Out of reach of AI-driven attacks

AI now finds and exploits WordPress flaws within hours. Staatic keeps your WordPress private and gives visitors, bots and scanners only finished pages, with no login, plugins or database to attack.

Start your 14-day free trialSee what attackers get

Patching can't keep up anymore

WordPress runs 39.6% of all websites.5 That makes one working exploit worth a lot, because it can be pointed at millions of sites at once. In 2025, 11,334 new WordPress vulnerabilities were published, 42% more than the year before. 91% of them were in plugins, and 46% had no fix available on the day they went public.1

Attackers don't wait for your update window. For the most targeted WordPress flaws, the first attack arrives a median of 5 hours after disclosure.1 AI is making that window shorter still, and this summer it showed what that looks like for WordPress.

July 2026: AI found a way into every default WordPress site

A researcher used an AI model to find a flaw chain in WordPress core itself, with no plugin involved. It let anyone take over a default install without logging in. This is how fast it moved.

  1. An AI model, steered by one researcher, finds the chain that became known as wp2shell.2

  2. WordPress ships 7.0.2. On that day, 60% of organisations running WordPress had a vulnerable site.3

  3. Public exploit code appears and attacks begin. Attackers install backdoors and fake admin accounts.3

  4. The US cybersecurity agency CISA adds both flaws to its list of vulnerabilities being exploited in the wild.4

  5. The flaw lived in the REST API, which a Staatic site doesn't serve to visitors. Owners still updated their private WordPress, but nobody could attack the public site in the meantime. Read our analysis.

What an attacker's scanner gets back

Bots, more and more of them driven by AI, try the same handful of WordPress addresses on every site they find. On a regular WordPress site, each one answers. On a Staatic site there is nothing at those addresses, because the public site is only finished pages.

  • /wp-login.php The login page, where bots guess passwords Regular WordPress 200 Login form Staatic 404 Not there
  • /xmlrpc.php Remote publishing, used to try many passwords in one request Regular WordPress 405 Interface answers Staatic 404 Not there
  • /wp-json/wp/v2/users The REST API, which lists user names Regular WordPress 200 User names listed Staatic 404 Not there
  • /readme.html Tells bots which WordPress version you run Regular WordPress 200 Version shown Staatic 404 Not there
  • /wp-admin/admin-ajax.php Runs plugin code for anonymous visitors Regular WordPress 400 Plugin code reachable Staatic 404 Not there
  • /wp-content/plugins/ The folder that holds your plugin code Regular WordPress 200 Folder reachable Staatic 404 Not there
Responses from a default WordPress install and from staatic.com, which runs on Staatic Cloud.

Check your own WordPress site

We send the requests bots try first to your site, plus a look at your homepage, and show what comes back.

We only request public addresses on that site, the same ones bots request all day, and follow a redirect to its www address if there is one. Only check sites you own or manage.

Start your 14-day free trial Move your public site out of reach in an afternoon.

Your WordPress moves out of reach

The UK's National Cyber Security Centre puts it simply: "If would-be attackers can't reach an interface, they can't attack it."6 Staatic is built on that idea.

The public site

What every visitor, bot and scanner reaches.

  • Finished HTML pages, images and stylesheets
  • Served by Amazon CloudFront over HTTPS (TLS 1.2 or newer)
  • No PHP runs, and there is no login page, REST API, plugin code or database to send requests to

Your WordPress on Staatic Cloud

Where you and your team edit and publish.

  • On its own address, behind a password prompt that comes before WordPress even loads
  • Switched off after 15 minutes without use
  • Each site runs separately, with its own database user and resource limits
  • Daily, weekly and monthly backups you can restore or download

What changes for you

A new plugin flaw stops being an emergency

Visitors never run your plugins, so a flaw in one can't be used against the public site. You update during working hours, not at night before the bots arrive.

Password guessing has nowhere to go

The public site has no login page and no XML-RPC, the two places bots send billions of password guesses a year.7

Your site stays up during an incident

If your WordPress breaks or needs cleaning up, visitors keep getting the last published version while you restore a backup.

What you still look after

No setup makes a website impossible to attack, and we'd rather tell you where the remaining risk sits than pretend there is none.

Keep WordPress updated
Your private WordPress still runs code. Updating it is calm work now, but it still needs doing.
Protect your accounts
Turn on two-step verification for your Staatic account and give team members only the access they need.
Publish from a clean site
Whatever is in your WordPress ends up in the next publication. After an incident, restore a backup first, then publish.
Choose dynamic paths carefully
If you forward paths to a live server with origin rules, those paths are dynamic again and need the usual care.

Using the free self-hosted plugin? The public site is just as static, but keeping your WordPress private is up to you. The preparation guide shows how.

And it's faster too

A finished page is also the fastest thing a server can send. Visitors get it straight from a nearby CloudFront location, without waiting for PHP or a database. Google uses page experience signals like loading speed in its ranking systems,8 so the same change that protects your site also helps it get found.

Read how static publishing changes WordPress security

Start your 14-day free trial

Sources

  1. Patchstack, State of WordPress Security in 2026, February 2026.
  2. Searchlight Cyber, Exploit brokers pay $500,000 for a WordPress RCE, 20 July 2026.
  3. Wiz, Exploitation in the wild of wp2shell, 20 July 2026.
  4. CISA, Known Exploited Vulnerabilities catalog, CVE-2026-63030 and CVE-2026-60137, added 21 July 2026.
  5. W3Techs, Usage statistics of WordPress, 19 October 2026.
  6. UK National Cyber Security Centre, Secure design principles: making compromise difficult.
  7. Wordfence, 2024 Annual WordPress Security Report: over 55 billion password attacks blocked in 2024.
  8. Google Search Central, Understanding Core Web Vitals and Google search results.