Should You Build Your Cannabis Storefront on WordPress?

We are not neutral here, and you should read this knowing that. But we also run a fleet of cannabis storefronts on WordPress — real ones, taking real orders — alongside the BudStacks platform. That gives us something most comparison articles do not have: the specific list of things that broke.

So here is the honest version, including where WordPress wins.

What WordPress genuinely does well

It is the most flexible publishing tool ever built, it costs almost nothing to start, and every developer on earth knows it. If you want a page to look a particular way, someone has already built a plugin for it. For a blog, a brochure site, or an ordinary shop selling ordinary things, WordPress plus WooCommerce is a sensible, boring, correct answer.

If your storefront is mostly a shop window and your orders arrive by phone, stop reading. WordPress will serve you well and cost you a few pounds a month.

WordPress does not know it is selling cannabis

This is the whole thing, really. WooCommerce was built to sell t-shirts. It has no concept of a patient, a prescription, an identity document, or a jurisdiction that will fine you for shipping into it.

Every one of those concepts has to be bolted on. In our own WordPress fleet, that meant building and maintaining four separate plugins:

• Identity upload — capturing a customer's ID, storing it somewhere defensible, and getting it in front of a human to approve or reject before an order can proceed.
• Direct payment — because the default checkout flow assumes the customer can simply pay, and a medical order cannot be paid for until the customer is verified.
• Local pricing — showing the right currency and the right price to the right country, which sounds trivial until you have priced South African rand at dollar values.
• Policies — the consent, terms, and disclosure furniture that regulated retail requires on every page.

None of those is exotic. All of them are the sort of thing you discover you need three weeks after launch, usually because something went wrong.

The update problem nobody mentions

One WordPress site is a pleasure. Twenty is a job. Two hundred is a full-time engineering function.

Every plugin you add is a thing that updates on its own schedule, occasionally breaks against a WordPress core release, and needs testing across every site you run. We ended up writing a fleet patching tool purely to push a single fix across hundreds of sites without visiting each one by hand. That tool exists because the alternative was a person clicking through admin panels for two days.

If you plan to run one store, this is not your problem. If you plan to run several, it is the problem.

Compliance is not a plugin

The parts of a medical cannabis store that keep you out of trouble are unglamorous and structural: identity verification before an order can be placed, a consultation questionnaire, geographic gating for regions you are not licensed to serve, consent capture that survives an audit, and a log of who changed what and when that cannot be quietly edited afterwards.

You can assemble all of that on WordPress. People do. But you are then the person responsible for it — for the encryption of those ID documents, for the redaction of personal data in your logs, for proving to a regulator that the audit trail is genuine. That responsibility does not go away because a plugin author said it was handled.

On BudStacks those pieces are part of the platform rather than an add-on, which is a claim worth being precise about: it does not make you compliant. It means the mechanism exists and works the same way on every store, and that keeping it working is our job rather than yours. You still have to operate lawfully in your own jurisdiction.

The honest cost comparison

WordPress hosting runs a few pounds a month. That is genuinely cheaper than any SaaS subscription, and anyone who tells you otherwise is selling something.

The cost you are actually comparing is the build. Assembling a compliant medical cannabis storefront from scratch — the identity workflows, the payment integration, the supplier connection, the legal review — is the part that runs into serious money and serious time. Our own estimate for doing it properly from nothing is $200,000 to $500,000 and one to three years, which matches what operators who have tried it tell us.

The subscription is not competing with your hosting bill. It is competing with that build.

So which one

Choose WordPress if you have development capacity in-house, you are running one or two sites, you want total control of every pixel and every integration, and you are comfortable owning the compliance surface yourself.

Choose BudStacks if you want to be selling this quarter rather than building this year, if you would rather spend your time on patients than on plugin updates, and if you want the compliance machinery to be someone else's problem to maintain.

There is no clever answer here. It is a straight trade: control and cheap hosting on one side, time and maintained compliance on the other. Anyone who tells you one option is simply better has not run both.