance cost?
Care plans in this industry generally run from modest monthly retainers for basic updates and monitoring up to substantially more for sites with commerce and custom work. Whatever the figure, compare it against the alternative, which is not zero — it is the emergency bill from a developer untangling several years of deferred updates at rush rates, which is routinely several times the cumulative cost of maintaining it properly.
How many plugins is too many?
There is no magic number, but the risk rises faster than the count because any plugin can conflict with any other. A typical rental site accumulates thirteen before doing anything unusual: booking, calendar sync, forms, SEO, caching, image optimization, security, backup, gallery, slider, consent, analytics, and a page builder. The more useful question is how many are still actively maintained by their developers. Anything untouched for a year is a liability.
What actually happens if I never update WordPress?
Four things, none of them dramatic on any given day. Security exposure grows as known vulnerabilities in old versions become targets for automated scanners. Things fail silently, most commonly the contact form, which stops sending mail without bouncing anything. Speed decays as plugins and images accumulate. And the eventual repair becomes an emergency job at emergency rates. The compounding is the danger, not any single month.
Should I move off WordPress?
Not automatically. If the site is fundamentally sound and you are willing to fund a care plan, keeping it is usually the cheaper answer. Rebuild when the theme has been customized to the point it can no longer be updated, when load-bearing plugins have been abandoned, or when you are maintaining something you would never choose to build today. Those three conditions tend to arrive together.
Is a WordPress booking plugin good enough?
Some are genuinely capable. The question to ask is not about features but about maintenance: how recently was it updated, how large is the developer behind it, and what happens to your booking page if they stop. A load-bearing plugin that gets abandoned leaves you choosing between running unpatched code where guests type card details, or an unbudgeted migration.
Who should maintain my WordPress site?
Someone whose job it is. That means in-house technical capacity, a specialist WordPress agency on a care plan, or a managed host that genuinely handles updates rather than just hosting. What does not work is the arrangement most owners actually have: a professional build handed over with no maintenance agreement and no monitoring, quietly decaying from the day it launched.
The verdict
WordPress is not the problem. Unowned WordPress is the problem — a capable system handed to someone who was never told it needs care, then blamed when it decays on schedule.
If you're going to run WordPress, run it properly: managed hosting, a maintained plugin stack, monitoring, and either in-house capacity or a care plan you actually pay for. That's a good site and a legitimate cost of doing business.
If what you want is a property site that ranks, takes real bookings, stays fast, and doesn't ask for two to five hours a month of skilled attention you don't have, then build for that outcome instead — and buy it once rather than renting it forever or inheriting it and hoping.
Tomas's four units are on a new site now. His contact form is monitored, so if it ever stops sending, he'll know that day. Nothing on it needs patching on a schedule. And the first thing we did, before any of the rebuild, was fix the form — because it turned out the soft season had been eleven months of inquiries going nowhere.
If that story sounds close to home, start with the form test. Then, if you want a second opinion on whether to maintain or rebuild, tell us about the property and we'll give you an honest answer within 48 hours — see the service or get in touch.
Photography via Wikimedia Commons (hero, inline, in-article); licences as noted on each file page.
