Headless
WordPress and WooCommerce

WordPress that does the job.

New WordPress sites, WooCommerce stores and headless builds, or a serious upgrade of the one you already run.

We audit, build and keep optimising, inside a martech team with digital legal, SEO & GEO and analytics specialists. So your site launches compliant, findable and measured, not just live.

9 yearsbuilding on WordPress
20people in our web team
NPS 62client survey, quality of work
ISO 9001 · 27001certified quality and information security
WordPress, in plain wordsLevel 1 · Plain words

The engine behind a huge share of the web.

WordPress is free, open-source software for building and running websites. You host it where you choose, your team edits pages in a visual block editor, and plugins add almost any feature, from forms to a full online store with WooCommerce.

It runs about 40% of all websites, and close to 6 in 10 of the sites built on a known CMS (W3Techs, 2026). Its share has slipped from its peak as hosted builders grow. So we call it what it is: still the largest open ecosystem, not the default answer to everything.

An open platform you own, for sites where content, reach and control matter.

  • What it isOpen-source code, your content and database, on any host. No licence fee for the software.
  • When it fitsContent-led and SEO-driven sites, multilingual estates, content with commerce, custom integrations.
  • What we doBuild new sites, stores and headless front ends. Audit, repair and speed up the one you have.

Pick the platform that fits. Not the one that pays us. WordPress is our default for many content-led and lead-generation sites, which is why it anchors our Websites service. When another platform fits better, we say so, further down this page.

Two ways inLevel 1 · Plain words

Build it new. Or make what you have better.

Most WordPress agencies only sell the rebuild. Often the smarter move is to fix the site you already have. We do both, and we will tell you which one pays.

Path A · New build

Start clean, built for the job.

A new WordPress property designed around what it must achieve: leads, sales, reach or reputation.

  • Corporate and brand websites
  • Lead-generation sites and landing pages
  • Content hubs and publications
  • WooCommerce stores, B2C and B2B
  • Multisite networks for brands or countries
  • Headless front ends on a WordPress back end
  • Interactive and gamified campaign experiences
  • Member areas, portals and knowledge bases
How it starts: discovery, a content model and a clickable working version within the first sprints.
Path B · Existing site

Keep what works. Fix what costs you.

Your current WordPress, made faster, safer, more visible and better at converting, often without replatforming.

  • Full audit: speed, security, SEO, accessibility, tracking
  • Core Web Vitals and speed programme
  • Security hardening and plugin clean-up
  • SEO and GEO fixes for search and AI answers
  • Conversion work on the journeys that pay
  • Tracking, consent and dashboards rebuilt properly
  • Redesign without replatforming
  • WordPress 7 and PHP upgrades, agency takeovers
How it starts: we review what you have first, then rank the fixes by business impact and effort.

Worried about a rebuild you do not need? We will tell you when fixing is enough.

Talk to our specialists →
What we buildLevel 2 · Business

Classic, commerce or headless. One core, three shapes.

How you run WordPress changes the cost, the speed and what your team can do alone.

Most sites

WordPress, block theme

The modern way to run WordPress: a custom block theme and a design system your editors cannot break.

Best for
Corporate, lead-generation, content hubs, multilingual sites.
What we build
A custom block theme with a theme.json design system, locked patterns so marketing ships pages on brand, and custom blocks where it matters.
Trade-off
It needs disciplined updates and a small, vetted set of plugins. We handle both.
Content and commerce

WooCommerce

An online store inside WordPress, so content and commerce share one site, one account and one data set.

Best for
Stores where content sells, B2B price lists and quotes, full data ownership, local payments and invoicing.
What we build
Block checkout, modern order storage, Multibanco and MB Way through local gateways, certified invoicing, ERP and PIM sync. See our E-commerce shops work.
Trade-off
You run what a hosted platform would run for you: hosting, updates and performance. Worth it when control matters.
Speed and many channels

Headless WordPress

WordPress as the editorial back end, with a separate front end that reads content through an API.

Best for
High-traffic brand sites, app-like experiences, and many front ends fed by one content hub.
What we build
REST API or WPGraphQL, a Next.js or Astro front end, previews that actually work, on cloud infrastructure we can run for you.
Trade-off
Two stacks, higher cost, and many plugins stop helping on the front end. We often recommend a hybrid instead.

