Why I've Been Moving Clients Off Self-Hosted WordPress for Years

When the PHP2Shell news broke last week, a few clients called to ask if they were okay. Most of them already were. That wasn't luck.

For years I've been telling clients the same thing in kickoff meetings: a self-hosted WordPress site is a server you own, and a server you own is a server you have to defend. Every plugin is someone else's code running with the keys to your business. Every PHP version eventually goes out of support. Most small businesses don't have anyone whose job is to watch for that.

Where it started

[STEWART: Your TrueCar story here, 2–4 sentences. What did you see on that project, and what made you think "this is how it goes wrong"? Keep it to what you saw firsthand.]

Since then, my default advice has been simple. Marketing sites go on Webflow. E-commerce goes on Shopify. Both handle hosting, security and platform updates for you, so you're not depending on someone to patch a server on time.

I didn't expect AI to be the trigger

To be honest about it: I wasn't predicting AI would find the bug. I figured it would be a bad actor, the same way it has played out again and again. A plugin gets sold and quietly backdoored. Someone steals a developer's password. PHP itself gets tampered with at the source. (We've written up a few of these: the 2021 PHP backdoor, the 2024 PHP-CGI ransomware wave and the WordPress plugin supply-chain attacks.)

What changed this month is speed. AI helped researchers turn decades-old bugs into working attacks fast, and attackers have the same tools. The gap between "bug found" and "your site is compromised" is shrinking.

What this isn't

This isn't "WordPress is evil." Plenty of WordPress sites are well run by teams who patch fast. If that's you, keep going.

And no platform is unhackable. Moving to a managed platform doesn't remove risk. It moves the patching job to a company whose entire business depends on doing it well, and it removes the plugins and server you'd otherwise have to babysit.

[STEWART: Optional client example. "When we moved [client] to Webflow in [year], they ..." Use only with permission.]

If you're on WordPress today

You have two honest options, and I'll help with either one. Patch it or move it →

— Stewart Ramsey, Founder, The R&D Dept.