Two suppliers are telling a UAE business two different things. One says WordPress is fine and always was. The other says the future is headless and anything else is legacy. Both are selling, and the buyer has no way to tell which is describing their situation and which is describing their product line.
The honest version is smaller than either pitch. Headless is an architecture that buys you one specific thing and costs you one specific thing. Whether that trade is worth it depends on six questions about your business, none of which are about technology.
This article stays out of territory we already cover. Migration mechanics are in our replatforming guide, hardening is in our website security guide, and a platform-by-platform verdict is in our WordPress, Webflow and Next.js comparison. This one is about how to make the choice.
What headless actually means
Headless means your content is stored and delivered through an API, with the front end built as a separate application. WordPress describes the capability without the marketing term, saying its REST API lets you build a brand new interactive front-end experience or bring your content into completely separate applications [1]. Contentful describes storing content as structured entries delivered as JSON [6]. Sanity describes content held as structured data, queryable, referenceable, and ready for delivery to any channel [12].
Notice what none of those say. None of them promise faster, safer, or better. They describe a separation, and everything else follows from it.
What you actually give up
Editors lose in-place visual editing. In a traditional setup, someone updating a page works on something resembling the page. In a headless setup they work in a structured form, and the rendered result lives somewhere else.
The strongest evidence that this trade is real is not a critic's complaint. It is that both leading vendors built features specifically to close the gap. Contentful ships Live Preview, which shows content rendering in real time beside the entry editor with an inspector mode that jumps from a piece of website content to its source field [7]. Sanity ships visual editing that lets editors see drafts render on the live site, click an element to reach the right field, and watch content update as they type [13].
Those features are good. They also would not need to exist if the base experience were not detached. Anyone selling you headless without mentioning this is not describing the product honestly.
What you actually gain
You gain content that can feed more than one destination. That is the whole benefit, and it is a real one when you need it.
If a product description has to appear on your website, inside your app, and on a screen in a showroom, holding it as structured data and delivering it through an API is the correct architecture, and doing it any other way means maintaining the same words in three places. If it appears on one website and nowhere else, you are paying a monthly subscription and an extra hosting bill for a capability that will never be exercised.
The four realistic options
Traditional WordPress. Free core, in-place block editing, a documented content export, and a maintenance burden that lands on you or whoever you pay [2][5]. The editing experience is the one most UAE content staff already know.
WordPress used headlessly. Your editors keep the interface they know while the front end is rebuilt separately against the REST API [1]. The trade is that you now run two systems rather than one, each with its own hosting, deployments and maintenance. It is a genuine middle path and it is not a cheaper one.
A hosted page builder. Hosting, patching and infrastructure become the vendor's problem, which removes real work from a small team. Webflow publishes defined collaborator roles including a content editor who can edit content and collection items but not touch page layout, with publishing gated by an admin toggle [19]. What you accept is dependence on their platform and their schedule.
A dedicated headless CMS with a separate front end. Contentful and Sanity both publish clear role models, and both include a role that can draft but not publish: Contentful's Author and Freelancer roles [8], Sanity's Contributor [14]. Wiring the front end, including preview and revalidation, is developer work throughout [17].
The six questions that actually decide it
Answer these about yourself and the platform usually chooses itself.
- Who changes content, and how often? If a non-technical person updates pages weekly, in-place editing has real value and a structured form is a real cost.
- Does the same content need to appear in more than one place? This is the question headless exists to answer. If the answer is no, most of the argument collapses.
- Do you need independent multilingual publishing? Whether your Arabic can go live without waiting for the English is an operational question with a technical answer.
- What can your team actually operate? If nobody in-house can investigate a failed deployment, a headless stack adds an ongoing dependency a page builder does not.
- What would it cost to leave? Ask this before you sign.
- Where does the content sit? Worth knowing regardless of whether any rule requires it.
Security, and the statistic you should not repeat
WordPress exposure is real, and it concentrates in plugins rather than in WordPress itself. WordPress.org states that its security team resolves issues across the core software, while vulnerability reports for plugins go to the plugin developer and the plugins team, and theme reports to the theme developer [4]. Its developer documentation is blunter still, describing plugins and themes as key points of weakness.