Need software people log into, like a portal or product with its own logic? That is often better as a web app, with WordPress kept for the content.

Use cases, in business termsLevel 2 · Business

Nine ways WordPress earns its keep.

We sell outcomes, not installs: each pattern names the result it is built to move, measured from day one.

01

Expertise nobody finds? Build a content hub that ranks and gets cited.

We buildTopic clusters, schema per template, clean block HTML and internal linking.

Moves: organic reach, AI citations, content leads
02

Many brands or countries? Run one network.

We buildMultisite with one design system and locked patterns, so local teams publish in PT, ES or EN.

Moves: cost per site, time to launch a market
03

Paying for a proprietary CMS? Move to one you own.

We buildContent model, URL mapping, redirects and SEO parity checks before cutover.

Moves: run cost, time to publish, rankings kept
04

Forms landing in an inbox? Wire leads to the CRM.

We buildProgressive forms and consent-aware tracking, with lead source flowing into HubSpot or Salesforce.

Moves: qualified leads, cost per lead
05

Selling in Portugal? A store that just works.

We buildWooCommerce with Multibanco and MB Way, certified invoicing, carriers and ERP sync.

Moves: checkout conversion, back-office hours
06

Distributors ordering by email? Give them a portal.

We buildCustomer prices, quotes, quick reorder and ERP and PIM integration on WooCommerce.

Moves: order cycle time, sales team time
07

Traffic that never reaches the shop? Make content sell.

We buildProduct blocks inside articles and one cart across content and store.

Moves: revenue per visit, order value
08

Slow, bloated site? Rescue it.

We buildAudit, plugin diet, a block theme or targeted refactor, caching and an image pipeline.

Moves: Core Web Vitals, conversion, hosting cost
09

Campaigns waiting weeks for a page? Build a factory.

We buildBlock patterns with tracking pre-wired, test-ready for our CRO team.

Moves: time to launch, cost per acquisition
The differenceLevel 2 · Business

Our builders sit inside a martech team.

Most WordPress specialists are design and development studios. Most big martech players do not build. We sit in the gap: a web team of 20 working every day with our digital legal, SEO & GEO and analytics & consent specialists.

It is the best of a great team, frameworks, technology and proprietary data, aimed at your business results. On WordPress, that looks like this.

20

The build team

Design, front end, back end, QA

Custom block themes, blocks and plugins, WooCommerce, headless front ends, migrations and care. The people who write the code also sit in the meetings about results.

ExampleA custom block with locked styles, so editors change the content, never the design.

Digital legal

GDPR, consent, EAA, AI Act

The consent platform wired to the WP Consent API, privacy, cookie and terms pages that match what the site really does, accessibility tests for the EAA, and AI Act duties flagged.

ExampleA forms plugin sending visitor IPs to a third party before consent: blocked until consent, or replaced.

SEO & GEO

Search and AI answers

Architecture and URLs before the first template, redirect maps for migrations, clean HTML from blocks, llms.txt where useful (still experimental). Then the ongoing SEO and answer engine work that gets you cited.

ExampleArticle, Product, FAQ and Organization schema generated per template from the block content.

Analytics & Consent Mode

Numbers you can trust

GA4 and Google Tag Manager, server-side tagging, Consent Mode v2 wired to the banner, WooCommerce ecommerce events, form and CRM tracking, and CRM data flowing to HubSpot or Klaviyo, with our Analytics & Measurement team.

ExampleServer-side tagging on Google Cloud, with WooCommerce purchase events deduplicated between browser and server.

On a WordPress project
Typical WordPress studio
Typical martech agency
Wise Pirates
Custom WordPress and WooCommerce build
Yes
Rarely builds
Yes, in-house
Legal review of plugins, consent and terms
Rarely
Sometimes
Digital legal team
SEO and GEO designed into the architecture
Partly
After launch
From the first sketch
Server-side tracking and Consent Mode v2
Rarely
Yes
Yes, built in
ISO 9001 and ISO 27001 certified delivery
Rarely
Varies
Both
A general market read, not a claim about any named company.
NPS 62Client survey on the quality of our work
ISO 9001 · 27001certified quality and information securityAccess control, supplier review and incident plans, applied to your site too.
500+Brands served by Wise Pirates since 2017
How we workLevel 2 · Business

Audit. Build. Optimise. Then go again.

