Practical guides, analysis, and product updates on static WordPress, publishing workflows, and safer site architecture.
Latest
Every Staatic Cloud site now runs PHP with the fix. Published sites run no PHP, and origins require a login, apart from origin rules and some endpoints.
PHP2Shell is a pair of critical PHP interpreter bugs, fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Where to patch and what a static public site changes.
CVE-2026-87902 lets an anonymous request make WordPress core include a local PHP file. Whether that leads to code execution takes minutes to check.
wp2shell is an unauthenticated remote code execution chain in WordPress core. Static WordPress changes your public exposure, but you still have to patch.
Keep canonical URLs, sitemaps, redirects, preview controls, and Search Console visibility intact when publishing WordPress as a static site.
Migrating WordPress to a static site changes more than hosting. Assess fit, audit dynamic dependencies, plan deployment, and launch with a rollback path.
The Essential Plugin incident shows how a compromised WordPress plugin becomes a supply-chain risk, and what static WordPress changes and what it does not.
With Elementor discontinuing static hosting, former Strattic users need a new home. Staatic is a practical replacement that keeps WordPress static.
Use Staatic hooks to fine-tune crawling, URL handling, and publication behavior beyond the settings screen, for sites with unusual routing or deployment.
GitHub Pages is a simple deployment target for smaller static WordPress sites. Set up GitHub and configure Staatic to publish there.