Custom ASP.NET Core site vs WordPress: which to choose?

Many small business websites are built with WordPress, and they work. But when someone asks me why their site is slow, why it keeps getting attacked or why Google doesn't show it, the answer usually lies in how it's built. Here I compare, with figures and real cases, a typical WordPress site with a custom ASP.NET Core site, the Microsoft technology I work with. I'll also say when WordPress is still a good choice.

Speed: what the data says

According to the HTTP Archive Core Web Vitals Technology Report (real Chrome user data, CrUX), as reported by Search Engine Journal on 27 May 2026 using April data, around half of WordPress sites (about 49%) get a good Core Web Vitals score: last of the 7 platforms compared.

Why does WordPress tend to be slower?

• Every page is assembled on every visit: PHP queries the database and builds the HTML, unless you add a cache plugin.
• Every theme and every plugin brings its own CSS and JavaScript, which add up on each page.
• Page builders generate heavy markup, full of nested containers.

ASP.NET Core works differently: the C# code is compiled, it runs on Kestrel, Microsoft's web server, and the HTML is generated on the server with only what that page needs. You control every byte that reaches the browser.

Real case: Bosques de Loncotraro

Bosques de Loncotraro is a set of cabins between Villarrica and Pucón. Their old site was WordPress with a booking plugin (WP Booking Calendar). I rebuilt it in ASP.NET Core, with its own booking system and Webpay payments. In practice:

• Brotli and Gzip compression handled by the app itself, because the IIS server had none. The main stylesheet goes from about 96 KB to about 15 KB once compressed.
• Cache headers: images for 30 days, CSS and JavaScript for a year, with a version hash in the URL.
• Photo thumbnails generated automatically, on demand.

Server response time is about 300 ms (Lighthouse on mobile, 7 October 2026).

Security: fewer parts, fewer doors

According to Patchstack's State of WordPress Security in 2026 report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, up 42% on the previous year. 91% were in plugins and 9% in themes.

A custom ASP.NET Core site has no third-party plugins or themes, and no /wp-admin, /wp-login.php or /xmlrpc.php for bots to attack. The attack surface comes down to the code written for that site plus the framework Microsoft maintains. My .NET sites receive WordPress attack probes every day and block them immediately. I go into detail in is WordPress safe?.

Indexing: what Google receives

With HTML generated on the server, Google gets the full text on the first request, without depending on JavaScript rendering. It's the opposite of builders that assemble the page with JavaScript only, as I explain in sites built with AI or Wix. On top of that, I have full control over:

• Clean URLs, with a title and description of their own for every page.
• Canonical and hreflang for each language.
• JSON-LD structured data for each page type.
• A sitemap generated from the database: Parcelas Patagonia regenerates its own automatically every day, and the one for jeromestephan.com lists 119 URLs in 3 languages.
• IndexNow, which I use on FindYourNeurotype to notify Bing as soon as a page is published.

Switching platforms doesn't have to cost you rankings either: the old WordPress addresses on Bosques (for example /wpbc-booking or /pagar-reservas) redirect with a 301 to the new pages (/reservar). If Google isn't showing your pages, read why Google isn't indexing a site and Google Search Console step by step.

Quick comparison

When does WordPress make sense?

To be fair: for a simple blog or a brochure site, WordPress works well with good hosting, a few well-maintained plugins and regular updates.

A custom site costs more upfront. In return, you pay for exactly what you need, with no plugin licences, and maintenance is handled by the developer. It makes most sense when the site is a working tool for your business: bookings, payments, several languages or a database.

In short

With ASP.NET Core you control speed, security and what Google reads, as long as you measure (here's how I do it with AI, Search Console, Analytics and Bing). Want to know how your current site compares? Get in touch and I'll review it for free, or explore my website, custom software and SEO services.