Oct 15, 2026 · Marc Price · ai-marketing-automation · 12 min read

The Make-Work Tax: What Your 'Free' CMS Really Costs the Marketing Team

WordPress is free the way a puppy is free. Plugins, patches, caching and hosting quietly eat marketing hours every week - and the CMS is only the first line on the bill.

TL;DR

WordPress is free the way a puppy is free. The licence costs nothing; the upkeep never stops. Plugin updates, security patches, caching layers, hosting tickets and the quiet dread of the white screen after an update all land on the marketing team, who did not sign up to run infrastructure. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins, and the enterprise alternatives simply invoice for the same make-work at a higher rate. A modern static approach, which we have written about before, removes most of that overhead in one move: faster launches, faster pages, a much smaller attack surface and almost nothing left to patch. The same logic then applies to the rest of the marketing budget, where agencies, ad management and research retainers are largely paying for routine work that an AI assistant with access to your own data now does in-house.

Why does a free platform cost so much to run?

Because “free” describes the download, not the job.

Your team is good. Your site is fine. But WordPress is a general-purpose engine, and every capability you actually need arrives as a plugin: forms, SEO, caching, security, backups, the page builder, the cookie banner. Each one is a small piece of third-party software with its own release cycle, its own bugs and its own idea of what the others are doing. Someone has to press update, check nothing broke, and roll back when it did. That someone is usually in marketing.

The scale of it is measurable. Patchstack’s State of WordPress Security in 2026 report logged 11,334 new vulnerabilities in the ecosystem during 2025, a 42% rise on the previous year. 91% were in plugins and 9% in themes. WordPress core accounted for six. Worse, 46% of vulnerabilities were public before a fix existed, and for the heavily exploited ones the median time from disclosure to mass exploitation was five hours. The hosting firewalls people assume are catching this blocked 12% of WordPress-specific attacks in Patchstack’s first test and 26% in the second.

None of this is a reason to feel bad about the site you have. It is a description of the market you are now in: a platform whose surface area grows with every plugin, and an attacker community that automates against it. The licence is free. The exposure, and the hours spent managing it, are not.

Do the big platforms fix this, or just charge for it?

They charge for it.

Move up the ladder and the make-work does not disappear; it gets a contract. Sitecore subscriptions are commonly quoted at $75,000 a year and upwards before anyone has built a page, with implementation on top. Drupal is open source and excellent, and it still reached the end of life for version 7 in January 2025 with a large share of its estate unmigrated. In September 2026, of the 526,150 Drupal sites reporting to drupal.org, only 346,011 were on the supported 10 or 11 releases; roughly a third were on versions that no longer receive security fixes, with a paid extended-support market growing up around them. Two years of “we must migrate” on a marketing roadmap is a cost, whichever line it sits on.

The developer-focused platforms are at least honest about it. Craft charges $399 per project and $99 a year for updates; Kentico quotes per channel. Neither number is the real cost. The real cost is that every change beyond the content editor needs a developer, a staging environment, a deployment and a test, and the marketing team waits.

Whatever the platform, the pattern is the same: a dynamic system assembled on a live server, with a database and an admin login on the public internet, needs feeding. The question is not which brand of upkeep to buy. It is whether you need the upkeep at all.

What does a modern build remove?

Most of the list.

We set out the JAMstack approach in January, so this is the short version. Pages are built in advance and served as finished files from a global edge network. There is no database on the public site, no admin login to brute-force, no PHP and no plugin runtime to patch. Content lives in a Git-backed CMS, so every edit is a reviewed, auditable commit rather than a change to a live database, and a bad edit is one revert away from undone. The hosting is a content delivery network, which is faster than any single server can be and costs a fraction of managed WordPress.

Three things follow, and we see all three on every build:

Time to launch shrinks. With a component system and content that migrates programmatically, the build is measured in weeks. On the largest one we completed this year, five separate WordPress sites for a global financial-technology firm became one rebranded platform of over 600 pages, with more than 500 legacy articles migrated by script rather than by hand, and the site went live ahead of the brand launch date.
Performance jumps. Those five old sites scored in the 30s to 50s on mobile. The new one launched at 96 to 100 across every page template, with accessibility and best practice at 100 and zero layout shift. That is not tuning. It is what serving finished pages from the edge does by default.
Security stops being a weekly task. The firm’s infrastructure and security team signed off the architecture precisely because there was so little of it exposed. The CMS sits behind their own single sign-on. There is nothing on the public site to update on a Tuesday night.

The maintenance overhead does not go to zero. Dependencies still get bumped and the build still needs someone who understands it. But it becomes a scheduled engineering task rather than a standing marketing anxiety, and the team’s time goes back to the content.

There is a second-order benefit that matters more every month. Buyers now start their research in ChatGPT, Claude and Perplexity as often as in Google, and those systems shortlist from what they can reach. Plain, fast, well-structured pages with schema on every one are what they read and cite. A static build produces that as a by-product.

Where else is the marketing budget paying for make-work?

Almost everywhere a recurring fee buys recurring admin.

