Why we stopped building stores on open-source platforms

Start with the concession, because the argument is worth nothing without it. Open source is not the problem. This site runs on it, and so does every platform we ship: React draws the interface, Next.js renders it, Node.js serves it, PostgreSQL holds the data. All four are free, open, and maintained more seriously than most commercial software a retailer could buy instead. Anyone who tells you open source is inherently unsafe is either confused or selling a licence.

The distinction that actually decides your next three years is between a library and a platform. A library is a component you call. It does one thing, you control when it runs, its version is pinned in a file you own, and if it is ever abandoned you replace the call. A platform is a building you move into. WooCommerce, Magento, PrestaShop and OpenCart own the request, the database schema, the admin, the checkout and the update cycle, and you live inside a hundred decisions made for a hundred thousand other shops. Those are not the same purchase, and only the second one is what this piece argues against.

Here is what you install when you install the second one. Not one open-source project — thirty. The platform, then a payment gateway plugin, a courier plugin, a myDATA connector, a Skroutz feed generator, an invoicing bridge, a caching layer, a page builder, a reviews widget, a stock synchroniser, a cookie banner, a search plugin because the built-in one cannot find a product by its Greek name, and eight more that accumulated during the build because a deadline was closer than a better idea. Thirty authors, thirty release cadences, thirty licences and thirty private opinions about backwards compatibility. You did not adopt an open-source project. You assembled a private distribution of thirty of them, and you are now its maintainer.

The security consequence is the one people quote backwards. Year after year the overwhelming majority of reported WordPress vulnerabilities sit in plugins and themes rather than in core, and that number is usually offered as a defence of core. Read it the other way. The part that is well maintained is the part you did not choose. The risk lives almost entirely in the layer that made the shop yours — the connectors, the widgets, the one-off that solved a problem in 2023 and has not been touched since.

Which produces the update trap, and there is no clean way out of it. Patch immediately and you find out in production that the payment plugin and the caching plugin disagree about the new version. Delay, and you are running a known vulnerability with a public advisory and a proof of concept attached. Nobody presses update on a store on a Friday in November, so in practice the whole ecosystem is patched in January, which is a sentence that should worry anyone who has read it properly. And every few years the floor moves entirely: anybody who lived through Magento 1 reaching end of life knows that a platform migration is not an upgrade, it is a rebuild with the old design taped to the front.

Then the part that is specific to this country, and in our experience the one that actually breaks. A Greek store is a front end onto systems that exist here and almost nowhere else. myDATA transmission to AADE. An invoice that needs an AFM, a tax office, a profession and a registered address, branching off a checkbox in the checkout. Instalments, because the market expects instalments. Cash on delivery, because a meaningful share of this market still pays the courier. Voucher generation for ACS, Speedex, Geniki Taxydromiki, ELTA Courier and a BOX NOW locker chosen from a map. A Skroutz feed that is correct about availability, and increasingly a Skroutz Marketplace order flow running in parallel with your own.

There is no well-funded plugin ecosystem for that list, because the addressable market for each of those plugins is a few thousand companies. What exists is a long tail of connectors written by one person, sold for forty euros, and maintained for exactly as long as that person stays interested. The component transmitting your invoices to the tax authority is maintained by somebody you have never spoken to, and the second phase of the myDATA mandate reaches every remaining business on 1 October 2026. That is a compliance dependency with a single point of failure and no contract behind it.

The performance argument follows from the same structure and needs no benchmark to make. Every one of those thirty plugins loads its own stylesheet and its own script on every page, including the twenty-eight pages that do not use it, because a plugin author cannot know which page you will put it on. That is why a WooCommerce product page routinely ships two megabytes to a phone on a train, and why the fix is always another plugin. Speed on a store is not a vanity metric; it is the first thing a customer on a bad connection decides about you, and now it is also what an AI search engine has to render before it can quote you.

So the free licence is real, and it is a rounding error. The bill is the specialist retainer that keeps the distribution alive, the plugin subscriptions that are per-year and per-site, the hosting tuned by somebody who knows this particular platform, and the rebuild in year four. We have taken over enough of these to have stopped pretending otherwise, which is why we now build the engine rather than assemble one. That is what Nextcommerce is: one codebase we write and patch, where the myDATA transmission, the courier vouchers, the instalments and the Skroutz feed are features with an owner and an SLA rather than plugins with an author and a hope.

The honest limit, because there is one. If you sell forty products, ship them yourself, invoice by hand and will not change the site for three years, WooCommerce is a perfectly rational answer and we will tell you so rather than quote you. The argument here is for the store that is a real part of the business — where somebody is accountable for the revenue, where the catalogue moves, and where the question every quarter is what the platform will allow next. That ceiling is the thing you are choosing, and a free licence is a bad reason to accept a low one.