We are strong at all three, and the value is in the loop: every optimisation feeds the next build.

01

Audit

What is slow, risky, invisible or leaking

Speed, plugin and security risk, SEO and GEO, accessibility, tracking and consent, and the conversion journeys. Output: a fix list ranked by impact and effort.

02

Build

Working versions, early

A new site, a new store or targeted fixes, shipped in short sprints to a staging site you can click from the first weeks.

03

Optimise

Measure, test, improve

Core Web Vitals, conversion tests, content and GEO, security patches and updates on a schedule. What we learn becomes the next audit.

Process, without the bureaucracy.

We have frameworks for every stage, and we stay agile. We use AI and modern tooling to move faster, with human review on everything that ships.

  • Short sprintsOne to two weeks, each with a clear goal.
  • Early versionsA working site on staging long before launch.
  • Weekly demosWith the people who decide, not just the project lead.
  • Decisions in writingOne place, so nothing gets re-argued.
  • One visible backlogYou see it, and you can reorder it.
Nine years on WordPressLevel 2 · Business

Nine years of WordPress. We know what breaks.

We started in the classic-editor era and have shipped through every major shift since. The number is 9. The value is what it taught us.

  1. 2017Our startClassic editor, page builders everywhere. We learned their real cost later.
  2. 2018WordPress 5.0The block editor arrives. Content becomes structured blocks.
  3. 2020WordPress 5.5Auto-updates for plugins and themes, XML sitemaps and lazy-loaded images in core.
  4. 2022WordPress 5.9Full site editing and block themes. Design systems move into theme.json.
  5. 2023WooCommerceOrders move to dedicated tables. Faster stores, careful migrations.
  6. 2024EcosystemA governance dispute makes host neutrality a buyer question.
  7. 2025WordPress 6.9The Abilities API lets software and AI agents see what a site can do.
  8. 2026WordPress 7AI Client and Connectors in core, and a redesigned admin.

Every plugin is a dependency you now own.

It adds features, and also updates, risk and weight. We keep the list short and every entry justified.

Page builders are the new lock-in.

Easy on day one, expensive to leave. Native blocks keep content portable and pages fast.

Speed is decided before the first line of code.

Hosting, theme choice and plugin count set the ceiling. Optimisation only gets you close to it.

If editors hate the admin, the site dies slowly.

So we design the editing experience as carefully as the front end, with patterns and guardrails.

The plugin supply chainLevel 3 · Platform

WordPress risk lives in what you add.

WordPress core is rarely the problem. Patchstack's 2026 security report counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025. 91% were in plugins, 9% in themes, and only six in core. The same report warns that many high-impact flaws are attacked within hours of disclosure.

So we run plugins like a supply chain: fewer, vetted, monitored, and virtually patched when no fix exists yet. The radar shows how our audit works.

THEMES PLUGINS themechild themeformsSEOcacheslidergallerybackupsecurityCRM synccookiespage builderpopupsshop add-onreviewsmapssocial feedanalyticsredirectsmultilingualeventssearch WP CORE
01ScanInventory every plugin and theme, match versions against vulnerability data.
02HardenRemove what is unused, update what is outdated, patch what is exposed.
03MonitorNew disclosures get a virtual patch while the vendor ships a fix.
0Active plugins
0Known vulnerable
0Outdated
0Unused
Scan. Building the inventory and checking every version.
HealthyOutdatedVulnerableUnusedPatched or updated

An illustration of how our audit works, not data from a real site. The proportions follow the pattern in the Patchstack report: the risk sits in the outer ring.

A plugin dietAn approved list, a reason for every entry, and fewer vendors to trust.
Monitoring and virtual patchingVulnerability feeds and firewall rules that block an exploit before the fix exists.
Tested updatesA written update policy, staging first, automated checks, then production.
Locked-down access2FA or SSO, least-privilege roles, file integrity checks and audit logs.
AI and agentsLevel 3 · Platform

From blocks to abilities.

