WordPress VIP vs self-hosted WordPress

WordPress VIP runs WordPress and Node.js applications on Automattic's container-based infrastructure, and it supplies a GitHub repository for every application. For a self-hosted team, those two facts map to duties that are easy to underestimate: building and operating the container platform the site runs on, and keeping the code in a version-controlled repository with a deploy path. On VIP, the platform and the repository are provided, so your team manages the application code and content rather than the servers beneath them. Before you plan a move, list every item in the infrastructure layer that VIP currently runs for you, including the runtime, the deploy pipeline, the repository structure and any environment separation you rely on.

Database backups are the second area to map. VIP customers can download full database backups from the VIP Dashboard or with the VIP-CLI command export sql. A self-hosted site needs its own backup schedule, storage location, retention policy and restore test, and those become your responsibility on day one. Ask your VIP account contact how far back full database backups are available and what the current download limits are, because that window sets how much history you can take with you. Confirm the same questions for media files, which are not covered by a database export, so you know what else has to be copied.

Some things stay with you under either model. Your content, editorial workflows and the decision to adopt or drop a plugin remain your call, and a managed platform does not evaluate whether a plugin fits your business logic. Confirm in your contract the current service boundaries, support tiers and code review terms, including whether review covers custom plugins, theme changes and third-party plugins, and what turnaround applies. Those terms decide how much of the review and on-call work your team still owns after leaving VIP, so treat the contract as the starting inventory for your self-hosted responsibilities.

On WordPress VIP, the platform team carries much of the patching and hardening load. On self-hosted WordPress, that load moves to you, and the largest shift is in how core and plugins get updated. WordPress core is maintained by the WordPress Security Team, which includes more than 50 trusted experts and fixes responsibly disclosed vulnerabilities in bugfix releases. The team also backports critical security fixes to older versions as a courtesy, so older sites can receive them through auto-updates. Background updates have existed since WordPress 3.7, and since WordPress 5.6 newly created sites have automatic major release updates enabled by default. Core patching is therefore largely automated, but only if your site is configured to receive it and your hosting allows the update to run.

Plugins and themes are where the exposure sits. By default, WordPress applies automatic updates to plugins and themes only in special cases determined by the WordPress.org API, which the security team controls to patch critical vulnerabilities. Everything else waits for your team. Self-hosted teams therefore own the plugin patch cadence, the staging tests that prove an update does not break checkout or editorial workflows, and the vulnerability monitoring that tells them a plugin they depend on has a known flaw. Confirm which plugins in your inventory are not in the WordPress.org directory, because those receive no automatic fixes at all. Ask your VIP account team which of today's plugins VIP currently patches on your behalf, since that list is the gap you will need to close.

Three risks change as a result. Patch latency increases because every update passes through your own review and deployment pipeline, and a delay of days on a critical plugin fix is now your decision. Configuration drift grows because the managed platform enforced a consistent PHP, database and caching setup, while your servers can diverge across environments. WordPress recommends PHP 8.3 or greater and MariaDB 10.11 or greater or MySQL 8.0 or greater, so record those versions and check them after every change. Single points of failure also appear: one database server, one media store or one engineer who knows the deployment script can become the weakest link. Document an owner for each control and test a restore from backup before go-live.

On WordPress VIP, the platform fee is the main recurring line, and it bundles the work of running the application: container infrastructure, the GitHub repository for each application, database backups and the support relationship. Self-hosting does not remove those tasks. It moves the bill into separate lines: compute and database hosting, a CDN, object storage for media, backup storage and restore testing, monitoring and alerting, security patching of WordPress core, plugins and themes, code review for every change, and on-call staff or a partner retainer for incidents. Each line has its own payee. Some go to a cloud provider, some to software vendors, and most to your own engineers or a partner. Ask VIP for a written quote that states what the platform fee includes and what it excludes, because the answer determines which self-hosted lines you must budget for.

Separate one-time work from recurring operations before comparing totals. The one-time items include the migration itself, rebuilding the deployment pipeline, setting up monitoring, writing runbooks and any security testing before go-live. The recurring items include hosting, storage growth, backup retention, patch cycles tied to WordPress releases (the current series is 7.1, and only the most recent release in a series is actively maintained), plugin updates that WordPress does not apply automatically except in special cases, and staff time for incidents. Costs such as patching and code review scale with the number of plugins and custom code, so an inventory of both is the first input to any estimate.

Request a written scope from any implementation partner that lists deliverables, responsibilities and exclusions for each recurring line, and ask whether that scope is fixed or time-based. Compare it line by line with the VIP quote, not with the headline platform fee alone. Confirm with your own finance and security teams which costs you already carry, such as an existing cloud account, a CDN contract or an on-call rota, because those reduce the incremental spend. Where a cost depends on traffic, storage or team size, record the driver now so the comparison can be rerun when those figures change.