5 things 15 years of WordPress delivery taught me

15 years in client software delivery, with WordPress running through a good chunk of it, not a WordPress specialist by title, a COO who's shipped it alongside everything else at Genetech. A few things that keep proving true no matter how the platform evolves:

1. Updates are the whole game, not a chore. We recently cleaned up a client site that had been hacked twice. It had been deployed in Jan 2026 and had fallen several updates behind. After the cleanup, we didn’t change the code, we patched and updated everything that needed updating. No repeat incident since.

2. The admin path being public isn't a bug. It's a decision you have to make yourself. Every WordPress install defaults to the same URL. Nobody's coming to lock that door for you.

3. Deactivating a plugin isn't the same as removing it. An inactive plugin is still a way in. If you're not using it, delete it.

4. Heavier page builders cost you speed you can't see until you measure it. Free-tier drag-and-drop builders load slower than lighter, block-based setups. The tradeoff stays invisible until someone actually checks.

5. WordPress still wins on value, not glamour. No SaaS lock-in, free to start, pay only for what you need. For a budget-conscious client with a smaller footprint, it's usually still the right call over a custom build.

None of this is exotic. It's mostly discipline nobody enforces. What's the one WordPress habit you know you should do consistently, and don't?