Keep your website. Lose the PHP.
We rebuild your WordPress site as plain HTML on Cloudflare. Same design, same URLs, faster pages, and no PHP, plugins or database left for attackers to target. After launch, we keep it updated for you.
A typical WordPress site
- x-powered-by: PHP/8.1
- /wp-login.php
- /xmlrpc.php
- /wp-json/
- /wp-admin/admin-ajax.php
- /wp-content/plugins/…
- MySQL database
After wp2html
- index.html
- styles.css
- images/
- sitemap.xml
Plain files, served from Cloudflare. Nothing runs when a visitor arrives.
Oct 21, 2026PHP2Shell disclosed
A critical flaw in PHP
Two critical PHP vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were made public on October 21, 2026. Security firm Wiz confirmed that attackers can take over a default WordPress site without logging in. Updating plugins doesn't fix it; only a PHP upgrade does, and PHP 8.1 and older get no official patch.
A static site doesn't run PHP for its visitors, so flaws like this have nothing to reach.
What changes when your site is static
Your visitors see the same site. What's underneath it gets much smaller.
| Aspect | WordPress today | After wp2html |
|---|---|---|
| Runs on | PHP and a MySQL database, on one server | Plain files on Cloudflare's global network |
| Public login page | /wp-login.php, open to anyone | None |
| Updates | Core, theme and every plugin, forever | Nothing to update |
| Page loads | Built by PHP on each visit, unless cached | Already built, served from the nearest data center |
| What search and AI crawlers read | Page-builder markup around your content | Clean HTML with your content, titles and schema |
| If a plugin breaks | Pages can go down until someone fixes it | No plugins to break |
How a move works
You approve every step. Your visitors notice only that the site got faster.
Free check and quote
Tell us your site address. We list every page, form and integration, then send you a quote with a launch date.
Rebuild
We copy every page into plain HTML, keep each URL, and fix SEO problems along the way: titles, descriptions, schema, broken links and slow images.
Preview
You review the new site on a private link, page by page, before anything changes for your visitors.
Launch
We point your domain to Cloudflare, copying your email and other DNS records first, so the switch happens without downtime. We keep a full backup of your WordPress site for 30 days.
Keep improving
Send changes whenever you need them, or let us optimize pages every week. Each change goes live after a preview.
Kept, fixed, removed
Every move ends with the same three lists.
Kept
- Your design and content
- Every URL and its rankings
- Forms, sent to your inbox or CRM
- Call-tracking numbers and analytics
- Your domain and email
Fixed
- Missing titles and meta descriptions
- Schema for your business and services
- Slow, oversized images
- Duplicate and broken links
- Sitemap and search-engine access
Removed
- PHP
- The database
- Plugins and their updates
- wp-login.php and xmlrpc.php
- Page-builder bloat
Built to be read by search engines and AI
Google, ChatGPT, Perplexity and Claude all read your pages before they recommend you.
Why it matters
Most AI crawlers don't run JavaScript. Anything your site builds in the browser can be invisible to them, and slow pages can get skipped.
What we do about it
- Every word of your content is in the HTML itself.
- Schema tells crawlers who you are, where you work and what you offer.
- Pages answer fast, so crawlers don't give up.
- We check that Cloudflare lets search and AI-search crawlers in. Some default settings block them.
Your site still changes whenever you want
Static doesn't mean frozen. Choose how you update it.
We edit it for you
Email us a change, or let us run weekly optimization. We publish to a private preview first, then go live.
Keep WordPress as a private editor
Your team keeps writing in WordPress, locked away where only you can reach it, and every publish turns into static pages. WordPress still needs updates in this setup; we handle them.
Is your site a good fit?
Not sure? The free check tells you.
Good fit
- Service businesses: law firms, contractors, clinics, agencies
- Sites with up to a few hundred pages
- Blogs that publish every week
- Sites built with Elementor, Divi, WPBakery or a theme
Not a fit yet
- Online stores with a checkout (WooCommerce)
- Members-only areas and logins
- Course platforms
- Sites that need live search across thousands of products
Questions
Will I lose my Google rankings?
We keep every URL exactly as it is. If one has to change, we add a permanent (301) redirect so search engines carry its history over. After launch we watch Google Search Console for errors and fix them.
Can I still edit my site?
Yes. Send us the change and we make it, or keep WordPress as a private editor and publish from there. Every change goes through a preview first.
Will my contact forms still work?
Yes. We rebuild each form so submissions reach your inbox or your CRM, such as HubSpot or GoHighLevel, with spam protection.
Do I have to move my domain or email?
No. Your domain stays with your registrar. We move its DNS to Cloudflare, which is free, and copy your email records first so email keeps working.
Where is my site hosted, and what does hosting cost?
On Cloudflare's network, in data centers around the world. Hosting is included in our monthly care plan, so there's no separate hosting bill.
My site uses Elementor or Divi. Is that a problem?
No. That's where most of the speed gain comes from: we keep how each page looks and drop the builder code it no longer needs.
Is wp2html part of WordPress?
No. wp2html is an independent service. We're not affiliated with WordPress, the WordPress Foundation or Automattic.
How long does a move take?
It depends on how many pages and features your site has. Your quote includes a launch date.
Get a quote for your site
Tell us where your site is. We'll reply by email with what moving it involves and what it costs.
Prefer email? Write to hello@wp2html.com.