After the PHP Vulnerability: How to Move Your Website Off WordPress
If you run a WordPress site, you've probably heard about the PHP vulnerability by now, and you might be wondering if your site is safe. That's a fair question. So let's take it one step at a time. First, what happened and what to do about it today. Then, if all this has you rethinking whether WordPress is still the right home for your site, we'll show yall exactly how to move.
What happened with the PHP zero-day
PHP is the programming language running behind the scenes on WordPress, along with your theme, your plugins and most WordPress hosting.
On Wednesday, October 21, 2026, a serious flaw in PHP went public. It's been nicknamed PHP2Shell, and it lets an attacker take over a web server without a password. Researchers at the security firm Wiz found it and reported it to the people who maintain PHP, and the fix came out the same day.
Attackers moved quickly. According to Cloudflare, attempts to use the flaw started showing up about 10 hours before the announcement. Within 45 minutes of it, Cloudflare logged tens of thousands of attempts. Within two hours, hundreds of thousands. By the next day, millions.
The team at Accolades IT wrote up the full story in plain language: PHP Just Had a Zero-Day. Is Your WordPress Site Safe?
Is my WordPress site affected?
If your site runs on WordPress, it's running on PHP. So the honest answer is that it depends on which version of PHP your host has your site on.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older don't get updates from the PHP project anymore, so a site on one of those needs a backport from the host or an upgrade to a supported version.
What to do first: patch and update
Before you think about moving anything, take care of today. Moving a site takes time, and patching doesn't.
If you'd like a copy of your whole site on your own computer before anybody starts changing things, Website Sucker can do that too. More on that below.
- Ask your host which PHP version your site runs on. It's often shown in your hosting dashboard too. If it isn't one of the fixed versions above, ask them to update it now.
- Update WordPress, your theme and your plugins. If something has been sitting there waiting for an update for months, update it or remove it.
- Make sure you have a backup that works. A backup you've actually seen restored is worth a lot more than one you've been told exists.
- Ask who's responsible if the site gets hacked. If there's no plan yet, now's a good time to make one.
Is it time to move off WordPress?
For a lot of folks, the answer is no. If your site is patched, somebody is keeping it updated, and you're happy with it, you're in good shape. WordPress is a good tool, and plenty of businesses run on it for years without a problem.
But this week has a lot of people asking bigger questions. Here are the signs it might be time to look at something simpler:
If that sounds like you, one alternative to WordPress after the PHP vulnerability is a static site. It's just files: pages, images and styles. There's no PHP running on it and no plugins to patch, so a flaw like this one has nothing on the site itself to grab onto.
- Your site is mostly a brochure. A few pages, some photos, a contact form. You don't really need a PHP server, a database and a stack of plugins to show that.
- Nobody is really watching it. Whoever built it moved on, and updates happen when somebody remembers.
- You're paying for more than you use. The bill grew, but the site stayed the same.
- You feel locked in. You'd like to leave, but you have no idea how you'd take your site with you.
How to get your website out of WordPress
Here's the part that trips most people up. WordPress has an export under Tools, but it gives you a file of your posts and pages meant for importing into another WordPress site. It doesn't give you the site as it looks.
So instead of exporting from the inside, you copy the site from the outside, the same way a visitor sees it.
Website Sucker visits every page of your site, opens it in a real browser when the site builds its pages with JavaScript, picks up images that only load as you go, and downloads the HTML, images, stylesheets, scripts and fonts. Internal links are rewritten so the copy works offline, and pages are saved at their original paths.
It sticks to the site you enter. Subdomains (like shop.yoursite.com) and outside services like a help center count as separate sites, so just run a separate scrape for each one you want. Images, styles and fonts from other hosts still come along.
Here's the whole process:
It works the same way on Squarespace, Wix, Webflow, Shopify and custom-built sites. It only downloads public pages, so it won't sign in to anything.
- Go to websitesucker.com and paste your site's address.
- Create an account for your first scrape. No card is needed.
- Watch it crawl, then check what it captured before you download anything.
- Download the ZIP for 1 credit ($1.99) and unzip it.
- Open index.html in any browser. That's your whole site, offline, on your own computer.
