Migrate Off WordPress Without Losing Rankings
leave wordpress and php behind
Migrate off WordPress, WooCommerce or a custom PHP app. We map every URL, move your content and data, and rebuild on a site with no PHP to patch.
Why Businesses Are Moving Away From WordPress
In October 2026, two critical flaws in PHP itself let attackers run code on web servers without logging in, and the FBI told organizations that couldn't patch to take those systems offline. Every WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel site was running on that language. We covered it in what to do about CVE-2026-109618.
That was the emergency version. The everyday version is the plugin update treadmill: a site that runs code on every visit needs someone to keep patching it, and the bill arrives when nobody does. We wrote up the hidden costs of plugin dependencies and why we move our own WordPress clients.
Migrating off WordPress means your public site stops running PHP at all. Pages are built ahead of time and served as files, so there's nothing on them for a request to take over.
What Changes When You Leave PHP Behind
| Compare | WordPress or PHP site | Built on Araptus Highlander |
|---|---|---|
| What runs when someone visits | PHP, a database query and your plugins, then the page | Nothing. The page was built ahead of time |
| What needs patching | PHP, WordPress core, and every plugin and theme | No public runtime to patch |
| Who patches it | You, your host, or whoever built it | We do |
| Forms, bookings, payments | Plugins inside the same application | Small separate services, isolated from the pages |
| Editing content | The WordPress admin | A headless CMS, or we publish for you |
What We Migrate Off WordPress and PHP
Most moves are one of three kinds. Plenty of businesses have two of them at once.
A WordPress website
Pages, posts and images move across to Araptus Highlander. Every live URL is mapped to its new home.
A WooCommerce store
The storefront is rebuilt on Highlander. The catalog stays on WooCommerce as a backend, or moves to Shopify or Medusa.
A custom PHP application
A Laravel app, an older CRM or a member portal, rebuilt as a custom platform with its data moved across.
Want to keep the WordPress editor? That's possible. WordPress becomes a private content source, and the public site is built from it ahead of time, so visitors never reach PHP. The trade-off is that you're still running a WordPress install, and it still needs updates. Most clients move their content to a headless CMS instead.
For applications, the data comes out of the old database and moves with Conduit, our migration engine, which shows you every record it would write before it writes any.
How We Protect Your Rankings in the Move
A migration done carelessly throws away years of search authority. Done properly, it keeps it.
Baseline first
Search Console and speed numbers recorded before anything changes, so we can measure the move.
Every URL inventoried
Pages, posts, categories, images and PDFs. If it's live and linked, it's on the list.
A 301 for every old address
Visitors, bookmarks and backlinks all land on the new page, and the authority each page earned carries across.
Content and metadata carried over
Titles, headings, descriptions and copy come across intact, so Google still recognizes each page.
Indexing checked after launch
We watch Search Console after the switch and chase down any 404s that show up.
One honest note: expect a short dip while Google re-crawls the new site. That's normal, and the redirect map is what makes sure it's a dip and not a loss.
How a Migration Works
01
Inventory
Every URL, form, plugin and integration on the current site, and what each one actually does.
02
Map
Each old URL gets a new home, and each plugin gets a replacement or is dropped.
03
Rebuild
The new site is built and reviewed alongside the old one, which stays live.
04
Move data
Content, customers and records move across, previewed before anything is written.
05
Switch and watch
The domain is pointed at the new site with redirects in place, then we watch indexing.
What You Own Afterwards
Your brand, your domain and its registrar account, your content and images, and your customers and their data. On request, and always if we part ways, we export them in standard formats and help point your domain wherever you choose.
The software and hosting are licensed and stay with Araptus. That's the part we keep patched, so you don't have to.
What Leaving Doesn't Fix
A site with no PHP removes one specific risk: software that runs on every public request. Your domain, your DNS and the accounts that can reach your hosting are still targets, and forms and payments still run on servers that need patching. They're just small and separate, so a flaw in one doesn't put the whole site in play.
And if a capable developer keeps your WordPress site patched and it earns its keep, you may not need to move this year. Patch to a fixed PHP release either way.
Before You Decide
PHP Vulnerability CVE-2026-109618: What to Do Now
The October 2026 PHP flaws, how to tell if you're affected, and what to patch today.
WordPress Security Vulnerabilities: The Hidden Costs
What plugin dependencies cost when one of them is breached.
Why We Migrate Every WordPress Client to Highlander
The case for leaving WordPress, beyond security.
Proactive Security: An Early Development Incident
Why we build security in from day one instead of patching it on later.
Tell Us What Your Site Runs On
Send us the address. We'll tell you what's under it, what a move would involve, and quote it.