WordPress is becoming something AI agents can use, not just read. Version 6.9 added the Abilities API, a register of actions a site can perform, described so software can discover and call them. Version 7.0 added a native AI Client and Connectors for the model provider you choose. The MCP Adapter exposes abilities to AI assistants and coding agents.

That makes a new build decision: which abilities to expose, to whom, and with which permissions. We map each one to a WordPress capability, keep publishing and money behind a human, and log what agents do.

Your blocksYour site
Heading
Paragraph
Image
Query loop
Button
Abilities APIWhat it can do
get-postread
update-alt-textupload_files
create-draftedit_posts
publish-postpublish_posts
Each ability is mapped to a permission. Anything that publishes or moves money waits for a person.
AI agentVia MCP Adapter
Add alt text to the new images, then draft a summary and publish it.
Guardrail log. Every ability call is checked against a permission, then logged.

Illustrative flow. Ability names are examples: which abilities a site exposes, and to which agents, is a decision we make with you in the build.

Stores

WooCommerce, agent-ready

WooCommerce has started exposing store abilities through MCP, as a developer preview. Agentic checkout protocols are on the roadmap, so we design for them without betting your checkout on them.

Editorial

AI that follows your rules

Alt text, summaries and translations drafted by AI, reviewed by people and held to your brand rules. Core is adding AI content guidelines in the 7.x releases; we use what your version supports.

Choice

Your model, your contract

Connectors keep WordPress provider-agnostic. Our AI Enablement team helps you choose, govern and train the team.

Where agents meet martech

Agents are data processing. We treat them that way.

Consent and logs, for agents tooAgent actions respect the visitor's consent state, run under a named role and land in the same audit log as any other processing. Our digital legal team reviews what agents may touch.
Which AI crawlers may read youA joint call by SEO & GEO and digital legal: visibility in AI answers against reuse of your content, set in robots rules and at the CDN, and reviewed as the market moves.
PerformanceLevel 3 · Platform

Fast WordPress is a set of decisions, not a plugin.

WordPress usually does well on interactivity and loses on loading. It is fixable, and one of the highest-return jobs in any audit.

Under half

of WordPress sites pass all three Core Web Vitals, usually failing on loading.

LCP 2.5 sLoading, the usual gap
INP 200 msInteractivity
CLS 0.1Visual stability

Google's "good" thresholds, at the 75th percentile of real users. We use them as budgets: checked in lab tests before every release and in field data after it.

Pass-rate source: Chrome UX Report data compiled by third parties, 2026. Figures vary by month and method.

1Hosting and PHPEU region, PHP 8.3 or newer, workers sized for peaks.
2Page cache and CDNEdge caching, with clean rules for logged-in users and carts.
3Object cacheRedis or Memcached, so repeated queries skip the database.
4Theme and blocksA lean block theme, not page-builder layers.
5Images and fontsAVIF and WebP, a preloaded hero, self-hosted fonts.
6Plugins and scriptsFewer plugins, tags server-side, speculative loading.

WooCommerce at scale

  • Modern order storage, migrated safely
  • Block checkout, extended the supported way
  • Product object caching from WooCommerce 11
  • Search off the main database for big catalogues
  • Background jobs, so shoppers never wait
For the CTOLevel 4 · CTO

The questions your CTO will ask. Answered.

How we build WordPress when it has to pass security reviews, survive traffic peaks and still be maintainable in five years. Three answers matter most.

01

Security

Supply-chain thinking, ISO 27001 discipline.

  • Plugin approval list, Composer lock files, vulnerability monitoring
  • Web application firewall and virtual patching
  • SSO or 2FA, least-privilege roles, audit logs
  • File integrity checks and a written incident plan
02

AI and agent readiness

Useful to agents, safe by design.

  • Abilities API and MCP Adapter, exposed on purpose
  • AI Client and Connectors, with the provider you choose
  • Agent permissions mapped to WordPress capabilities
  • Every agent action logged, humans approve the rest
03

The exit door

Among the lowest lock-in of the major site builders. We keep it that way.