Once you see the CMS this way, the rest of the stack looks similar. Gartner’s 2025 CMO Spend Survey puts marketing budgets at 7.7% of company revenue, flat for a second year, with agencies taking 20.7% of that spend and 39% of CMOs planning to cut agency allocations. Gartner’s separate martech survey found marketers actively use 49% of the capability they pay for. Half the stack is idle, and a fifth of the budget goes to third parties to operate the other half.

Look at what those retainers actually buy:

Paid media management commonly costs 10 to 20% of ad spend. A large share of the work is monitoring, bid adjustment, budget pacing and the monthly report.
SEO retainers average $3,209 a month at agencies, per Ahrefs’ survey of 439 providers. Much of the deliverable is rank tracking, technical audits, content briefs and the same monthly report.
Research and monitoring subscriptions deliver a digest of what competitors and the market did last week, assembled by someone reading sources you could name yourself.

Every one of those is a person doing repetitive, rules-based work on data you already own. That is exactly the category of work that AI now does well, and does inside the business rather than at an agency. We run our own marketing this way: a weekly radar that reads the sources, drafts the analysis and proposes the angles; a drafting routine that turns those angles into posts for review; performance audits that arrive as reports rather than tickets. A person still decides. The grind is gone.

The pattern generalises. Give a Claude-based assistant, what we call a business brain, governed access to the analytics, the ad accounts, the CRM and the site repository, and the monthly agency report becomes a Monday-morning brief. The bid adjustments become a rule it applies and a human approves. The technical SEO audit becomes a build check. The tools you keep start talking to each other instead of needing a human bridge, which is where most of the idle 51% comes from in the first place.

This is not about making the team smaller. It is about giving the people you have their afternoons back, and pointing them at the work that needs judgement: positioning, offers, the argument on the page. The businesses that get there first will simply move faster than the ones still pressing update.

The Bottom Line

The free platform was never free, the enterprise platform charges rent for the same upkeep, and a good part of the agency budget is paying humans to do what software now does in-house. None of that reflects on the quality of your marketing. It reflects on how quickly the ground has moved.

Do this in the next quarter:

Count the hours. For one month, log every hour the team spends on plugin updates, caching problems, hosting tickets and “the site is doing something odd”. Put a salary rate against it.
List every retainer and what the last three deliverables actually were. Mark each one as judgement work or routine work.
Score the site on mobile. If it is in the 30s to 50s, you are paying a performance tax on every visitor and every AI crawler.
Cost a static rebuild against the next twelve months of the current upkeep, not against zero.
Pick one routine deliverable, a report or an audit, and have it produced in-house by an AI assistant with access to the data. Compare it to the agency version.

The make-work will keep arriving as long as you keep the systems that generate it. The businesses pulling ahead are not working harder at it. They stopped feeding it.

If you would like the hours-and-retainers audit above done for you, it is a two-hour exercise we run regularly. Book a discovery call and we will walk through where your marketing budget is buying admin.

Frequently Asked Questions

Is WordPress really a security problem, or is that vendor scaremongering?

It is a measured problem. Patchstack logged 11,334 new vulnerabilities across the WordPress ecosystem in 2025, up 42% on the year before. 91% were in plugins, only six were in WordPress core, and 46% were public before a fix existed. The platform is fine; the plugin estate you bolt onto it is where the exposure lives.

What does a JAMstack site actually remove from the maintenance list?

The database, the admin login on the public site, the plugin runtime and the patch cycle that goes with them. Pages are built in advance and served as static files from a global edge network, so there is nothing running on the public site to update, cache or harden. Content edits become reviewed commits rather than live database changes.

How much faster is a static site in practice?

On the most recent rebuild we did, five WordPress sites that scored in the 30s to 50s on mobile were consolidated into one platform that launched at 96 to 100 across every page template, with accessibility and best practice at 100. The gains come from serving finished pages from the edge rather than assembling each one on a server.

Are enterprise platforms like Sitecore or Drupal a safer bet than WordPress?

They swap one kind of cost for another. Sitecore subscriptions are commonly quoted at $75,000 a year and up before implementation. Drupal 7 reached end of life in January 2025, yet in September 2026 roughly a third of the 526,150 Drupal sites reporting to drupal.org were still on versions that no longer receive security fixes. Big platforms make work too; they just invoice for it differently.

Where else is a marketing budget leaking in the same way?

Anywhere a recurring fee buys recurring admin. Agencies take 20.7% of marketing spend per Gartner’s 2025 CMO survey, with 39% of CMOs planning to cut that. Typical SEO retainers average $3,209 a month and paid-media management commonly runs at 10 to 20% of ad spend. Much of what those fees cover is reporting, monitoring and routine optimisation - exactly the work a well-set-up AI assistant with access to your data now does in-house.

References

Marc Price is the founder of Aandai, a B2B automation and AI consultancy helping mid-market businesses achieve more with less. With 25+ years in B2B technology marketing and web development, Marc specialises in connecting legacy systems, eliminating manual processes, and implementing practical AI solutions that deliver measurable ROI. Aandai runs its own agentic stack on OpenClaw to automate parts of its consultancy delivery - including the research that informed this article, and the site it is published on.