Why We Are Retiring PHP & WordPress
A briefing for existing clients. The short version is in the executive summary. The technical detail follows for anyone who wants it.
A moving target in front of every visitor
A WordPress site assembles each page on request: PHP executes, queries a MySQL database, and runs code from the core software, a theme and often a dozen or more plugins. Every one of those pieces is a place where a newly published vulnerability can land, and automated scanners probe for them around the clock.
CISA and the NSA have published ongoing legacy web and attack surface reduction guidance. It urges organizations to shrink internet-facing exposure, retire unsupported software and cut dependence on components that need constant patching. PHP runtime vulnerabilities also appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which lists flaws attackers are using in the wild. Older PHP releases stop receiving security fixes on a fixed schedule, and WordPress plugin flaws turn up in the same kinds of lists. A site that is not patched promptly is exposed.
The risk is not that WordPress is careless. It is that a patch-forever model is hard to sustain for a small business, and one missed update can be enough.
Where the exposure actually is
- Runtime exposure. A live PHP interpreter handles untrusted input on every request, so input-handling bugs in any loaded code become reachable.
- Database exposure. The CMS database is queried on the public path, which makes injection flaws and credential leaks high-impact.
- Plugin supply chain. Third-party plugins and themes update on their own schedules, and abandoned ones stop receiving fixes entirely.
- Administrative surface. A publicly reachable login page invites credential stuffing and brute-force attempts.
- End-of-life PHP. Each PHP branch has a fixed support window. Once it ends, known flaws stay unfixed.
Decoupled Next.js on the edge
No runtime attack surface
Pages are rendered at build time. Visitors receive finished files, not a running application.
No database in the visitor path
Content is not queried per request, so there is nothing for an injection attack to reach.
Deterministic delivery
The code that ships is the code that was tested. It changes only when we deploy it.
Global CDN routing
Files are served from locations near each visitor, which is also why the pages are fast.
| Factor | WordPress / PHP | GSG Next.js |
|---|---|---|
| Runtime on every request | PHP interpreter + web server | None: pre-built files from a CDN |
| Database exposed to visitors | Yes (MySQL behind the CMS) | No database in the visitor path |
| Third-party code to patch | Core + theme + plugins | Reviewed dependencies, locked at build |
| Admin login on the public site | Yes (/wp-admin) | No public admin surface |
| What is served | Generated per request | The same tested files every time |
No architecture is risk-free. Forms, hosting accounts and third-party services still need care, and we manage those as part of managed hosting. The difference is that the largest, most frequently attacked layer is no longer there.
Your content, design and URLs carry over. See how a migration works, check pricing, or just call me.
Talk With Mike