  • GPL code and custom plugins in your repository; content exports plus the database
  • No page-builder shortcodes that trap content, no premium plugins nobody else can maintain
  • Composer lock files and a private mirror, with the FAIR package manager (Linux Foundation, still emerging) as a hedge against single points of control
  • Host-neutral by default, so no single company in the WordPress ecosystem controls your site

Migrations in five steps

  1. InventoryEvery URL, template, media file and user, with traffic and links.
  2. MapOld content mapped to the new model, and a full 301 redirect map.
  3. ImportScripted with WP-CLI, using WordPress Data Liberation and Playground tooling where it fits.
  4. Parity checkTitles, schema, canonicals and hreflang compared before cutover.
  5. CutoverA monitored launch, Search Console and logs watched, fixes queued.
More detail
ArchitecturePHP with MySQL or MariaDB, a block theme with theme.json, custom React blocks, Block Bindings to custom fields, business logic in plugins, never in the theme.
Hosting and the enterprise pathEU regions on managed WordPress or Google Cloud, with tested restores. For high-traffic or regulated estates, WordPress VIP adds SLAs of up to 99.99% and code review: right for some, overkill for most.
Code and deliveryGit, Composer and WP-CLI; dev, staging and production with CI/CD; coding standards, PHPUnit and Playwright; configuration in code.
PerformanceThe Core Web Vitals budgets above, checked in lab tests before every release and in field data after it; load tests before launches and campaigns.
Headless, done rightPreviews and drafts that work, cache invalidation on publish through webhooks to the front end, and an honest list of plugins that stop helping, such as page builders and front-end form or SEO features.
Integrations and APIsREST API, WPGraphQL, WooCommerce REST and Store API; webhooks and queues for CRM, ERP and PIM, Klaviyo and marketplace feeds.
MultilingualOne site with a translation plugin, or Multisite with a site per locale. Hreflang, localized slugs and per-market SEO either way; we choose by team structure and content overlap.
Governance at scaleRoles and workflows, review with Notes, locked patterns, the DataViews admin, Multisite rules to limit the blast radius, PHP 8.3 or newer as the target.
AccessibilityWCAG 2.2 AA tests on theme, blocks and checkout, with keyboard, screen reader and contrast checks, and accessible patterns for editors.
For technical buyers

Send us your CTO's questions. We answer them in writing.

Specific answers for your stack. Talk to our specialists to see how this applies to your case.

Let's talk →
When it is not WordPressLevel 4 · CTO

When WordPress is not the right fit.

We are platform-agnostic by default, so we can say this out loud. Here is when we would point you somewhere else.

Already on WordPress?

Talk to our specialists before you change anything.

Auditing is one of our specialties. On a new project it is usually the first step: we review what you have before we build or change anything. Talk to our specialists to see how this applies to your site.

FAQ

WordPress, answered.

Is WordPress still worth it in 2026?

Yes, for content-led, multilingual and SEO-driven sites. It still runs about 40% of all websites, and close to 6 in 10 sites on a known CMS, but its share is slipping as hosted builders grow. So choose it for fit, not habit: when you want to own the platform, publish a lot, or combine content with commerce.

How much does a WordPress website cost, and how long does it take?

A focused WordPress site starts in the low thousands of euros, a custom design with integrations runs into the tens of thousands, and large multilingual, Multisite or integrated WooCommerce projects sit above that. A full custom build usually takes 6 to 14 weeks, with a working version on staging early. We give a clear estimate before you commit.

Can you take over and improve our existing WordPress site?

Yes. Auditing is one of our specialties, and on a takeover it is the first step of the project: we review access and ownership, hosting, code and plugins, security, speed, SEO, accessibility and tracking before we change anything. We stabilise what is risky, fix what costs you money, and recommend a rebuild only when the foundations hold you back. Everything gets documented.

Do we own our WordPress site, and can we leave?

Yes. WordPress is open-source software under the GPL, so the code we write for you, your content and your database are yours, and you can move to any host or agency. The real lock-in comes from page builders and some premium plugins, so we avoid them and hand over repositories, credentials and documentation.

Should we choose WordPress or Shopify for an online store?

