Web DevelopmentContent

Headless, static or WordPress: choosing a CMS in 2026

Updated 10 min readBy Jaskirat Singh Talwar

There are three honest ways to run a business website in 2026: WordPress with its theme as the front end (40.0% of all websites, per W3Techs on 14 October 2026), a headless CMS feeding a framework such as Astro or Next.js, or a static site whose content lives in files. The right one depends on who edits the content and how often, how many channels consume it, and how much security and maintenance you can carry. Headless is no longer exotic, WordPress 7.0 (May 2026) put an AI client and an Abilities API into core, and every major headless vendor now ships an MCP server so AI agents can read and draft content. None of that changes the first question: who will be editing this site in year two?

Key takeaways

  • WordPress runs 40.0% of all websites and 58.5% of sites with a known CMS; Shopify 5.4%, Wix 4.2%, Squarespace 2.4%, Webflow 0.8%, Craft CMS 0.1%; 31.6% of sites use no detectable CMS (W3Techs, 14 Oct 2026).
  • The security cost of the WordPress ecosystem is measurable: Patchstack logged 11,334 new vulnerabilities in 2025, up 42% on 2024, 91% of them in plugins and 9% in themes, with only 6 in core; 46% "did not receive a fix from the developer in time for public disclosure".
  • WordPress 7.0 "Armstrong" (20 May 2026) added "a new AI Client in Core" that "lets WordPress communicate with generative AI models", a Connectors screen and a redesigned admin; the Abilities API (core since 6.9) plus the official MCP adapter let agents call WordPress capabilities.
  • Astro 7 (22 June 2026) rebuilt its compiler in Rust and reports builds "15-61% faster"; Contentful, Sanity and Storyblok all run hosted MCP servers for their content APIs.
  • Google's guidance for AI features says "there are no additional requirements" beyond crawlable, consistent pages; the architecture you pick matters for speed, security and editing, not for a secret AI ranking signal.

The three architectures, in plain terms

Coupled (traditional) CMS. The system that stores the content also renders the pages: WordPress with a theme, Joomla, Drupal, Craft with Twig templates. One install, one admin, plugins for everything, server-side rendering on every request unless cached.

Headless CMS. The CMS stores structured content and exposes it over an API (REST or GraphQL); a separate front end, often a framework build deployed to a CDN, fetches and renders it. Contentful, Sanity, Storyblok, Strapi, Payload and Hygraph are the usual names, and WordPress itself can be used headless through its REST API or WPGraphQL. "Decoupled" is the half-way house where the CMS keeps its own front end but also publishes through an API.

Static (content in files). Markdown or JSON in a repository, built into HTML by a static site generator (Astro, Hugo, Eleventy) and served from object storage behind a CDN. No runtime, no database, nothing to patch at the web tier. Editing happens in files, in a Git-based editor, or through a headless CMS that writes to the repo. Our own site, impingesolutions.com, moved from WordPress to this model (Astro on S3 and CloudFront) in October 2026; the numbers and the problems are in our WordPress to Astro migration write-up.

The 2019 version of this article framed headless as an IoT story. The practical multichannel case in 2026 is simpler: a website, a mobile app, email, a product feed, and now AI assistants and agents that read your content through crawlers, feeds and MCP servers.

What changed since 2019

  • WordPress became an AI host. Version 7.0 shipped on 20 May 2026 with 875+ contributors, a "fully revitalized dashboard", new blocks, and the AI building blocks: an AI Client in core, a Connectors screen to "manage all your external connections in a central hub", and the Abilities API, which the release notes pair with the client. 7.1 "Mary Lou" (19 August 2026) added a persistent admin bar across editors, a media editor, Notes with @mentions, and Playlist and Tabs blocks; 7.1.3 (6 October 2026) was a security release. The real-time collaboration feature that delayed 7.0 from April to May is not in either announcement. The official WordPress/mcp-adapter package, still pre-1.0, exposes abilities to MCP clients, with nothing exposed until an ability is explicitly made public.
  • Frameworks got faster and agent-aware. Astro 7 (22 June 2026) moved to Vite 8, replaced its Go compiler with a Rust one, added route-level control through src/fetch.ts, and added a background dev server and JSON logs "for coding agents". Astro 7.3 followed on 3 September 2026.
  • Headless vendors shipped MCP servers. Contentful hosts one at mcp.contentful.com/mcp (OAuth 2.1, EU endpoint available); Sanity's remote server at mcp.sanity.io covers document patching, GROQ queries, schema and releases; Storyblok exposes its Management API through "agent-safe tools". The point is operational: an agent can draft, tag and schedule content under review, inside the content model, instead of pasting text into a page builder.
  • The plugin problem got bigger. Patchstack's 2026 report counts 11,334 new WordPress-ecosystem vulnerabilities in 2025 (+42%), 91% in plugins, and a weighted median of five hours to mass exploitation for the most targeted ones. Every plugin you add is attack surface someone has to patch within hours.

