Website Platform Risk, Revisited

Platform risk occurs when your business relies on a third-party service provider. Typically, the concept of platform risk is applied to platforms like Facebook, YouTube, TikTok, or Google. These platforms allow you to build a branded profile and interact with their users. But these platforms aren’t the property of your business, and you could have your branded profile and audience ripped away without warning or recourse. Platform risk can also apply to software downloaded and run on your hardware, physical or virtual. WordPress in 2024 exposes your brand to platform risk.

WordPress is released under the GNU General Public License v2 and claims to provide “The four freedoms”: the freedom to run the program for any purpose, the freedom to study how the program works and change it to make it do what you wish, the freedom to redistribute, and the freedom to distribute copies of your modified versions to others. Taken at face value, this sounds amazing and doesn’t sound like platform risk at all.

But as with many things, the surface level can be deceiving. Much digital “ink” has been spilled, chronicling the litigation between WP Engine, Automattic, and the founder of WordPress, Matt Mullenweg. Unlike the earlier platform examples, the platform risk inherent in WordPress has nothing to do with corporate entities but is instead centered around Matt Mullenweg and his personal ownership and sponsorship of WordPress.org. Considered the official home of the WordPress Open-Source Software project, WordPress.org provides downloadable copies of the core platform, over 12,000 free themes to customize the look and feel of a WordPress site, over 60,000 free plugins to add functionality to WordPress, support forums, and the infrastructure for one-click updates with individual WordPress websites. Remember, this functionality is provided on a domain owned by Mullenweg, hosted on servers personally paid for by Mullenweg.

As Uncle Ben told us, “With great power comes great responsibility.” Providing update infrastructure for the software used by 43% of the websites on the internet is a great power. But we’ve also seen that “Absolute power corrupts absolutely” when millions of websites were cut off from receiving security updates at Mullenweg’s whim. Using software that can have critical functionality disabled by one person without warning is as significant a platform risk as using a Facebook account as your only online presence.

Option 1: fork and maintain the code yourself

What can you do to mitigate this platform risk and ensure that your brand’s online presence is safe, secure, and stable? The first option, and the most complicated, takes advantage of the GNU General Public License. Using the version of WordPress that you are currently using for your website, you can perform what’s called a fork, that is, you begin writing code to address any security vulnerabilities, address stability, and add new functionality to the platform to meet the needs of an evolving modern website. You can also clone the WordPress.org theme and plugin repository to replace the platform’s default connection to WordPress.org – a connection that is so critical to the functioning of WordPress that when WP Engine was blocked from accessing WordPress.org by Mullenweg, it became impossible to edit any content on the website. If that sounds like a lot of work, it is. The top 10 contributors to WordPress currently devote over 5,000 hours per week to the project.

Option 2: move to a hosted page builder

Platforms like Squarespace and Wix take software updates and server security off your plate, and for many small sites that's a reasonable trade. But you're renting. The vendor sets the price, the features and the code that loads on every page, and you can't take the site with you as it is. When we measured our own Squarespace site in October 2026, a large share of the code slowing it down was platform code we had no way to remove.

Option 3: own a plain site and have it maintained for you

The lowest-risk website is the simplest one: plain pages in a code repository you own, served from hosting in your own account, with no database, no plugins and no page builder. No single person or vendor can switch off your updates or change the rules on you. If you change developers, the new one picks up exactly where the last one left off.

The catch used to be that someone technical had to make every change, so plain sites went stale. That's the part that has changed. An AI agent can now take a change request in plain English, make it on a preview copy, check it on a laptop and a phone, and wait for your approval before anything goes live.

That's how we run berrybuckley.com today. We moved it off Squarespace in October 2026, and every change since has gone through a preview link and an approval. It's also what our Website Agent does for firms.

Three questions to ask about your own site

• If your web person left tomorrow, could you get your site back?
• Who decides what your site costs next year?
• Could you move it to another host or developer without starting over?

If any of those answers is "I'm not sure," the free First Agent Audit covers your website too.