Open Source E-Commerce vs Closed SaaS Platforms

Cost Structure: License Fees vs Self-Hosting in KL

Open source does not mean free. A WooCommerce store on Exabytes or IP ServerOne in Kuala Lumpur costs roughly MYR 39 to MYR 99 per month for shared hosting with 2 GB to 4 GB RAM. You pay for the domain (MYR 60 per year), SSL certificate (MYR 150 to MYR 300 per year, or free via Let’s Encrypt if you handle it yourself), and a theme. A decent custom theme from a local developer runs MYR 1,500 to MYR 5,000 one-time. No recurring license fee, but the responsibility for PHP version updates, MySQL patches, and security hardening lands on you or your hired agency.

Closed SaaS platforms charge a monthly subscription. Shopify’s Basic plan costs USD 39 (roughly MYR 185) per month plus a 2.9% payment processing fee per transaction unless you force customers through Shopify Payments. Malaysian platforms are cheaper: SiteGiant starts at MYR 29 per month, EasyStore starts at MYR 49, and StoreHub’s online store plan is around MYR 99. These fees include hosting, automatic updates, and the checkout page. But transaction fees on local gateways like iPay88 (now OmniPay) or aZa Pay still apply, typically 1.5% to 2.8% per transaction depending on your volume.

The math flips at scale. A store doing RM 50,000 monthly revenue with a 2.8% transaction fee pays MYR 1,400 per month in processing alone. The subscription is a minor line item. The cost difference between open source and SaaS becomes irrelevant if your payment gateway economics are wrong.

Payment Gateways: FPX, eWallet, and Direct Integration

In Malaysia, the payment gateway is the battleground. Open source platforms give you direct API access to iPay88, Billplz, Razer Merchant Services, and eGHL. You can insert custom front-end code for Touch ‘n Go eWallet QR, GrabPay redirect, and Boost without paying a platform app store fee. For example, a WooCommerce store can use the Billplz FPX plugin (free, but Billplz charges MYR 0.55 per FPX transaction) or a custom iPay88 gateway module built in 3 to 5 days by a KL-based PHP developer.

Closed SaaS platforms restrict this. Shopify’s app store has “iPay88: Pay with FPX” and “eGHL Malaysia” apps, but each app adds a monthly fee (typically MYR 49 to MYR 99 per month) on top of the subscription. StoreHub and SiteGiant have native integration with a limited set of local gateways, often just iPay88 and their own in-house payment processor. If you want to use a niche gateway like aZa Pay or Faspay for a specific demographic, you are stuck waiting for the platform to add it.

There is also the issue of PCI-DSS compliance. With open source, your payment form is embedded in your own checkout page, so you either use a hosted payment page (via iPay88’s redirect) or you handle card data with a certified processor. With SaaS, the platform handles this centrally, but you forfeit control over the checkout UI. Malaysian consumers are used to the icon-packed payment page with FPX banks listed, eWallets, and online banking options. A SaaS checkout often hides these behind speed-bump screens, which increases cart abandonment, especially on mobile browsers.

Operational Control: Servers, APIs, and Data Extraction

Open source gives you the actual files and database. You can SSH into your Exabytes VPS, run `top` to see MySQL load, tune the PHP-FPM pool for high traffic during Hari Raya sales, and install Redis for object caching. You can write a custom cron job that exports order data to an FTP folder for your third-party warehouse in Shah Alam. You can dump the entire MySQL database with `mysqldump` before any plugin update. This is real control, and it counts when your store’s uptime depends on a peak-corrected server configuration.

Closed SaaS platforms expose a limited admin panel. SiteGiant and EasyStore provide a drag-and-drop site builder and an order management dashboard, but no SSH access, no direct database access, and no control over the web server. Shopify’s GraphQL API is powerful, but it is rate-limited to 4 requests per second per token at the Storefront API tier. If you need to bulk-update 10,000 SKUs with stock levels from your supplier’s spreadsheet, you will hit the API ceiling and need a queue system. With open source, you can run a direct SQL `UPDATE` on your own database or use a plugin like WP All Import with unlimited volume.

Local hosting matters for latency. A WooCommerce store hosted on IP ServerOne’s KL data center serves pages with a time-to-first-byte (TTFB) of 80 to 120 ms on a 5G connection in Petaling Jaya. A Shopify store is served from edge nodes, but the Canadian or Singapore data center introduces a 300 to 600 ms delay on dynamic content. For mobile shoppers on CelcomDigi or Maxis, that extra 300 milliseconds is the difference between tapping “Checkout” or scrolling back to TikTok.

Security and Maintenance in the Klang Valley Context

The hidden cost of open source is maintenance. WooCommerce sites get hacked when store owners fail to update plugins. A breach that redirects customers to a phishing page will get your domain blacklisted by Google Safe Browsing, which instantly kills traffic from Malaysian Chrome users. To avoid this, you need a maintenance retainer with a local agency (MYR 300 to MYR 800 per month) or internal IT manpower. That cost alone exceeds a SiteGiant subscription.

Closed SaaS handles security centrally. You never see a PHP deprecation warning or a vulnerable plugin in the WordPress plugin repository. But you are renting security. If SiteGiant or Shopify gets compromised or goes bankrupt, your store data lives on their infrastructure. Malaysian platforms have come and gone; Sellrr and Orangesoft had limited adoption, and consolidation risk in this market is real.

Server-side security also has a local angle. IP ServerOne and Exabytes offer DDoS protection within Malaysia, reducing latency for local customers and keeping compliance under Malaysia’s Personal Data Protection Act (PDPA) simpler because data does not leave the country. With SaaS, your data sits on AWS or Google Cloud locations that may be outside Malaysia, complicating PDPA compliance if a customer files a complaint with the Personal Data Protection Department under the Ministry of Communications.

Migration, Exit Scenarios, and the Real Decision Framework

Open source migration is a file-and-database move. Export the MySQL dump, move the `wp-content` folder, update the `wp-config.php`, and point the domain to the new server. The entire store moves in under two hours. Closed SaaS migration is a data export at the application level. Shopify exports a CSV of products, customers, and orders, but loses your blog posts, custom meta fields, alt text, and SEO redirects. SiteGiant and EasyStore export CSV too, but each has a different field mapping; you will spend a week cleaning the export before importing it into WooCommerce or a competitor.

There is also the marketing data angle. Open source stores attached to Google Analytics 4 and Meta Pixel have zero platform API restrictions; you can deploy custom event tracking for “Add to Cart” and “Initiate Checkout” with a simple GTM container. SaaS platforms have stricter data layer restrictions, and some (like SiteGiant) only expose basic event data to GA4, making it harder to run a Facebook retargeting campaign with granular product-level data.

The final decision is a price-to-control sweep. If your store does less than MYR 20,000 monthly revenue and you need the fastest setup with local payment gateways, SiteGiant or EasyStore gets you live in a day. If you are a forward-planning operation — or have a technical person on staff — WooCommerce on a KL VPS with iPay88 and a custom checkout flow will save you 40 to 60% on subscription fees over three years, but only if you handle maintenance.

The table below summarizes the trade-offs.