Craft CMS vs WordPress
What’s the differences between these two content management systems?
Lori Hosseinbucus is a developer at William Joseph who is passionate about creating accessible websites
Craft CMS and WordPress are both content management systems that have been around for more than 10 years and are built using PHP with an SQL database.
I’ve used both for a long time, but, like most developers, I came across WordPress first. I have a soft spot for it, as it’s the WordPress community that helped me get started as a developer. But for the past few years, Craft has become my go-to option for every project.
For websites that use a custom design, Craft and WordPress are comparable, although you have to use the right setup to get the best out of either of them.
I detail some of the setup I use below, as well as the differences between the author experience, security, plugins, maintenance, accessibility, SEO, hosting and more of Craft and WordPress.
If you’re more interested in which CMS is right for your project, read my guide to choosing a CMS.
Custom design
The creators of WordPress want to make setting up a website as easy as possible. You do not have to be able to code to use WordPress, because ready-made themes and plugins are available.
You can also hire someone to choose or tweak a WordPress theme for you. This is a good option if you’re hiring a freelancer to create your website and have to choose between hiring a marketing expert or a developer. Using something ‘off the shelf’ might mean you can launch your new website sooner.
Using a ready-made theme can provide you with a basic website for a smaller budget. I wouldn’t recommend a branding package that costs thousands of pounds to a plumber, and I wouldn’t recommend a custom theme for them either.
Agencies like William Joseph do not use pre-made website themes. Instead, we create a design system to keep the website’s pages consistent and accessible.
When we use WordPress, we create a custom theme, building the templates and components according to the design system.
Craft CMS was built with agencies in mind, so it does not have a marketplace of ready-made themes and does not include any front-end code by default.
Building the front-end does not mean we start from scratch, though – we use a boilerplate that includes our favourite tools and frameworks (like Vite and Tailwind).
Author experience
Page editor
A common misconception is that once you’ve learnt how to add content to one WordPress site, you’ll know how to add content to all WordPress sites.
One of the benefits of WordPress is its flexibility. But this means there’s no clear path for a developer to take, so it’s rare for two WordPress sites to be the same. For example, you may know how to use WordPress’s Gutenberg blocks, but the page editor changes if you’re using a page builder plugin like Elementor, Divi or Beaver Builder.
Craft CMS does not use page builder plugins, but it’s still extremely flexible because it does not make assumptions about the website’s content.
Craft’s page editor does not have any content fields when you install the CMS, so the developer sets them up according to the design system.
Craft uses custom content fields by default, but we get the same setup in WordPress using the Classic Editor plugin with the ACF (Advanced Custom Fields) plugin.
The content editor’s experience is less about which CMS you use and more about how the website has been designed and set up. We aim for it to be intuitive, so you need little or no training before you start uploading content to the CMS.
Content blocks
Agencies like William Joseph build page components using custom content fields to create content blocks.
Using custom fields means you have fewer decisions to make when you’re adding your content to the CMS. For example, you do not need to select a readable font size or accessible colour combination, as the designer has already worked these out in the design system.
Craft’s flexible Matrix fields allow you to move content blocks up and down the page to build rich, unique layouts.
To replicate Craft’s content blocks in WordPress, we use the repeater field available with the premium/pro version of the ACF (Advanced Custom Fields) plugin.
Content sections
Sections are added to the site according to your site’s IA (information architecture). This is how Craft works out-of-the-box.
WordPress comes with two sections: one for pages and one for posts (posts can be blog posts or news articles). We can add more sections using custom post types – for example, we might add a section for event pages or one for resources.
Drafts and revisions
Craft and WordPress offer drafts (to be published later) and preview URLs (which let colleagues review drafts without logging in).
Both Craft and WordPress store a page’s revision history (saved content changes). You can view and restore previous versions of the page in the editor.
Security
WordPress is notorious for getting hacked. It’s a victim of its own success, as its popularity is one of the reasons why it is targeted. Many attempts are automated mass attacks, so hackers focus on widely adopted platforms.
For example, one Craft website that we manage had 7,687 attempted visits to the (non-existent) WordPress login page URL (/wp-login.php) in less than five months.
The public CVE (Common Vulnerabilities and Exposures) database has more than 25,000 records for WordPress; there’s less than 1% of that number for Craft CMS.
WordPress plugins introduce most of the vulnerabilities. Craft has many of the features we need out-of-the-box, which minimises our reliance on plugins.
By default, Craft includes security measures that WordPress does not, like automatic CSRF (cross-site request forgery) token validation. Read Craft’s list of security practices.
Craft’s powerful config settings allow us to harden security further. For example, we disable admin changes on public sites, so malicious actors can not carry out major changes, like installing a plugin, in non-development environments. We replicate this behaviour in WordPress using a dependency manager (like Bedrock).
Craft allows CMS users to set up two-factor authentication (2FA), which is a very good measure against brute force attacks. We set up 2FA in WordPress with a plugin (like Wordfence).
