WordPress to Next.js: $25,000 – $80,000 (Full rebuild with headless CMS. Higher end includes API integrations, authentication, and CI/CD pipeline setup.)
The Question Every Budget-Signer Asks
How much does it cost to migrate a website? The honest answer is that migration cost depends on three variables most agencies quote only one of: the upfront build cost, the ongoing maintenance cost, and the security exposure cost. A WordPress-to-Next.js migration that costs $40,000 upfront but eliminates $15,000 per year in plugin patching, security monitoring, and incident response pays for itself in under three years. A migration that costs $8,000 but moves to a framework with its own vulnerability history just shifts the maintenance line item, it doesn't remove it.
Upfront Migration Cost by Target Framework
The numbers below are based on agency rate surveys, public case studies, and WebPulse's framework health scoring. They assume a mid-complexity site: 50-200 pages, CMS-managed content, contact forms, analytics integration, and basic e-commerce or lead capture. Enterprise sites with custom integrations, multi-language support, or regulatory requirements will exceed these ranges.
The Cost Nobody Quotes: Annual Security Maintenance
Migration quotes cover the build. They rarely cover what happens after launch. WebPulse's framework scoring data shows why the annual cost diverges dramatically by framework choice. WordPress has accumulated 18,005 documented CVEs across core and its plugin ecosystem. Every CVE that enters CISA's Known Exploited Vulnerabilities catalog triggers a patching cycle. Under the new CISA BOD 26-04 directive, the highest-risk vulnerabilities require patching within 3 days — not 30.
For a WordPress site with 15-25 plugins, annual security maintenance typically runs $4,200 to $12,000: plugin update testing, compatibility verification, security monitoring, backup management, and incident response retainer. That cost recurs every year. For a site running Astro (3 total CVEs, 0 critical) or Hugo (5 total CVEs, 0 critical), the annual security maintenance cost approaches zero — there is almost nothing to patch.
The 3-Year Total Cost of Ownership
When you add upfront migration cost to three years of security maintenance, the picture changes. A WordPress site that stays on WordPress avoids the migration fee but pays $12,600 to $36,000 in security maintenance over three years. A migration to Astro at $20,000 upfront with near-zero ongoing security cost breaks even against WordPress maintenance alone within two years — before accounting for hosting cost differences, developer productivity, or the business cost of a security incident.
What Drives Migration Cost Up
Four factors consistently push migration costs above initial estimates. First, content migration: moving 500+ posts with custom fields, media assets, and URL redirects is labor-intensive regardless of the target framework. Second, plugin replacement: every WordPress plugin that handles business logic (forms, payments, booking, membership) must be rebuilt or replaced with a SaaS equivalent. Third, SEO preservation: maintaining URL structures, redirects, structured data, and internal linking requires careful mapping. Fourth, training: the content team that knew WordPress must learn a new publishing workflow.
The single largest cost driver, however, is discovery. Most organizations underestimate how much custom functionality lives in their WordPress installation. A 'simple marketing site' often turns out to have custom post types, Advanced Custom Fields configurations, WooCommerce integrations, membership paywalls, multi-language content, and third-party analytics pipelines that no one documented. The migration agency discovers these during the build, and the estimate grows.
What Drives Migration Cost Down
Three decisions significantly reduce migration cost. First, choosing a headless CMS (Sanity, Contentful, Strapi) for content management means the content team's workflow stays similar while the frontend changes completely — this decouples content migration from code migration. Second, using the migration as an opportunity to reduce scope: if 60% of the pages on the current site get no traffic, don't migrate them. Third, choosing a static-first framework (Astro, Hugo, Eleventy) for content-driven sites eliminates the need for server infrastructure, reducing both build complexity and ongoing hosting cost.
The Framework Security Factor
WebPulse scores every tracked framework on seven dimensions including security, ecosystem health, and cost of ownership. For migration cost decisions, the security dimension is the one most commonly ignored in agency quotes — and the one that determines whether the migration saves money or just moves the spend.
A migration to a framework with a security score above 90 is a migration away from security maintenance cost. A migration to a framework with a score below 80 may reduce some costs while introducing new ones. The framework's CVE history is not a prediction of future vulnerabilities, but it is the best available proxy for the ongoing security maintenance burden the framework will impose on your team.
How to Get an Accurate Migration Quote
Ask three questions that most agencies won't volunteer. First: what is the annual security maintenance cost for the target framework, based on its CVE history? Second: what is the 3-year total cost of ownership including hosting, maintenance, and the migration itself? Third: what is the cost of not migrating — the annual spend on patching, monitoring, and incident response for the current platform? Any agency that can't answer all three is quoting a build, not a migration.
