[jstarfish]

Your business requirements:

> build a website for them plus a bit of marketing stuff, and maybe a remote desktop and a platform for invoicing for their personnel.

This is a shoe-in for Django, especially the invoicing part.

Wordpress is a blog engine. It's great for letting a bunch of people log in and submit news but every feature you implement beyond that is going to be through plugins, and those are routinely compromised. All sites I've deployed that used only the major plugins (Yoast, Jetpack, WooCommerce, etc.) are still running. All third-party ones have since been compromised, which is embarrassing for me. I wouldn't deploy Wordpress for a business again unless the alternative was Magento.

Django isn't bulletproof, but it will stop you from making amateur mistakes as you build it out. There is no convenient plugin architecture with a friendly UI, which makes it harder for yourself (and the client) to change themes/plugins every week and introduce code that can be exploited.