The decision table

WordPress (coupled) Headless CMS + framework Static, content in files Hosted builder (Wix, Squarespace, Webflow)
Editing Familiar admin, block editor, anyone can publish Structured fields, previews need setup; good for teams with content models Developers or a Git-based editor; marketers need a CMS layer Visual, easiest for one person
Multichannel Possible through the REST API Native: one source, many front ends Possible through build-time data Limited
Security exposure Core is solid; plugins and themes are where 100% of 2025's non-core vulnerabilities sat CMS is vendor-managed; your front end is mostly static Smallest: no runtime at the web tier Vendor-managed
Performance Good with caching and discipline; degrades with plugins Excellent when pre-rendered to a CDN Excellent by default Fair to good
Cost pattern Low licence, ongoing maintenance and plugin renewals Vendor subscription plus build; low hosting Lowest hosting; build cost up front Monthly subscription; low build
Lock-in Low (open source, portable) Medium (content model and API are vendor-specific; export exists) Lowest High
AI-agent readiness Core AI client and Abilities API (7.0); MCP adapter pre-1.0 Hosted MCP servers from the main vendors Content is already structured text; add feeds and llms.txt Depends on vendor
Best for Content-heavy sites with non-technical editors and a maintenance budget Brands with several channels or apps and a content team Marketing and documentation sites with a developer in the loop Very small sites with no developer

The two comparisons this page absorbed

Craft vs WordPress. Craft CMS is the developer-built middle ground: structured content, Twig templates, no theme marketplace, far fewer plugins. The pricing as of October 2026 is Solo free, Team $279 per project and Pro $399 per project, each with one year of updates and $99 a year after. At 0.1% of all websites it has a small talent pool, which is the practical risk for a business that may change agencies. Choose it when you want structured content and hand-built templates without going fully headless; choose WordPress when you need the plugin ecosystem and editors who already know it.

WordPress vs Medium. Medium is a publishing platform, not a CMS. You can attach a custom domain, but it requires an active Medium membership, works only for a root domain or subdomain (not yourdomain.com/blog), and if you point the domain elsewhere Medium disconnects it. For anything you want search engines and AI assistants to attribute to your business, publish on a domain you control and syndicate to Medium if you want its audience.

Choosing: a seven-step procedure

  1. List the editors and their frequency. One marketer publishing weekly points to WordPress or a hosted builder; a content team with a model of reusable components points to headless; a developer-maintained site points to static.
  2. Count the channels. Website only: coupled or static. Website plus app plus feeds plus assistant: headless, or static with a CMS writing to the repo.
  3. Price three years, not launch. Include plugin renewals, security monitoring, hosting, vendor subscription and the cost of a developer hour when something breaks.
  4. Audit the plugin list you would need. If a WordPress build needs more than a dozen plugins, cost the maintenance of each against Patchstack's numbers.
  5. Define the content model. Entry types, fields, relationships, localisation. If this is hard to write down, headless will be hard to live with.
  6. Prototype the editor experience. Have the real editors publish one page in the candidate system before you commit.
  7. Plan the migration. URL map and 301s, structured data parity, forms, analytics and consent, feeds, redirects tested before launch. Our guides to 301 redirects and the pre-relaunch audit cover the checklist.

The AI angle, without the hype

Google's guidance is that "there are no additional requirements to appear in AI Overviews or AI Mode". The architecture does not earn citations; crawlable, fast, consistent pages with named authors do (see our GEO guide). Where the CMS choice does matter for AI:

  • Structured content is reusable by agents. A headless or file-based model already separates facts (price, address, specification) from prose, which is what assistants quote and what a feed or an MCP server can expose.
  • Agents as editors need guardrails. WordPress 7.0's AI client, the Abilities API and vendor MCP servers let an agent draft and tag content; keep publishing behind human review, scope the credentials, and log what was changed.
  • Static and pre-rendered sites make crawler access trivial. No login walls, no rendering budget, no plugin injecting scripts; add an Atom feed and keep robots.txt permissive for the search crawlers you want.

FAQ

Is WordPress still a good choice in 2026?

Yes, for content-heavy sites with non-technical editors and a maintenance budget. It runs 40.0% of all websites, 7.0 added an AI client and Abilities API in core, and the core itself had only 6 reported vulnerabilities in 2025. The risk is the plugin layer, where 91% of the year's 11,334 vulnerabilities were found, so keep the plugin list short and patch fast.

What is a headless CMS, in one sentence?

A content store with an API and no built-in front end: editors work in structured fields, and any website, app, feed or AI agent fetches the content through the API and renders it however it needs to.

When is a static site enough?

When a developer is in the publishing loop or a CMS writes to the repository, content changes are not minute-by-minute, and you want the smallest attack surface and the lowest hosting cost: marketing sites, documentation, portfolios, and company sites like this one.

Does a headless CMS help with AI search or AI agents?

Not with ranking or citation; Google says no additional requirements apply. It helps operationally: structured fields are what assistants quote, and Contentful, Sanity and Storyblok run MCP servers so agents can work inside the content model under review.

Should I move my blog to Medium?

Keep the canonical version on your own domain. Medium's custom domain needs a paid membership, works only on a root or subdomain, and Medium disconnects it if the domain points elsewhere. Syndicate if you want Medium's readers; own the original.

Impinge Solutions builds WordPress, headless and static sites and migrates between them as part of its content management and website modernisation services. To get a three-year cost comparison for your site, request an estimate.

Sources

Are you ready to partner with us?

Our good-natured team is waiting to hear your business requirements.

Book a free project call

Stay informed with our newsletter