Website Strategy & Ownership
The Case for Moving On
You should not need a software maintenance department to publish your business hours.
A service business needs clear information, convincing work, fast pages, and an easy way to make contact. Yet a straightforward website can come bundled with a database, a public login, a page builder, a collection of plugins, and a recurring obligation to keep them working together.
My position: most business websites should move away from WordPress. A CMS is no longer necessary for the work those websites actually do.
01 / The Wake-Up Call
This week’s PHP issues exposed the dependency beneath the dashboard.
On October 21, 2026, PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both can enable unauthenticated remote code execution. PHP’s advisory called for immediate updates and warned that partial mitigations do not provide complete protection. PHP security advisory.
These are flaws in the PHP runtime. They do not establish that every WordPress website was compromised. The connection is the dependency: WordPress requires PHP and a MySQL-compatible database, as its official requirements explain. Updating the WordPress dashboard alone does not establish that the host’s PHP installation has been patched.
The PHP Foundation’s account describes a difficult repair effort involving compatibility trade-offs, limited specialist resources, and changes to its security processes. That work deserves credit. It also shows how much infrastructure a small business can depend on without ever seeing it.
On October 23, PHP also published a narrowly scoped session upload progress advisory involving unusual configuration and application behavior. It deserves attention where applicable, without treating every installation as equally exposed. PHP follow-up notice.
The business question is bigger than this patch: why keep a live publishing engine on a website that mostly delivers finished pages? If a visitor simply needs to read about your services, that dependency should earn its place.
02 / The Recurring Bill
The expensive part is everything you have to keep compatible.
WordPress is free to download. Operating a WordPress website still takes time, responsibility, and often paid services. Someone has to maintain the core software, extensions, theme, hosting environment, backups, and recovery process. If a premium plugin controls a key feature, its renewal becomes part of the cost of keeping that feature dependable.
Consider a local contractor whose website has twelve service pages, a project gallery, a contact form, and three new articles a year. A full publishing platform may give that owner editing access. But if the owner still sends every change to a designer, much of the promised independence exists only in theory. The maintenance is real either way.
Updates
Changes need an owner who checks compatibility and confirms that important features still work.
Dependencies
A builder, form extension, or abandoned theme can turn a small change into a larger project.
Attention
Time spent tending the platform competes with time spent improving the content and customer experience.
Good maintenance has value. The stronger investment is often removing unnecessary maintenance altogether. Before agreeing to another year of keeping the same stack alive, ask what business capability you would actually lose by simplifying it.
03 / A Different Publishing Model
You can keep publishing without keeping a CMS.
A website does not need a database to have a blog. An article can be a finished page, with a title, date, author, images, links, and search metadata. A publishing workflow can add the page and update the article list before the site goes live. Visitors receive the result.
Modern editing tools and AI assistance make direct changes more approachable. A developer can update structured content, reuse established layouts, and prepare new pages without adding another dashboard. Human review still matters: someone must check facts, accessibility, design, links, and the final result. Faster production does not replace responsibility.
For an owner who changes a few paragraphs, adds occasional projects, or publishes monthly, that can be a much better fit. There should be a clear way to request or make changes, preview them, approve them, and restore an earlier version. Those are workflow requirements. They do not automatically require WordPress.
Content management is a task. A content management system is one possible tool. The tool stopped being mandatory when simpler workflows could handle the actual publishing needs. Your site should be designed around those needs instead of inheriting a CMS by default.
04 / Less to Carry
A simpler website gives every moving part a reason to exist.
With a properly designed static site, the public website can serve HTML, CSS, JavaScript, and images without running WordPress, PHP, or a content database. Removing those components from the public hosting environment removes those particular components as attack targets. A static export does not achieve that if the old WordPress installation remains exposed elsewhere.
There is also an opportunity to deliver less code, optimize images deliberately, and build layouts without a general-purpose page builder. That can improve performance, but it must be measured. Large media, unnecessary scripts, or poor implementation can make any website slow.
A contact form, booking tool, or checkout can use a carefully chosen service when needed. Each connection still brings privacy, cost, availability, and maintenance decisions. Keep those decisions visible, and avoid recreating an oversized platform out of dozens of external services.
Ownership matters, too. Ask for the source files, account access, content exports, deployment instructions, and a practical handover. Portable files can make a future move easier, provided your agreement gives you control of the work. A new platform should not replace one kind of dependence with another.
And keep the SEO conversation honest. Leaving WordPress does not automatically raise search rankings. Useful content, crawlable pages, good metadata, sensible links, and careful redirects still need deliberate work. The opportunity is a cleaner foundation for that work.
05 / Make the Move Count
Convert the website around the business you have now.
My recommendation for a typical service business, portfolio, or informational website is to make a plan to leave WordPress. Start by listing what customers actually use and what the team actually edits. Preserve the useful content and essential functions. Remove the accumulated machinery that no longer serves either group.
- Secure the existing site first. Confirm that the host has applied the relevant PHP updates. A future migration does not protect the current installation.
- Map the content and addresses. Inventory pages, articles, images, downloads, forms, and existing links before rebuilding.
- Rebuild the essentials. Preserve valuable URLs where practical, add redirects where they change, and check metadata, accessibility, mobile layouts, and customer actions.
- Agree on future updates. Define who changes content, how it is reviewed, how quickly it is published, what it costs, and how recovery works.
- Retire the old installation. Verify the replacement, retain a secure archive, and remove the publicly reachable WordPress files and database access that are no longer needed.
A large newsroom with publishing approvals, a complex membership service, or a store deeply integrated with WooCommerce needs a separate assessment. A CMS can still earn its place in those environments. Those cases should not dictate the architecture of a small business brochure site.
For most straightforward business websites, the case for a CMS has become weaker than the habit of installing one. This week’s PHP issues are a reason to review that habit. Build a website your business can own, update, and afford to maintain. Make every layer justify the responsibility it adds.
Take the Next Step
Ready for a simpler website?
I can review your current site, identify what is worth keeping, and plan a move away from WordPress around your content, customers, and future updates.
Let’s Talk