What Is WordPress? The Complete Guide for 2026
What WordPress is, how themes and plugins work, the WordPress.org versus WordPress.com difference that costs people money, real costs, and when not to use it.
Quick answer
WordPress is free, open-source software that turns a web server into a publishing system: you write in a browser, it stores content in a database and renders it as pages. It powers roughly 43% of all websites. The critical distinction is WordPress.org, the software you install on hosting you control, versus WordPress.com, a commercial hosting service built on it. Nearly everything written about WordPress refers to the first. Choosing the second by accident is the most common and most expensive beginner mistake.
Most explanations of WordPress are a definition, a market-share statistic, a list of famous users, and a paragraph about how it started as a blogging tool. That tells you what WordPress is without telling you anything you can act on.
What people actually need is a map: what the software does, what it costs once the free part ends, how .org and .com differ in ways that matter later, what the block editor changed, and the cases where WordPress is genuinely the wrong answer. That last one is missing from almost every guide, because almost every guide is published by somebody who sells WordPress services. ThemesCraft builds for WordPress, so treat the section on when not to use it as the part where we argue against ourselves, and judge it on that basis.
What WordPress actually is
WordPress is a content management system: PHP application code plus a MySQL or MariaDB database. Your posts and pages live as rows in database tables. Your images live as files on disk. When someone visits a URL, WordPress works out which content that URL refers to, fetches it, hands it to a theme that decides how it looks, and returns HTML.
That separation is the whole idea, and it is why the platform has lasted twenty years. Content is not welded to presentation. You can redesign a site completely without retyping a word, because the words were never in the design.
Three concepts sit on top, and once they click the rest of WordPress makes sense.
| Concept | What it controls | Rule of thumb |
|---|---|---|
| Themes | Appearance. Layout, typography, colour, templates | One active at a time. Switching changes the look, not the content |
| Plugins | Behaviour. Adds features WordPress does not ship with | Many at once. Each one is code you are trusting |
| The block editor | How you compose a page, block by block | Introduced in WordPress 5.0, 2018. Replaced the classic editor |
The plugin model is the reason WordPress does everything and also the reason WordPress sites break. Core ships deliberately lean. Contact forms, SEO controls, ecommerce, caching, backups: none are built in. You add them, which means you are running code from a dozen different authors with different standards and different levels of ongoing maintenance.
WordPress.org and WordPress.com: the distinction that costs people money
Two different things share a name. WordPress.org is the free open-source software, maintained by the WordPress project, that you install on hosting you choose. WordPress.com is a commercial hosting product run by Automattic that uses that software and adds plan tiers on top.
The trap is not that one is better. It is that the entire internet of WordPress tutorials assumes .org, so a beginner who signs up at .com follows advice that does not apply, hits a wall where a feature is not available on their tier, and concludes WordPress is broken.
| WordPress.org (self-hosted) | WordPress.com (hosted service) | |
|---|---|---|
| Software cost | Free | Free tier available, paid plans above it |
| You also pay for | Hosting and a domain | Nothing else, it is bundled |
| Install any plugin | Yes, from day one | Only on the higher business-grade plans |
| Install any theme | Yes, including custom code | Restricted on lower tiers |
| Edit files and add custom PHP | Yes | Only on plans that allow it |
| Ads shown on your site | Never, unless you add them | On the free tier, yes |
| Who handles updates and security | You, or your host | Automattic |
| Who most tutorials are written for | This one | Not this one |
Pro tip
If you are not sure which one you are on, look at your admin URL. Self-hosted WordPress lives at yourdomain.com/wp-admin. WordPress.com sites are administered at wordpress.com/home with a different interface. If you cannot find a Plugins menu at all, you are on a .com plan that does not include them.
What WordPress actually costs
The software is free. The website is not. This is the section most introductions skip, and it is the one that determines whether the project is viable.
| Line item | Typical annual cost | Can you avoid it |
|---|---|---|
| Domain name | 10 to 20 USD | No, if you want your own address |
| Shared hosting | 50 to 150 USD | No. Something has to serve the site |
| Managed WordPress hosting | 300 to 500 USD and up | Yes, but you inherit the maintenance |
| Premium theme | 0 to 100 USD, often one-off | Yes, thousands of free themes exist |
| Page builder | 0 to 100 USD per year | Yes, the block editor is capable now |
| Essential plugins | 0 to 300 USD per year | Partly. Good free versions exist for most jobs |
| SSL certificate | 0 | Included free by every credible host |
The honest floor is a domain and shared hosting. Everything above that is a choice. The cost that catches people is not any line in that table but the renewal: introductory hosting prices are frequently a third of the renewal rate, and the discount applies only to the first term.
The block editor, and why older tutorials look wrong
WordPress 5.0 replaced a single rich-text box with a block editor, internally called Gutenberg. Every element is a block: paragraph, image, heading, table, button, gallery. You stack and configure them.
This matters when you are learning, because a large share of WordPress tutorials online predate 2018 and describe an interface you do not have. If a guide tells you to paste HTML into a box marked Text, it was written for the classic editor.
The second phase, full site editing, extended blocks beyond content into the templates themselves: header, footer, archive pages, the lot. Themes that support it are called block themes. Themes built the traditional way, with PHP template files, still work and remain extremely common. Both are valid in 2026, and a beginner does not need to pick a side to get started.
What people build with it
- Business and brochure sites. The default case. Pages, a blog, a contact form. WordPress is comfortably overpowered for this, which is fine.
- Blogs and publications. What it was built for, and still the thing it does with the least friction. Editorial workflow, categories, authors and scheduling are native rather than bolted on.
- Ecommerce, through WooCommerce. Turns WordPress into a store. Strong when you want full control of content and checkout; more maintenance than a hosted platform.
