The short answer: choose WordPress for a tight budget and a standardised website you manage yourself; choose Wagtail when the website carries your credibility, has to last and must remain your property. WordPress runs 40.2% of all websites and 58.8% of the sites whose CMS is known (W3Techs, 17 September 2026). Wagtail powers Google, NASA's Jet Propulsion Laboratory, the UK's NHS and the French State, which made it the base of its public websites. The comparison below was checked on 18 September 2026, with sources, including the cases where WordPress remains the right choice.
What changed in 2026
Both CMSs shipped major versions this year, and they are not heading the same way.
- WordPress 7.0 "Armstrong", released on 20 May 2026, adds an AI hub to the admin, a new dashboard and new layout blocks. Real-time collaboration, announced as the headline feature, was pulled twelve days before launch. WordPress 7.1 followed on 19 August, and 7.1.1 of 17 September 2026 fixes eleven security issues in the core (official announcements). The dispute between Automattic, the company behind WordPress, and the host WP Engine, opened in late 2024, is still running.
- Wagtail 7.4 LTS, released on 5 May 2026 and maintained until 2 November 2027, then Wagtail 8.0 on 25 August 2026. The latter opens the CMS to AI agents through a writable interface, without adding any magic button to the admin: "a CMS with AI, not an AI CMS", as Thibaud Colas of the Wagtail core team puts it. We detail the release calendar in our article on LTS releases.
WordPress: convenience, paid for in debt
WordPress has one immense merit: everybody knows it, and there is a theme or a plugin for everything. That is also its problem. A typical WordPress site rests on a pile of third-party extensions, each with its updates, its potential flaws and its conflicts. The usual outcome after three years: a slow, fragile site that nobody dares to update any more.
The 2025 figures from Patchstack, a WordPress security specialist, show the scale: 11,334 new vulnerabilities recorded in the WordPress ecosystem in one year, up 42%; 91% in plugins, 9% in themes, and only six in the WordPress core, all low priority. The core is healthy. What surrounds it is not.
Wagtail: architecture first
Wagtail is an open source CMS built on Django (Python), one of the most robust development frameworks on the market. The difference in philosophy is simple: instead of assembling plugins, the features are built to measure, in a clean architecture. Content blocks, page templates and connections to your tools are written for your project, not downloaded. Our full definition is in the glossary.
Wagtail publishes security advisories too, and it is better to know it: ten in 2026 as of 18 September, one of them rated high (fixed in 7.3.3 and 7.4.2). All of them require an account in the site's admin: none can be exploited by an ordinary visitor. The code has also been audited against the OWASP standards by independent auditors commissioned by the DINUM, the French State's digital directorate (Wagtail security page). The difference with WordPress lies in the process and the scope, not in an absence of flaws.
The comparison, criterion by criterion
| Criterion | WordPress | Wagtail |
|---|---|---|
| Getting started | Very fast (ready-made themes) | Custom development required |
| Day-to-day editing | Good, but interfaces cluttered by plugins | Clean interface built for your content, autosave since 7.3 |
| Security | Healthy core, 91% of 2025 flaws in plugins | Django base, smaller surface, advisories fixed before publication |
| Artificial intelligence | AI hub built into the admin since 7.0 | Optional (Wagtail AI extension); the CMS can be driven by your own agents since 8.0 |
| Cost of ownership over 5 years | Updates, plugin licences, fixes | Stable: few dependencies to maintain |
| Custom evolution | Limited by the plugin ecosystem | Free development, you own the code |
| Multilingual | Through third-party plugins | Native, designed in from the architecture |
| Accessibility | Depends on the theme and plugins | Admin targeting WCAG 2.2 AA (published conformance report), built-in checker for editors |
| Provider ecosystem | Huge | Smaller, more specialised |
Choose WordPress if...
Wagtail is not the answer to everything.
- Your budget is under EUR 5,000 and you accept a standardised website.
- You want to run the site yourself from A to Z, without a technical provider, on an off-the-shelf theme.
- You need a simple blog or a temporary site, with no strong credibility stake.
A well-built WordPress site beats a botched Wagtail one, for that matter. The CMS is not everything: quality comes from the architecture, the design and the rigour of whoever builds it.
Choose Wagtail if...
- Your website carries your commercial credibility and must last without a forced rebuild.
- You want to own the code, not rent a pile of plugins.
- Your project involves several languages, connections to your business software or genuinely custom templates.
- Security is an argument towards your own clients (accounting and legal professions, healthcare, institutions).
Cost of ownership, line by line
The purchase price says nothing about the real cost. Over five years, a plugin-heavy WordPress site accumulates annual licences for premium extensions (forms, SEO, caching, security...), emergency work when an update breaks a feature, and the internal time lost managing those incidents. Every plugin is an implicit maintenance contract nobody signed. Patchstack notes that 46% of the 2025 vulnerabilities had not received a fix from their developer by the time they were published: the risk does not depend on you.
A Wagtail site reverses the logic: the upfront investment is higher, but the base depends only on Django and your own code. Updates are planned, for instance at each LTS release, not suffered. Over the life of the site, the two curves cross well before the fifth year for an active professional website. Price ranges are in our article on the cost of a website in Belgium.
Security, in figures
WordPress's security problem is its supply chain: thousands of plugins of uneven quality, maintained (or not) by third parties. Still according to Patchstack, 1,966 vulnerabilities in 2025 were rated high severity, meaning likely to be targeted by mass automated attacks, and about half of the high-impact ones are exploited within 24 hours of publication. Every plugin added is one more door to watch.
Django, the foundation of Wagtail, is a framework whose reputation was built on rigour: built-in protection against the classic attacks, a serious patch cycle, and above all, on a custom site, only the code you need. Fewer doors, less monitoring, fewer bad surprises. We cover the subject in Is Wagtail secure?.
AI in both CMSs
WordPress 7.0 puts AI at the heart of the admin: a central hub to switch on AI capabilities in the site. Wagtail makes the opposite choice: nothing imposed in the interface, a Wagtail AI extension if you want generated alt texts, summaries or quality checks, and since 8.0 an interface that lets an AI agent create, edit or publish content with the same rights as a user. For an organisation that wants to keep control of what AI touches, the second approach is easier to govern.
What about the other options?
The question is not limited to these two. No-code platforms (Webflow, Wix, Squarespace) are legitimate for an entry-level website: fast, hosting included, but you remain a tenant, with the limits of the engine and prices that change without you. One exception: entry-level sites generated by AI rather than built on a platform, where the code produced belongs to you. Drupal plays in Wagtail's league for robustness, with a steeper learning curve. Our reading grid is simple: on an entry budget, a well-executed no-code site; as soon as the website carries your credibility and has to last, custom work that you own.
What it looks like in practice
This is the choice we have made since 2016: ten years of Wagtail projects, often multilingual, often demanding. A telling example: the website of Venn Telecom, a sharp technical offer (satellite, 5G, bonding) made readable for several audiences, on a base their team keeps alive themselves.
And if you start from an ageing WordPress, the migration is prepared: content taken over, redirects, visibility preserved. The full method is in this article. Unsure about your own website? Describe your project, and we will tell you whether Wagtail is justified, or not.