During the past year, a clear shift has been seen in Swedish companies that are going to build a new web or a new digital service. Instead of asking for a new WordPress site with a theme and twenty plugins, they're asking for something else: a proprietary platform that they own, that's fast, secure, and buildable. Behind the shift are concrete drivers — Google's increasingly tough performance requirements, an explosion of security holes in the plugin ecosystem, and new EU rules that make technical shortcuts expensive. This article goes through what actually separates a tech agency from a traditional web agency, and why the choice has long-term consequences.
Two completely different ways of building
Atraditional web agencyusually build on top of a ready-made system — in the vast majority of cases WordPress, which in June 2026 powers around 42 percent of all websites on the Internet and around 60 percent of all sites using a CMS. The model is based on reuse: a theme, a page builder like Elementor, and a bunch of plugins for forms, SEO, booking and e-commerce. It's quick to get started, and for a simple brochure site, it can go a long way.
Atech agencyworking instead as a product development team. The platform is built in a modern codebase — typically a JavaScript-based frontend with frameworks such as Next.js, a frontend connected to an API or a so-called headless architecture, and database and business logic tailored to the business. Instead of adapting the business to what a theme can handle, the code is adapted to the business.
The difference is not academic. It determines performance, security, who owns the solution and how expensive it will be to develop further.
Performance is no longer a bonus — it's a ranking factor
Google measures real user experience through Core Web Vitals:LCP(how quickly the main content is visible),INP(how quickly the page responds to clicks and input) andCLS(how much the layout jumps). Since INP replaced the old FID metric, responsiveness has become the most common stumbling block: a large percentage of websites do not pass the 200 millisecond threshold, and it is often heavy sites with many scripts that fail.
This is the Achilles heel of the traditional model. Each plugin adds its own JavaScript and CSS, page builders generate bloated HTML, and the result is pages that load slowly and respond sluggishly. Instead, a tech agency that builds on a performance-first architecture with static generation and edge delivery can deliver pages that load almost instantly. Companies that have migrated to headless architecture report load times that are often twice as fast as on monolithic platforms, with direct improvement in Core Web Vitals.
It matters to the business, not just the rankings. Pages that load under two seconds have noticeably lower bounce rates than pages that take more than five seconds, and every extra second in load time costs conversions.
Security: where the holes actually are
The most common misunderstanding about WordPress is that the problem lies in the core. It doesn't. According to security firm Patchstack, over 11,000 new vulnerabilities were discovered in the WordPress ecosystem in 2025, andabout 91 percent of them were in plugins— only a handful in the core itself, all low-priority. The picture becomes even clearer when you look at actual breaches: around 92 percent of all successful WordPress breaches in 2025 came via just plugins and themes, not via the base system.
The problem is compounded by the pace. Vulnerabilities begin to be exploited in automated attacks within hours of their publication, while on average it takes a website owner about two weeks to install critical security updates. In a single month at the end of 2025, over 150 plugins were removed from the official WordPress directory due to unaddressed security issues or the developer having stopped maintaining them.
A traditional site thus inherits the attack surface from every third-party component it depends on. A proprietary platform has dramatically fewer moving parts: no public plugin market, no attack surface you don't control yourself, and no abandoned components that suddenly become a backdoor. This does not mean that proprietary is automatically secure — but the attack surface is deliberately chosen rather than inherited.
Ownership and lock-in
When a traditional agency builds with a third-party theme and commercial plugins, you rarely own the entire solution. Features are behind licenses, some plugins stop working if you don't renew your subscription, and if you migrate away from the agency, often not everything comes with you. In practice, you rent your own site.
A tech agency supplies source code. The platform is yours: you can take it to another developer, host it wherever you want and build on it without asking permission. For a company that sees its web or service as a strategic asset — not a cost item — this is often the single most important difference. Ownership of the code is ownership of your digital future.
What lock-in costs in practice
Depending on a supplierwhich alone understands a patched configuration of theme and plugins.
Recurring license costsfor premium plugins required for the site to function.
Expensive retakeswhen a plugin stops being maintained or becomes incompatible with an update.
Limited functionality— you can only do what the theme and plugin flora allows.
Future assurance and regulatory compliance
2025 and 2026 have made technical shortcuts more expensive. Three regulations are particularly relevant for Swedish companies.
European Accessibility Actentered into force on 28 June 2025 and requires digital products and services — including many e-commerce sites and apps — to meet accessibility requirements, in practice WCAG 2.1 level AA via the standard EN 301 549. Companies with fewer than ten employees and under two million euros in turnover are exempt, but for everyone else accessibility is now a legal requirement, not an aspiration. Building accessible from the ground up in your own code is significantly easier than forcing a theme into compliance afterwards.
The Cyber Security Act (SFS 2025:1506), which implements the EU's NIS2 directive in Swedish law, entered into force on 15 January 2026. It covers 18 sectors and private actors with at least 50 employees or at least 10 million euros in turnover or balance sheet total. The law sets concrete requirements for risk management and incident management, with personal responsibility for management and the board. Affected businesses would report to the regulator by February 16, 2026. For these businesses, a platform with an unchecked plugin attack surface is not only a risk — it can make it more difficult to meet the law's security requirements.
Add GDPR, which continues to require control over how personal data is collected and processed, and the picture becomes clear: the more of your platform that runs on third-party code you don't understand, the harder it will be to document and ensure compliance.
When is a traditional web agency enough?
Building in-house is not right for everyone. For a small business that needs a simple presence site, rarely updates content, and doesn't handle sensitive data, a well-built WordPress site can be perfectly reasonable — faster to get up and running and perfectly adequate. The point is not that a tool is bad, but that you choose the right tool for the level of ambition.
Tech agency becomes the rational choice when any of the following is true:
The web or the service isbusiness critical— it drives revenue, leads or operations.
You needspecific functionalitywhich is not ready: customer portals, integrations, automation.
Performance and SEOdirectly affects your top line.
You are covered byregulatory requirementsregarding security, availability or data protection.
You want toown your platformand avoid lock-in.
What actually controls the cost?
A proprietary solution requires more work in the beginning than a template-based site — there's no getting around it. But the ongoing total cost looks different: no stacked licenses, less time patching security holes, and a platform that can be built on without expensive rework. What a project lands on depends on scope, integrations, design level and how much own logic is to be built. Instead of guessing, you can get a transparent estimate viathe quote calculator, which is based on your particular situation.
ZORC builds platforms you own
ZORC is a tech agency: we build fast, secure and proprietary websites and digital services in modern frameworks, with the source code in your hands and performance, security and compliance built in from the start. Do you want to know what it would mean for your project? Count on itthe quote calculatoror get in touch viacontactthen we'll talk through your conditions.