The data supports that split clearly. A keyword search of the US National Vulnerability Database returns over eighteen thousand records mentioning WordPress plugins, against a hundred and thirty-eight for WordPress core [20]. Those are free-text matches rather than a formal taxonomy, and they are not mutually exclusive categories, so treat them as raw counts rather than a clean ratio. Even read conservatively, the direction is unmistakable.
What you should not repeat is the claim that some large percentage of hacked websites run WordPress. No official source publishes it. Every version we traced comes from a security vendor's own client caseload, which measures who hired that vendor rather than what happens across the web, and the most-quoted version is several years old. We had published a version of that claim ourselves and have now corrected it.
The useful conclusion is narrower and more actionable. Plugins are third-party code running with access to your site, and OWASP's current top ten includes a category covering software supply chain failures [21]. A site with eight maintained plugins someone reviews quarterly is safer than one with three abandoned ones.
What each option costs to run
A traditional CMS build is one cost line, and a headless build is at least three: the CMS subscription, front-end hosting, and building the front end itself. Build cost is the number everyone compares, and running cost is the number that decides it.
As checked in August 2026, Contentful published a free tier with ten users and a single space, a Lite tier at 300 US dollars a month for twenty users, and custom enterprise pricing [11]. Sanity published a free tier of up to twenty seats and a Growth tier at 15 US dollars per seat per month [16]. Strapi's self-hosted core is free under an open-source licence with paid cloud tiers starting at 35 US dollars per project per month [24]. Webflow published a Premium plan including its CMS at 25 US dollars a month billed yearly, with localisation sold as a separately metered add-on [19]. Vendor pricing pages change without notice, so confirm the current figures rather than relying on these.
The structural point matters more than any of those numbers. A headless build is at minimum three cost lines: the CMS subscription, front-end hosting, and the one-time cost of building the front end. A WordPress or page-builder build folds all three into one. Per-seat pricing adds a fourth dynamic that most businesses do not model, because it is invisible at five editors and material at thirty.
A pattern worth naming. A Dubai business is sold headless on performance and security grounds, spends more than planned on a front-end build, and two years later has a site nobody in the marketing team will touch without asking a developer first. The content goes stale, which costs far more in lost enquiries than the milliseconds ever earned. The architecture was not wrong in the abstract. It was wrong for a team of four.
Arabic content, and why you should test rather than assume
None of these platforms market Arabic handling specifically, so verify it yourself with real content. Contentful documents locale-based publishing and unpublishing that lets editors publish and unpublish content in selected locales in isolation from others [9]. Sanity documents two localisation patterns, one holding languages in a single document that publish together, and one giving each language its own document so versions publish independently [15]. Both are generic locale mechanisms. Neither is Arabic-tuned.
WordPress is the starkest case. Its own documentation states that WordPress does not support a bilingual or multilingual site out of the box, and that community plugins make it possible, with native capability described as a future roadmap item [3]. For a UAE business planning Arabic, that means a third-party plugin carries your multilingual capability.
The most honest data point comes from the W3C, which states that there is currently a lack of good editing environments for creating pages using right-to-left scripts [22]. That is a standards body saying the tooling is not solved. Have an Arabic speaker type real content into the actual editor during evaluation, because a locale checkbox on a feature page tells you nothing about what the experience is like. The layout side of this is covered in our Arabic-first RTL design guide.
Where your content actually lives
We found no UAE requirement to host website content in the country. The published summary of Federal Decree-Law No. 45 of 2021 says the law applies to processing of personal data inside and outside the country and sets out requirements for cross-border transfer and sharing of personal data [23]. That is transfer-control language, not a hosting mandate. If you operate in a regulated sector, your regulator may say otherwise, so ask them rather than us.
