Section
Analysis and perspective on static WordPress, security, and site architecture.
Latest
CVE-2026-87902 lets an anonymous request make WordPress core include a local PHP file. Whether that becomes code execution depends on your theme’s folders, whether PEAR is installed, and one PHP setting, and all three take minutes to check.
wp2shell is an unauthenticated remote code execution chain in WordPress core, not a plugin. Here is what static WordPress changes about your public exposure and what you still have to patch.
The Essential Plugin incident shows how a compromised WordPress plugin can become a supply-chain risk. Here is what static WordPress changes, and what it does not.
With Elementor discontinuing static hosting, former Strattic users need a new home. This piece looks at Staatic as a practical replacement for teams that want to keep the static WordPress model.
Static publishing changes the security profile of WordPress by removing the public PHP and database runtime. This article explains where that reduced attack surface helps most, and what risks still remain.
Static WordPress reduces the amount of server work needed to publish a site, which can also reduce its energy footprint. This piece looks at why that matters and where the sustainability gains are most real.