Choose Shopify for hosted, low-maintenance commerce and a fast launch with a small team. Choose WooCommerce on WordPress when content and commerce live together, when you need custom B2B logic or deep integrations, or when you want full ownership of code and data. We build on both, so the advice follows your business.

Should we choose WordPress or Webflow?

Choose Webflow for design-led marketing sites where a small team wants visual control and hosting handled for them. Choose WordPress for large content libraries, multilingual and multi-site estates, custom integrations and content with commerce, with more ownership of the platform. We build on both and will tell you which one fits.

Is WordPress secure enough for a business website?

Yes, when it is run properly. Core has very few vulnerabilities: Patchstack's 2026 report found 91% of the ecosystem's new vulnerabilities in 2025 were in plugins. A small, vetted plugin set, monitoring, virtual patching, tested updates, a firewall, strong authentication and least-privilege roles make it safe. Neglect is the real risk.

How do we make WordPress fast and pass Core Web Vitals?

Fix loading first. WordPress sites usually do well on interactivity but fail Largest Contentful Paint, so the big wins are good hosting on current PHP, page and object caching, a CDN, modern image formats, and fewer plugins and page-builder layers. We measure with real-user data and keep performance budgets after launch.

Do we need WordPress VIP?

Probably not, unless you run a high-traffic, regulated or multi-brand estate. WordPress VIP is an enterprise managed hosting platform, with SLAs of up to 99.99%, code review and enterprise support, priced on quote. For most companies, good managed WordPress hosting or your own cloud is enough. We help you decide based on risk, traffic and internal capacity.

Is WooCommerce a good choice for an online store in Portugal?

Yes, when you want local payments, certified invoicing and integrations under your control. WooCommerce works with Portuguese payment providers for Multibanco and MB Way, certified invoicing software, carriers and ERPs. We set it up with block checkout, modern order storage and proper tracking, and tell you when a hosted platform would cost less to run.

Can AI agents use our WordPress site?

Yes, if you decide they should. WordPress 6.9 introduced the Abilities API, a register of actions a site can perform, and the MCP Adapter exposes them to AI agents. WooCommerce has started doing the same for stores. We choose which abilities to expose, map each to a permission, keep publishing and payments behind human approval, and log agent actions.

Does WordPress support llms.txt and AI search (GEO)?

Yes. SEO plugins can generate an llms.txt file, and WordPress blocks produce clean HTML that AI engines can read and quote. llms.txt is still experimental, so we start with schema per template, clear structure, quotable content and rules for AI crawlers. Getting cited is ongoing work, not a setting.

Is WordPress compliant with GDPR and Google Consent Mode v2?

It can be, but compliance comes from how the site is built, not from WordPress itself. You need a consent platform that supports Consent Mode v2 and the WP Consent API, EU hosting, no third-party calls before consent, and policies that match what the site really does. Our digital legal and analytics teams set this up together.

Does WordPress meet the European Accessibility Act?

It can, but compliance depends on your theme, blocks, plugins, checkout and content, not on WordPress alone. The European Accessibility Act has applied since 28 June 2025 to ecommerce and many consumer services. We audit against WCAG 2.2 AA, fix templates and components at the source, and train editors so new content stays accessible.

Do disputes in the WordPress ecosystem affect our website?

Not directly. Your site runs on open-source code that works on any host. Public disputes between companies in the ecosystem are about governance, trademarks and access to WordPress.org services, not the code your site runs on. We reduce your exposure by building host-neutral, managing plugins through Composer with a private mirror, and avoiding dependence on any single vendor's plugins.

Third-party figures on this page are cited with their source. Any figures we share in a project are estimates and benchmarks, not guaranteed results.

WordPress, WooCommerce, headless

Build it new, or make it better.

Tell us what the site has to do. We will come back with the platform call, the plan, and what we would build or fix first.

  1. 1You send the URL or a short brief.
  2. 2We come back with questions.
  3. 3You get a scoped proposal. On an existing site, the first step is usually an audit of what you have.

WordPress, WooCommerce and the other product names and logos on this page are trademarks of their respective owners, used here to describe the platforms we work with. Wise Pirates is an independent agency.