Analysis of WordPress security incidents, static hosting and sustainability, and what they mean for WordPress site owners.
Latest
PHP2Shell is a pair of critical PHP interpreter bugs, fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Where to patch and what a static public site changes.
Read article: PHP2Shell: why updating WordPress will not fix it
CVE-2026-87902 lets an anonymous request make WordPress core include a local PHP file. Whether that leads to code execution takes minutes to check.
Read article: WordPress page-template traversal: when file inclusion becomes RCE
wp2shell is an unauthenticated remote code execution chain in WordPress core. Static WordPress changes your public exposure, but you still have to patch.
Read article: What the wp2shell vulnerability means for WordPress security
The Essential Plugin incident shows how a compromised WordPress plugin becomes a supply-chain risk, and what static WordPress changes and what it does not.
Read article: What the Essential Plugin incident means for WordPress security
With Elementor discontinuing static hosting, former Strattic users need a new home. Staatic is a practical replacement that keeps WordPress static.
Static publishing removes the public PHP and database runtime from WordPress. See where the smaller attack surface helps most and which risks remain.
Static WordPress reduces the server work needed to publish a site, which can also cut its energy footprint. See where the sustainability gains are real.
Why a static site leaves next to nothing to attack, and how Staatic Cloud keeps WordPress private.
SecurityYou keep editing in WordPress as you do now. Staatic publishes your site as finished pages, so it’s safer and faster without new habits.
Visitors and bots get finished pages. On Staatic Cloud, WordPress stays private and pauses when idle.
Pages are built once when you publish, not on every visit.
Download a full backup any time, and the free plugin keeps a site static on your own hosting.
On Staatic Cloud, origin rules send one path, such as an API, to your own server, or to your WordPress with the always-on add-on. Every other page stays static.
Publish your WordPress site as finished pages and see the difference on your own content.