WordPress security can be improved with good hosting, security plugins (like Wordfence), and regular updates. But as there are fewer installations of Craft, it is a less attractive target for hackers.
Plugins
A benefit of WordPress is that there are many cheap and free plugins available. But if the plugin developer is getting paid, they’re more likely to work on it (to add security patches or make the plugin compatible with the latest version of the core CMS).
WordPress plugins do not always do what they claim to do, and introduce bugs if they’re not compatible with other plugins.
With their large directory of tens of thousands of plugins, I’ve found that you can install several plugins before finding one that works.
The Craft plugin store is smaller, but it’s quality over quantity. Craft also lets you trial plugins on a staging site before purchasing a licence.
Maintenance
WordPress frequently release updates with security patches, which you need to install as soon as they’re released.
The same goes for WordPress plugins and themes – even if you’ve chosen ones that do not have security issues, they can be introduced if you do not update them as soon as new versions become available.
You could set updates to be installed automatically, but there are often compatibility issues between a plugin and the latest version of WordPress, so an update can break the website’s functionality.
Another reason we don’t install updates automatically is that we use a dependency manager (like Bedrock). We do this so the Git repository uses the same versions of the plugins and core CMS as the live site. And for security reasons, we need to make sure WordPress core and plugins can’t be modified in non-development environments.
Craft releases regular updates too, but the process tends to be smoother and less likely to cause unexpected issues.
Monthly updates are usually enough for a Craft website, but WordPress sites need extra maintenance and monitoring because you need to install the security patches straight away.
Accessibility
For William Joseph, website accessibility is not just something that’s required by law – it’s part of our mission to reduce inequality.
To make a website accessible, accessibility needs to be considered at the beginning of the project and continue throughout the design phase. The person creating and uploading the content also plays a huge role in making the site accessible (like writing in plain English and adding the image alt text and video captions).
However, there are some steps we can take as developers. Craft does not include any front-end code by default, which means we can write semantic HTML optimised for accessibility. We do not have to use third-party platforms or plugins to build a Craft website in an accessible way. And we can use WordPress in the same way.
Accessibility is not just about the people who visit the website – the people authoring the website also need to have an accessible experience. The developers who work on Craft audit new features for WCAG 2.2 compliance and include improvements with every release (read more information here, including their latest accessibility conformance report).
This is one of the reasons why the W3C, who develop the WCAG (Web Content Accessibility Guidelines), moved their website from WordPress to Craft (read its CMS selection report).
SEO
While SEO (Search Engine Optimisation) depends on many factors, your CMS contributes to on-site and technical SEO.
Technical SEO includes page load speeds, and as Craft does not include any front-end code by default, we can write clean code optimised for performance. We use WordPress in the same way (rather than using a third-party theme or page editor plugin).
Craft’s image transforms functions allow me to optimise each image depending on how it’s used. WordPress core has built-in image optimisation and three image sizes, which we enhance with a plugin (like Imagify).
Craft and WordPress both have great SEO plugins: Craft has SEOmatic, and WordPress has Yoast SEO.
SEOmatic is used by the SEO experts at Moz.com and lets you control your on-site SEO from the Craft admin area (including SEO page titles, JSON-LD microdata, and XML sitemaps).
Hosting
When it comes to hosting, WordPress and Craft are very similar:
Both are self-hosted, so you own all your website’s code and content (WordPress.org, not WordPress.com). Being self-hosted means you have to set up a hosting server for your website.
Both are LAMP stack applications (Linux, Apache, MySql, PHP), which is a very common setup, so you can use most cloud hosting servers.
There are hosting platforms with tools to help you install and maintain the CMS (like Craft Cloud or WP Engine).
Other features
Craft and WordPress both have the following useful features:
Form plugins that include payment processing integrations (like Stripe) and CRM (Customer Relationship Management) integrations (like Salesforce and DotDigital).
Multisite function for translated content and microsites.
CMS user groups with editable permissions.
Craft makes it easier to do the following tasks:
Build headless applications with Craft’s auto-generated GraphQL API.
Keep functions separate (instead of adding everything to the WordPress functions.php file).
Launch the site, as changing the staging subdomain to the public domain name is easy in Craft (the full URL is used in content in WordPress, so we need to edit these in the SQL database).
WordPress has the following features that content editors like:
Toolbar at the top of the front-end for users logged in to the CMS. There is a handy edit button in this toolbar that opens the page editor. In Craft, we replicate this by adding ‘cpEditUrl’ to the template.
Menu/navigation items are managed in the CMS. In Craft, we replicate this by using the Navigation plugin.
Summary
WordPress can be set up using a pre-made theme, making it a good low-budget option.
Craft CMS is a great fit if you want a bespoke website built around your design system and content model. You can get a comparable result in WordPress with a custom theme that uses the Bedrock boilerplate and the ACF PRO, Classic Editor, Timber and Wordfence plugins.
If you are planning a website project and want help deciding between WordPress and Craft, read our guide to choosing a CMS.