Skip to content

Out of reach of AI-driven attacks

Staatic keeps your WordPress private. Visitors and bots only ever get finished pages.

Start your free trial See what attackers get
July 2026: a WordPress core takeover
Vulnerabilities
Affected
Default installs of WordPress 6.9 and 7.0
Fixed in
WordPress 6.9.5 and 7.0.2
  1. Found

    One researcher with an AI model finds a takeover chain in WordPress core for about $25 of compute. No plugin or login needed. Searchlight Cyber

  2. Patched

    WordPress 6.9.5 and 7.0.2 ship the fix. 60% of organizations in Wiz’s data had a vulnerable site.

  3. Attacks begin

    Public exploit code appears. Attackers install backdoor plugins and collect admin user names. Wiz

  4. Listed as exploited

    The US cybersecurity agency CISA lists both flaws as exploited in the wild.

Public sites on Staatic: not exposed. The attack needs the REST API, which they don’t have. Read our analysis

Updates arrive after the attacks start

WordPress runs 39.5% of all websites. W3Techs A working exploit can be pointed at millions of them within a day, as it was in July. Staatic doesn’t race the patch: the public site has nothing for the exploit to run on.

11,334
new WordPress vulnerabilities in 2025, 42% more than in 2024. 91% were in plugins. Patchstack, 2026
46%
had no fix on the day they went public. Patchstack, 2026
5 hours
median from disclosure to the first attack, for the most targeted flaws. Patchstack, 2026

What an attacker’s scanner gets back

Bots try the same WordPress addresses on every site they find. A default install answers each one. A Staatic site has nothing there.

  • /wp-login.php The login page, where bots guess passwords Default WordPress 200 Login page found Staatic 404 Not found
  • /xmlrpc.php Remote publishing, used to try many passwords in one request Default WordPress 405 XML-RPC answers Staatic 404 Not found
  • /wp-json/wp/v2/users The REST API, which lists user names Default WordPress 200 1 user name listed Staatic 404 Not found
  • /readme.html Tells bots the site runs WordPress Default WordPress 200 Readme present Staatic 404 Not found
  • /wp-admin/admin-ajax.php Runs plugin code for anonymous visitors Default WordPress 400 Plugin code reachable Staatic 404 Not found
  • /wp-content/plugins/ The plugins folder; most hosts hide its contents Default WordPress 200 No plugin list Staatic 404 Not found
Responses from a default WordPress 7.1.4 install and from staatic.com on 6 November 2026.

Check your own WordPress site

We request the addresses bots try first, plus your homepage, and show what comes back.

We only request public addresses, the same ones bots try all day. Only check sites you own or manage.

Start your free trial Move your public site out of reach in an afternoon.

Two separate places: the public site and your WordPress

“If would-be attackers can’t reach an interface, they can’t attack it,” says the UK’s National Cyber Security Centre.

The public site

What visitors and bots reach.

  • Finished HTML pages, images and stylesheets
  • On Staatic Cloud, served over HTTPS from Amazon CloudFront
  • No PHP, login page or database to send requests to

Your WordPress on Staatic Cloud

Where you and your team edit and publish.

  • On its own address, behind a password prompt in front of WordPress
  • Paused after 15 minutes without use, unless you turn on the always-on add-on
  • Isolated from other sites, with its own database user and resource limits
  • Daily, weekly and monthly backups you can restore or download

Where your data lives

Your WordPress, its backups and your Staatic account are hosted in the EU. Your public pages are served worldwide, because a page that comes from near each visitor loads fast.

Staatic is a Dutch company. On your own hosting, your WordPress stays there; your account, forms and search are hosted with us in the EU. Read our data processing agreement and privacy policy.

Hosted in the EU

Your WordPress on Staatic Cloud
Its files and database
Its backups
Daily, weekly and monthly
Your Staatic account
The dashboard, form submissions and attachments, and the search index

Served worldwide

Your public pages
The finished pages anyone can visit, from 250+ locations (400+ on Enterprise)

What changes for you

A new plugin flaw stops being an emergency

Visitors never run your plugins, so a flaw in one can’t reach the public site. You update during working hours.

Password guessing has nowhere to go

The public site has no login page and no XML-RPC, where bots send billions of password guesses a year. Wordfence, 2024

Your site stays up during an incident

If your WordPress breaks, visitors keep getting the last published version while you restore a backup. See what keeps running.

An old WordPress or PHP version you can’t update yet? Staatic runs on WordPress 5.0 and PHP 7.1 or newer. Publish it as static pages and visitors no longer reach the old code, so you can update when it suits you.

Requirements

What you still look after

Keep WordPress updated
Your private WordPress still runs code. A security plugin there helps too: the two work together.
Protect your accounts
Use two-step verification and give team members only the access they need.
Publish from a clean site
Whatever is in your WordPress goes out with the next publication, scheduled ones included. After an incident, restore a backup before you publish.
Choose dynamic paths carefully
Paths you send to a live server with origin rules, such as an API, can still be attacked. Protect them like any dynamic site.

On the free self-hosted plugin, the public site is just as static, but keeping WordPress private is up to you. See the preparation guide.

Keep your WordPress out of reach

Try Staatic Cloud on your own site for 14 days. Faster too: staatic.com’s homepage took 42 ms to its first byte from Staatic and 227 ms from our WordPress. See the measurements.

Start your free trial Talk to us first
  • No payment details needed
  • The trial ends automatically
  • You keep editing in WordPress