Most Irish small-business websites don't need custom development. A well-configured CMS — WordPress, Webflow, Shopify, Squarespace — covers 80% of cases. Custom development earns its keep when the business has functional requirements that don't map to off-the-shelf software: bespoke booking flows, custom integrations with proprietary systems, complex multi-product e-commerce, or high-traffic consumer apps.
When custom development is justified
- Your business has a one-off workflow that no SaaS tool covers.
- You're integrating with multiple back-end systems (CRM, ERP, custom inventory, telephony).
- You expect to scale to traffic levels that off-the-shelf CMS hosting can't handle.
- Performance, accessibility, or security requirements are stricter than what generic platforms deliver.
- You need long-term cost control and want to own the codebase.
When off-the-shelf is the right answer
- You publish content (pages, articles, products) and need an editor your team can use.
- Your scope fits within what the platform was designed for.
- Time-to-launch is short.
- You don't have ongoing technical capacity in-house.
Sensible framework / stack picks in 2026
- Static + headless CMS — Astro, Eleventy, or Next.js statically generated, with content in Sanity, Storyblok, or a headless WordPress. Best performance; best cost-of-hosting; suits content-heavy editorial sites and brochure sites.
- Laravel + Inertia/Livewire — popular for full-stack apps with custom logic. PHP ecosystem; broad Irish developer pool.
- Ruby on Rails — still well-supported. Mature ecosystem; good for back-office heavy applications.
- Django (Python) — strong choice if your team has Python expertise, or for data-heavy applications.
- Node.js + Express / Fastify — when JavaScript is unavoidable across the stack.
- WordPress — still the most-built CMS in Ireland; powerful with a good developer; nightmarish if maintained badly.
Performance baseline every site should clear in 2026
- Largest Contentful Paint < 2.5s on a 4G connection.
- Cumulative Layout Shift < 0.1.
- First Input Delay < 100ms.
- Lighthouse score > 90 on Performance, Accessibility, Best Practices, SEO.
- HTTP/2 or HTTP/3, HTTPS only, HSTS enabled.
Security minimums
- HTTPS with auto-renewing certificates.
- Automated security patches on the CMS, plugins, and underlying server.
- Daily off-site backups. Tested restores, not just backup files.
- 2FA on every admin account.
- A WAF (web application firewall) — Cloudflare's free tier handles most SMB cases.
- No default admin usernames. No "admin/admin." Yes, this is still the most common exploit vector.
How to avoid lock-in
- Own the domain. Always registered to you, not your developer.
- Own the hosting account. If they hold the keys, they can hold you to ransom at renewal.
- Have access to the codebase — a Git repository you can read, even if you can't write to it.
- Documentation. A short README that explains how to deploy, where the database lives, how to take a backup. One page is enough.
- Avoid proprietary CMS platforms built on a single agency's code. When that agency disappears (and they do), so does your support.