All of these points are valid, none of them are unique to the Wordpress solution.<p>If you&#x27;re writing a reasonably complex CMS, <i>you</i> will create security flaws you can fly a 747 through. This is doubly true if the CMS isn&#x27;t the end goal and rather a necessary dependency for what&#x27;s actually needed.<p>The only guard against security holes is battle-testing your code - Wordpress may not be the most secure thing in the world, but it&#x27;s likely more secure than something you can whip up yourself in a jiffy.<p>Ditto maintenance and obsolescence - in fact this problem is probably <i>worse</i> for a homebrew solution than WP, since the number of people qualified to maintain this homebrew codebase is approximately one, whereas you can actually hire for WP plugin maintainers if you need to. Likewise, homebrewing your own solution and then moving onto the next project <i>literally means it&#x27;s not being maintained from day one</i>, which is strictly worse than even a casually maintained plugin.<p>WP installs aren&#x27;t always the right solution, nor is deploying some off the shelf code, but choosing to write your own code needs to pass a higher standard than is normally applied in most companies - it&#x27;s silly to complain that some open source thing might stop being maintained when by default what you write yourself is also not actively maintained ;)