Websites That Never Needed the PHP Patch (and When to Move)

Two Ways to Build a Website

WordPress builds each page when someone asks for it. A visitor arrives, PHP runs, the database is queried, the theme and a dozen plugins each add their part, and the page is assembled and sent. That is flexible, and it is why WordPress runs so much of the web. It also means a program is running on a server every time anyone, including an attacker, sends a request.

A static site does the assembling once, when something changes, and saves the result as finished files. Those files are copied to a network of servers around the world and handed out as-is. There is no PHP, no database and no admin login on the public site. The parts that need to do something, a contact form, a booking, a payment, run on separate services that each do one job and are maintained by the company that does only that job.

That is the whole difference, and it is why on 21 October the owners of WordPress sites got urgent emails and the owners of static sites got nothing. There was nothing on their sites for the hole to be in.

Side by Side

What You Give Up

Honesty first. You give up the WordPress dashboard and the plugin store. If you install a plugin to solve every problem, and you enjoy that, a static site will feel bare. Editing is done through a content editor that writes to the site (Sanity and Decap are the two we use), or by sending the change to whoever looks after it; our care plan includes small changes for exactly that reason.

You give up some kinds of site altogether. A large WooCommerce store with hundreds of products and a team trained on it, a membership site with logged-in content on every page, a forum: these are built around a server doing work per visitor, and rebuilding them static is a bigger job than most small businesses should pay for. Shops with a few dozen products are fine; we build those with Stripe or a hosted checkout.

And you give up the comfort of the familiar. That one is real, and it fades in about a fortnight.

What a Move Costs in New Zealand

Our published prices, which do not change for a WordPress rebuild. The Launch Build is $3,000 + GST: up to five pages, your own words and photos, live in two weeks. The Starter Build is from $5,000 + GST: five to eight pages, the words written from a conversation with you, the search work done, two to four weeks. Hosting and care after launch is $50 + GST a month and includes the updates, a monthly check and report, and small changes when you ask.

The part people worry about is Google. Every address on the old site is forwarded to its place on the new one, the sitemap is submitted, and Search Console is connected on day one, so the ranking you have earned moves with you. On the Wizard IT rebuild the switch itself took four minutes and the email was never touched. On Sans Pareil, a 4.7 MB WordPress home page with a mobile score of 48 became a 1.3 MB static page scoring 82, with the layout shift gone.

A rebuild is also the moment to fix what the old site never said. Most WordPress sites we take over have three service pages for a business that does ten things. The new one says all ten, which is worth more than the security.

When to Stay on WordPress

Stay if you publish several times a week and the editor is part of your routine. Stay if the site depends on a WordPress-only plugin with no equivalent and the plugin is well maintained. Stay if you run a big WooCommerce store and the team knows it. Stay if the site is doing its job and your host answered the PHP version question within the hour with a number and a date; a well-hosted, well-patched WordPress site is not a crisis, it is a site with a maintenance schedule.

Move if the site is slow on a phone, if nobody can tell you who patches what, if the last three "urgent" emails have all been about the platform rather than the business, or if you have been meaning to redo it anyway and this was the push. One owner told us this week that it was.

FAQ

Related Reading