The factual position is still worth knowing. Contentful documents a default United States region with an EU data residency option available as a paid addition, and no Middle East region [10]. Sanity's own documentation points to an EU-hosted content store by default, though we could not confirm a specific region on a dedicated regions page, so treat that as direction rather than a fixed fact. Meanwhile Vercel documents a Dubai compute region among its global regions, though functions default to a United States region unless configured otherwise [18].
Read together, that produces an arrangement most buyers never picture: a front end rendering in Dubai, with the content it renders stored in Virginia or somewhere in the EU. That is not a violation of anything. It is simply not what people assume when they are told the site is hosted locally.
The cost of leaving, which belongs in the decision
Ask what it takes to get your content out before you put it in. This is the question buyers almost never ask and almost always regret not asking, because the answer is cheap to obtain up front and expensive to discover later.
WordPress documents a built-in export producing a file containing posts, pages, custom post types, comments, custom fields, categories, tags, custom taxonomies and users [5]. That is a genuine advantage, with an honest limit: it covers content and structure, not your design or, fully, your media. Sanity documents a command-line dataset export with options for including assets [12]. For some platforms we looked at, we could not find equivalent documented bulk-export tooling, and that absence is itself an answer worth having.
The wider point is that leaving is never only an export. It is migrating content, rebuilding the front end, and preserving search visibility through redirects, which is a project rather than a task. Our replatforming guide puts a migration from around AED 5,000, and that figure assumes the content comes out cleanly. Where it does not, the number moves.
Put concretely: a platform on a four-figure annual subscription that holds your content in a format you cannot easily extract has more pricing power over you every year you stay. That is not an accusation against any particular vendor. It is the reason to check the exit before you commit to the entrance.
What it costs with us
A focused business website starts from around AED 3,500 with us, rising once a CMS your team edits itself is part of the scope. A headless build with a separately built front end starts from around AED 10,000, because you are commissioning the front end that a traditional CMS would have handed you as a theme.
These are our own figures rather than a market survey, since no official body publishes rates for this work. Final pricing depends on scope, mostly on page count and how much of your content genuinely needs modelling rather than typing. Ongoing, a traditional site is hosting plus maintenance from around AED 150 a month, while a headless setup adds platform subscriptions and separate front-end hosting billed in dollars by someone else.
Over three years, that recurring gap often exceeds the difference in build cost. It is the part comparisons leave out because it arrives after the project is signed off.
The short version
Choose headless when your content genuinely has more than one destination, when languages must publish independently, or when your website is a product rather than a brochure. Choose a traditional CMS or a hosted builder when it is a website, your team edits it themselves, and nobody has named a second destination.
If someone is pitching you an architecture and you would like a second opinion from people who will tell you when the cheaper answer is the right one, contact us. We will ask you the six questions and tell you if the cheaper answer is the right one.
References
[1] WordPress, REST API Handbook. developer.wordpress.org
[2] WordPress, The WordPress block editor. wordpress.org
[3] WordPress, Multilingual WordPress. developer.wordpress.org
[4] WordPress, Security. wordpress.org
[5] WordPress, Tools Export screen. wordpress.org
[6] Contentful, Data model. contentful.com
[7] Contentful, Live preview. contentful.com
[8] Contentful, Space roles and permissions. contentful.com
[9] Contentful, Localization. contentful.com
[10] Contentful, EU data residency FAQ. contentful.com
[11] Contentful, Pricing. contentful.com
[12] Sanity, Content Lake. sanity.io
[13] Sanity, Introduction to visual editing. sanity.io
[14] Sanity, Roles. sanity.io
[15] Sanity, Localization. sanity.io
[16] Sanity, Pricing. sanity.io
[17] Next.js, Draft Mode. nextjs.org
[18] Vercel, Edge Network regions. vercel.com
[19] Webflow, Pricing and collaborator permissions. webflow.com
[20] NIST, National Vulnerability Database API. services.nvd.nist.gov
[21] OWASP, Top 10:2025. owasp.org
[22] W3C, Authoring HTML: handling right-to-left scripts. w3.org
[23] The Official Portal of the UAE Government, Data protection laws. u.ae
[24] Strapi, Pricing. strapi.io
