Why agencies move away from WooCommerce: updates, security and support

WooCommerce is flexible and free, and many agencies built their business on it. When they move away, it’s rarely about features. It’s about updates, security and support, and how all three grow with every client shop they add.

What WooCommerce does well

It’s worth starting fairly. WooCommerce is open source, free to install and takes no share of a shop’s revenue. It runs on any host that meets its requirements, the code is yours to change, and it sits inside WordPress, so content and commerce live together. For an agency with strong WordPress developers, it has paid the bills for years.

None of that has changed. What changes is the number of client shops. Problems that are minor on one site become a large part of the week across twenty. This article looks at those problems. If you are weighing platforms more broadly, our checklist for the best ecommerce platform for agencies is the place to start.

Problem 1: the updates never stop

WooCommerce’s release calendar says new versions “typically occur on a 5-week cycle”. WordPress, the theme and every plugin release on their own schedules too. WordPress can update plugins automatically: since WordPress 5.5, administrators can switch auto-updates on plugin by plugin, and WordPress then checks twice a day. But WordPress’s own documentation advises being able to roll back “in case things go wrong”, and notes that scheduling relies on WordPress’s cron tasks, which may not work on every server.

For a shop, “things go wrong” means checkout. That’s why WooCommerce’s update guide asks for a backup, a test on a staging copy, “Coming soon” mode on the live shop during the update, and a test order afterwards. It also notes that compatibility “often depends on the full set of active store software”. Every client has a different set, so every client needs its own test.

We put numbers to this routine in the real cost of running WooCommerce sites for clients.

Problem 2: security sits with you and your client

A good host secures the server. WordPress’s hardening guide is clear about where that stops: hosts “are not responsible for the application you choose to install”. It also warns that on a shared server, a neighbouring site that is compromised can put yours at risk.

Card payments raise the stakes. WooCommerce’s own documentation says “PCI DSS compliance is ultimately the responsibility of the store owner”, and that the core plugin is not PCI certified. A payment provider that handles card details off-site or in hosted fields reduces the scope, but because the shop still serves the checkout page, the rules still apply. In practice, when something goes wrong, the client calls the agency that built the shop.

We go through who owns which task, line by line, in WooCommerce hosting for agencies: what you are really responsible for.

Problem 3: support is split between many companies

WooCommerce’s help page explains that the free plugin is supported through the WordPress.org forums, that WooCommerce support “covers only products created and offered on WooCommerce.com”, and that third-party themes and plugins are supported by their own developers. Hosting questions go to the host.

So when a client’s checkout fails after an update, the answer may lie with the theme author, one of several plugin developers, the payment provider or the host. Your agency sits in the middle, often unpaid for the hours it takes to find out which.

Problem 4: every client site is different

Over the years, each WooCommerce site picks up its own theme, plugins and custom code. Knowledge lives in the head of whoever built it. New staff need time on each site, and you can’t improve all your shops at once. That’s one reason agencies standardise client stores on one platform.

Problem 5: income tied to hours

WooCommerce work is usually paid as a build fee, then a maintenance retainer. When the retainer is mostly updates and fixes, every extra client adds work in a straight line, and the margin shrinks on the busiest shops. Agencies that want to grow without hiring look for income that isn’t hours: a monthly plan per store, at a price they set. See how to charge clients monthly for an online store and agency margin maths.

Where do agencies move to?

• Managed WooCommerce hosting. Less server work, but the plugins, updates and application security stay with you.
• A hosted platform’s partner programme, such as Shopify’s. Hosting and updates are handled, but the client becomes the platform’s customer, under its brand. See Shopify alternatives for agencies that want their own brand.
• Headless builds. More control, more code to own. See headless or hosted?
• A white-label ecommerce platform. The platform runs the software; the client sees your brand and pays your price. See what white-label ecommerce is.

How DripFunnel answers these problems

DripFunnel’s partner programme lets you run client stores under your own brand, on a platform we host and keep up to date. More than 75 partners across the globe use it.

Support sessions last 30 minutes, need a reason and two-step sign-in, and are recorded in the activity log. Your team works with roles (Owner, Admin, Support, Finance, Read-only), and you can require two-step sign-in for everyone. Partners see each store’s plan, status and totals, never its orders, customers or products. The details are in Look after your stores and Let support look at your store.

When should you stay on WooCommerce?

Stay if a client depends on a specific WordPress plugin or custom integration, if their shop is a small part of a large WordPress content site, or if they sell from a country where DripFunnel doesn’t yet offer payments (today, card and online payments are available to shops in India and the United States). For a side-by-side view, see DripFunnel vs WooCommerce.

If you decide to move, our step-by-step plan for moving a client off WooCommerce without losing products covers the export, the spreadsheet and the checks. Then tell us about the shops you run.

Questions