Built In vs Bolted On: Backups, Security, Email, and Speed
On WordPress, the four things every business site depends on — backups, security, email, and speed — are all bolted on. On a static, AI-built platform like Press CMS, they are built in.
A built-in feature ships as part of the platform, maintained by the platform, at no extra license or configuration. A bolted-on feature is a third-party plugin you buy, install, update, and reconcile yourself, because the core software left the job undone.
That single distinction explains most of the difference between a modern static site and a legacy WordPress one. On WordPress, the four things every business site actually depends on, backups, security, email, and speed, are all bolted on. On a static, AI-built platform like CitrusWeb Press CMS, they are built in. This post walks the four one at a time: how the bolted-on model works and what it costs you, then what built-in does instead.
First, fairness. WordPress powers roughly 42% of the web, and its plugin model is the reason. Anything you can imagine, someone built a plugin for. That flexibility is real, and a share of WordPress's attack volume simply reflects how common it is. The point here is narrower: for the core essentials, first-party and built-in beats third-party and bolted-on. Not that WordPress is worthless.
Backups
Bolted on. WordPress core has no automated, off-site backups. None. You add a plugin like UpdraftPlus or BlogVault, roughly $70 to $140 per year, then you configure a schedule, connect off-site storage, and hope the job actually ran the night before the day you need it (Duplicator). A backup you never tested is a backup you do not have, and a restore means overwriting the live site and praying the archive is clean.
Built in. On Press CMS, every change is saved automatically. Full version history ships with no schedule to set and no storage to connect. Restoring an earlier version takes one click, so nothing is lost and no history is destroyed. There is no backup plugin, nothing to configure, and nothing to hope ran. The backup is the way the platform saves your work.
Security
Bolted on. This is where the model shows its bill. In 2024, 96% of new WordPress vulnerabilities were in plugins, with only 7 in core all year, and the ecosystem logged 7,966 new vulnerabilities, up 34% year over year. About 59% of those plugin vulnerabilities needed no authentication to exploit (Patchstack). Of the sites Sucuri cleaned in 2023, 95.5% were WordPress, though that figure partly reflects Sucuri's WordPress-heavy customer base and WordPress's overall dominance (Sucuri). The standard response is to bolt on a firewall plugin, which is one more piece of code to buy, update, and patch. When the firewall itself has a flaw, you are patching the thing that was supposed to protect you.
Built in. A static site has almost no attack surface to begin with. No database, no PHP, no plugin code means no SQL injection, no vulnerable plugin, no admin login to brute-force on the public site. On top of that, Press CMS sets security headers site-wide at the platform level: HSTS with a two-year max-age and preload, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, a strict Referrer-Policy, a locked Permissions-Policy, and Cross-Origin-Opener-Policy. The editor itself is gated by server-enforced roles, its API is marked noindex, and every proposed change is HMAC-signed and re-validated at commit time behind a path-traversal guard. There is no WAF plugin to license, and no plugin CVE to wake up to.
Email and forms
Bolted on. WordPress cannot reliably send email on its own. The default wp_mail() and PHP mail() either fail silently or land in the spam folder, which is exactly why WP Mail SMTP appears on nearly every must-have plugin list. To take a message from a visitor and deliver it to your inbox without dropping it, the standard stack is three plugins: Contact Form 7 or WPForms to build the form, WP Mail SMTP to make the mail deliver, and Akismet to stop the spam. Three vendors, three update schedules, three ways for a lead to vanish between the form and your inbox.
Built in. Press CMS ships a contact form that delivers through Postmark, a dedicated transactional email service, with a spam honeypot on the form. It also includes a built-in live chat with send, poll, rate, and email-transcript support. One platform covers what the Contact Form 7 plus WP Mail SMTP plus Akismet stack covers, and email deliverability is handled by design rather than bolted back on.
Speed
Bolted on. Only about 44% of WordPress sites pass all three mobile Core Web Vitals, behind Shopify at roughly 65% and Wix above 60% (Core Web Vitals). A large part of the reason is the stack itself: the average WordPress site runs 20 to 30 plugins, and each one tends to inject its own CSS and JavaScript into every page. You fight that with yet another plugin, a caching plugin like WP Rocket, which patches over the weight instead of removing it. The clearest proof the built-in model wins comes from WordPress's own ecosystem: managed hosts like Kinsta ban caching, backup, and security plugins outright and do those jobs server-side (Kinsta). When the host that specializes in WordPress tells you to remove three plugin categories and let the platform handle them, that is the bolted-on model conceding the point. Wix has its own version of the problem (see Wix’s export and template limits), and if you’re still choosing a platform, start with AI CMS vs website builder.
Built in. Press CMS outputs static HTML with CSS inlined and minified, so there is no render-blocking stylesheet and no plugin JavaScript piling up. A real Atomic build scored 100 out of 100 on mobile PageSpeed. The editor loads only for logged-in operators, so ordinary visitors download essentially none of it. Images are downscaled to WebP at edit time, which means no image-optimization plugin and no caching plugin to bolt back on. Speed is a property of how the site is built, not a plugin you install to recover it.
What else is built in
The same pattern holds past the big four. On Press CMS, these ship with the platform, not as add-ons:
A few honest limits. Press CMS is single-tenant, one install per deploy. It does not offer SSO or MFA today. Creating brand-new pages from inside the editor is still partial. It is not a drop-in replacement for every WordPress workflow, and it is not trying to be.
If you want pricing, book a demo and we’ll quote your site.
FAQ
What does "built in vs bolted on" mean for a website? Built in means the platform ships and maintains a feature itself, with no extra license or setup. Bolted on means you add a third-party plugin to fill a gap the core software left, then you own the buying, updating, and troubleshooting. Backups, security, email, and speed are bolted on in WordPress and built in on a static platform like Press CMS.
Why is a static site more secure than WordPress? A static site has no database, no PHP, and no plugin code, so the most common attack paths simply do not exist. That matters because 96% of new WordPress vulnerabilities in 2024 were in plugins, with only 7 in core (Patchstack). Press CMS also sets site-wide security headers like HSTS and X-Frame-Options at the platform level, so there is no firewall plugin to buy or patch.
Do I still need backup and caching plugins on Press CMS? No. Backups are automatic because every change is saved with full version history and a one-click restore. Speed comes from static HTML with inlined, minified CSS and WebP images, so there is no caching or image-optimization plugin. Managed WordPress hosts like Kinsta ban those same plugin categories and handle them server-side, which is the same built-in logic (Kinsta).
Is WordPress a bad choice, then? No. WordPress powers about 42% of the web, and its plugin model gives you flexibility nothing else matches. The argument here is specific: for the four essentials every business site needs, first-party and built-in is more reliable and cheaper to own than third-party and bolted-on. If your site lives or dies on those four, built-in is the safer default.
---