- Membership sites and online courses. Gated content, subscriptions, drip-fed lessons. A mature plugin ecosystem covers this well.
- Directories, listings and catalogues. Custom post types and taxonomies are genuinely good at structured content, and this is where WordPress quietly outperforms simpler site builders.
- Headless front ends. WordPress as the editing interface and REST or GraphQL API only, with a separate framework rendering the site. A real pattern, and more work than it sounds.
When WordPress is the wrong choice
A platform that runs 43% of the web is not universally correct; it is universally available, which is different. Four cases where something else wins.
- A pure ecommerce business with no appetite for maintenance. A hosted platform handles PCI scope, uptime, updates and payments as someone else’s problem. WooCommerce gives more control and hands you the operational burden. If nobody on your team will own updates, that burden becomes an outage.
- A five-page site that will never change. A static site or a simple builder is faster, cheaper and has effectively no attack surface. Installing a database-backed CMS to serve five pages that nobody will edit is work you are volunteering for.
- A genuine web application. Dashboards, real-time features, complex user-specific state. WordPress can be bent into this shape and the result is usually worse than a purpose-built application. The request lifecycle is designed to render pages.
- Nobody is responsible for updates. This is the decisive one. WordPress security incidents overwhelmingly involve outdated plugins rather than core. If no person and no managed host owns patching, the site will eventually be compromised, and no theme choice changes that.
Watch out
The claim that WordPress is insecure is mostly a category error, but the correction people give is also wrong. Core is well audited and patched quickly. The risk sits in plugins and themes, particularly abandoned ones and nulled commercial versions distributed for free. Popularity means it is targeted constantly, so an unmaintained WordPress site is found by automated scanning within weeks, not years.
Where it came from, briefly
Matt Mullenweg and Mike Little forked an abandoned blogging tool called b2/cafelog in 2003. It is released under the GPL, which is the fact with lasting consequences: anyone can use, modify and redistribute it, nobody can revoke your licence, and any theme or plugin derived from it inherits the same freedoms. That licence is why an ecosystem of tens of thousands of plugins exists and why your site cannot be taken away by a vendor decision.
Automattic, Mullenweg’s company, runs WordPress.com and employs many contributors, but does not own the open-source project, which is stewarded by the WordPress Foundation. The distinction matters when you are assessing platform risk.
Getting started, honestly
- Decide .org or .com. If you want any plugin, any theme, or your own code, it is .org. That is most people reading this.
- Buy a domain and hosting. Almost every host offers one-click WordPress installation. Pay attention to the renewal price, not the headline.
- Pick a theme and leave it alone for a month. Beginners lose weeks switching themes. A default like Twenty Twenty-Five is genuinely fine while you learn.
- Install four plugins, not thirty. An SEO plugin, a backup plugin, a security plugin, a form plugin. Add more only when you hit a specific limitation.
- Set permalinks to Post name under Settings, then Permalinks, before you publish anything. Changing it later breaks every URL you have already published.
- Publish something. The site teaches you more in a week of use than a month of configuration will.
Step four is where most people go wrong, and our list of essential WordPress plugins is organised around what each one actually does rather than how many you can install. If you are weighing whether the platform will hold up in search, we cover that directly in is WordPress good for SEO, and if you are hiring rather than building, what WordPress development involves sets out scope and realistic costs.
Frequently asked questions
What is the difference between WordPress.org and WordPress.com?
WordPress.org is the free open-source software you install on hosting you choose and control completely. WordPress.com is a commercial hosting service built on that software, with features gated by plan tier. The practical consequence is that plugins and custom code are available immediately on .org but only on higher-priced .com plans, and nearly every WordPress tutorial online assumes you are on .org.
Is WordPress really free?
The software is free under the GPL and always will be. The website is not. You still need a domain, roughly 10 to 20 USD a year, and hosting, from about 50 USD a year on shared plans. Themes, plugins and page builders have capable free versions, so a realistic minimum is around 60 to 170 USD a year with no software licences at all.
Do I need to know how to code to use WordPress?
No. You can build and run a complete site through the dashboard and the block editor without writing anything. Coding knowledge widens what is possible, particularly for custom layouts and functionality, but the platform is designed so that publishing, design changes and adding features are all point-and-click operations.
Is WordPress secure?
WordPress core is well audited and patched quickly. The risk lives in plugins and themes, especially abandoned ones and pirated commercial versions. Because WordPress runs such a large share of the web it is scanned constantly by automated tools, so an unmaintained site is found quickly. Keeping everything updated and limiting plugin count removes most of the real exposure.
What is the difference between a theme and a plugin?
A theme controls how the site looks: layout, typography, colour and templates. Only one is active at a time, and switching changes appearance without touching content. A plugin adds behaviour or features, such as contact forms, SEO tools or ecommerce, and you can run many at once. Themes are presentation, plugins are function.
When should I not use WordPress?
Four cases. A pure ecommerce business with nobody to own maintenance is usually better served by a hosted store platform. A tiny static site that will never change does not need a database-backed CMS. A genuine web application with complex state is better purpose-built. And critically, if no person or managed host will own plugin updates, the site will eventually be compromised regardless of how it is built.
What is the block editor and do I have to use it?
The block editor, introduced in WordPress 5.0 in 2018, composes pages from individual blocks such as paragraphs, images and tables rather than one rich-text field. It is the default. You can restore the previous interface with the official Classic Editor plugin, though new features are built for blocks, so treat that as a transition rather than a permanent choice.
Can WordPress handle an online store?
Yes, through WooCommerce, which adds products, cart, checkout and payments. It suits businesses that want full control over content and the buying flow, and it sits naturally alongside a serious content operation. The trade-off is operational: you own hosting, updates, security and performance, which a hosted store platform would handle for you.
1 response