Practical guides, security analysis and product news on static WordPress, publishing and safer sites.
Latest
Every Staatic Cloud site now runs PHP with the fix. Published sites run no PHP, and origins require a login, apart from origin rules and some endpoints.
Read article: PHP2Shell on Staatic Cloud: protection and patching
PHP2Shell is a pair of critical PHP interpreter bugs, fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Where to patch and what a static public site changes.
Read article: PHP2Shell: why updating WordPress will not fix it
CVE-2026-87902 lets an anonymous request make WordPress core include a local PHP file. Whether that leads to code execution takes minutes to check.
Read article: WordPress page-template traversal: when file inclusion becomes RCE
wp2shell is an unauthenticated remote code execution chain in WordPress core. Static WordPress changes your public exposure, but you still have to patch.
Read article: What the wp2shell vulnerability means for WordPress security
Keep canonical URLs, sitemaps, redirects, preview controls, and Search Console visibility intact when publishing WordPress as a static site.
Migrating WordPress to a static site changes more than hosting. Assess fit, audit dynamic dependencies, plan deployment, and launch with a rollback path.
The Essential Plugin incident shows how a compromised WordPress plugin becomes a supply-chain risk, and what static WordPress changes and what it does not.
Read article: What the Essential Plugin incident means for WordPress security
With Elementor discontinuing static hosting, former Strattic users need a new home. Staatic is a practical replacement that keeps WordPress static.
Use Staatic hooks to fine-tune crawling, URL handling, and publication behavior beyond the settings screen, for sites with unusual routing or deployment.
GitHub Pages is a simple deployment target for smaller static WordPress sites. Set up GitHub and configure Staatic to publish there.
You keep editing in WordPress as you do now. Staatic publishes your site as finished pages, so it’s safer and faster without new habits.
Visitors and bots get finished pages. On Staatic Cloud, WordPress stays private and pauses when idle.
Pages are built once when you publish, not on every visit.
Download a full backup any time, and the free plugin keeps a site static on your own hosting.
On Staatic Cloud, origin rules send one path, such as an API, to your own server, or to your WordPress with the always-on add-on. Every other page stays static.
Publish your WordPress site as finished pages and see the difference on your own content.