Turn the download into a site you can edit
A folder of HTML is a great backup. But if you want to keep using it as your website, you'll want to be able to edit it without opening fifty files.
That's where HTMLtoJekyll comes in. Upload the ZIP and it turns that folder into a Jekyll site. It finds the parts every page shares, like the header, footer and navigation, and pulls them into one place, so a change happens once instead of on every page. It can also set the site up so the people who write the content can edit it visually.
The result is a simple site made of files that you can host just about anywhere.
What to check after you move off WordPress
A copy is the groundwork, not the finished house. We've moved real sites off Squarespace and WordPress this way, and these are the things that needed attention:
- The scrape report. Every ZIP includes a short report listing anything that couldn't be downloaded. Some sites block automated visitors on certain pages, so check the list and grab those pages another way.
- Page styling. Now and then a page comes down without its styles and shows up as plain stacked blocks. Click through every page and compare it with the live site.
- Forms. A contact form that sent its messages through WordPress has nothing behind it anymore. Swap in a form service that actually delivers to your inbox.
- Fonts. If your headings suddenly look like Times, the theme's font didn't come along. Add it back.
- Old platform scripts. Some scripts expect to be running on the old platform and throw errors once they aren't. Those can usually come out.
- The mobile menu. Test on a real phone. Menus are one of the places things go sideways, like a menu that's missing on some pages or a hidden one that blocks taps.
- Popups and animations. A popup can get captured stuck open, and fade-in effects can end up playing twice. Both are quick fixes once you spot them.
- Leftover links. Look for emails or links still pointing at the old platform, and swap the default browser tab icon for your own.
- Your URLs. Pages keep their original paths, which helps. If you change any addresses, set up redirects so old links and search results still land somewhere.
- Your domain and DNS. Don't point your domain at the new site until everything's tested. And if your email runs on the same domain, make sure those records come along when you switch.
What a copy can't bring with it
We want to be straight with yall about this part.
A copy captures what visitors can see. Anything that needs a server to work doesn't come along on its own. That means logins and member areas, booking systems, live chat, and forms that relied on WordPress to send. If your store's checkout runs on WordPress, plan for that too.
Embedded videos and maps stay in place as live embeds, so they still need an internet connection.
If your site does a lot of that kind of work, a static copy may not be the right move, and that's okay. It just means making a short list before you decide, so nothing surprises you on launch day.
Is my WordPress site safe after the PHP vulnerability?
It depends on your PHP version. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your host which one your site runs on, and keep WordPress, your theme and your plugins updated.
Is my WordPress site affected by the PHP zero-day?
Every WordPress site runs on PHP, so it's worth checking. If your host has you on one of the fixed versions, you're patched for this one. If you're on PHP 8.1 or older, talk to your host about upgrading.
Do I have to leave WordPress because of this?
No. Patching and keeping things updated is the first fix. Moving is just one option if this has you rethinking your setup.
What are the alternatives to WordPress after the PHP vulnerability?
For a site that's mostly pages, photos and a contact form, a static site is a simple option. It doesn't run PHP or plugins. Website Sucker copies your site, and HTMLtoJekyll turns the copy into a site you can edit.
How do I get my website out of WordPress?
Paste your site's address into Website Sucker to download every public page as a ZIP. Then run that ZIP through HTMLtoJekyll to turn it into a site you can edit. WordPress's own export only covers posts and pages for another WordPress site, not the design.
How do I move from WordPress without losing my design?
Copy the site as it renders in the browser instead of exporting from the dashboard. That way the layout, images, styles and fonts come along the way visitors see them.
Does this work for Squarespace or Wix too?
Yes. Website Sucker renders each page in a real browser before saving it, so sites built with JavaScript, like Squarespace and Wix, come out looking like the live site.
Is it okay to download a website this way?
For your own site, yes. Backing up, archiving or moving your own website is exactly what it's for. Copying somebody else's site to republish it is not. Our plain-English guide, Is It Legal to Download a Website?, goes into more detail.
What if something didn't come through right?
Email the site's address to hello@websitesucker.com and we'll take a look.
Enable JavaScript to use Website Sucker.