Patch tonight. Migrate to modern, AI-improved.
WordPress migration to Next.js, without a PHP server to patch
Last updated: 2026-10-23 · Shawn Gants
Before
WordPress on a PHP server
Web server
Apache, nginx, or the host's edge
PHP runtime
PHP2Shell lives here, before the CMS
WordPress
Core, plugins, and theme. Still PHP.
Database
Whatever that PHP process can reach
After
Next.js, Netlify, Supabase
Netlify CDN
Prerendered pages and hashed static files
Next.js
TypeScript. No PHP interpreter in the path.
Supabase Postgres
Content in ordinary tables
Row-level security
The database decides who can see a row
Request a free site audit · Estimate a WordPress migration · Read the WordPress to Next.js guide · Compare Drupal with Next.js
WordPress is a PHP application. The WordPress requirements recommend PHP 8.3 or greater, and the same page says older PHP can still run it. This service moves the site off that PHP runtime. It does not patch PHP, and there is no emergency PHP patching service.
Why teams move a WordPress site
Why leave plugin sprawl behind?
Features on a WordPress site usually arrive as plugins. Each one is more PHP to update. WordPress's own hardening guide says to keep plugins updated and to delete a plugin you are not using. Site Health flags plugins that are waiting on an update and flags an outdated PHP version. We do not publish a count of plugin vulnerabilities. The maintenance is the point: the new site keeps the features you still need, as application code you can review, instead of a pile of plugins.
Are WordPress sites exposed to PHP2Shell?
Yes, when the PHP version serving the site is unpatched. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in PHP itself, fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (php.net). Updating WordPress does not fix it. The free PHP version check runs in the browser for a WordPress host the same way it does for Drupal. Your host or system administrator installs the update. Patch guide.
What is the update and maintenance burden?
WordPress core, themes, and plugins each ship updates. Site Health is where WordPress reports an outdated PHP version and plugins waiting to be updated (Site Health). On Next.js, the equivalent work is a dependency update that Netlify rebuilds from Git. That work does not disappear. It stops being a PHP server you patch in place. Our care plan is the monthly version of that.
Will the site be faster?
A typical uncached WordPress request runs PHP and queries the database. The new site can prerender pages and serve them from Netlify. That is a different operating model. It is not a measured speed score for your site. We do not publish before-and-after numbers we have not measured.
Will hosting cost less?
A WordPress host is there to run PHP and a database. After the move, the site is a Next.js app on Netlify plus Supabase. Invoices vary, so this page does not claim a savings amount.
What migrates
| From WordPress | What we do | Notes |
|---|---|---|
| Posts and pages | Rows in Postgres, rendered by Next.js | WordPress's default post types include post, page, and attachment |
| Custom post types | A table or a shared content table, decided in the audit | The identifier and the public slug both matter for redirects |
| Advanced Custom Fields | Field values copied into columns | ACF adds custom fields on edit screens. Repeaters and flexible content are scoped, not waved through |
| Media | Files moved to Supabase Storage | The uploads library, including the attachment post type |
| Users | Accounts in Supabase Auth | Password reset versus a one-time hash check is decided in the audit |
| WooCommerce | Quoted. This is the $499 audit | WooCommerce is the ecommerce plugin: catalog, cart, checkout, orders, and often extensions. It is not the $999 floor and it is not the overnight tier |
| Forms | Rebuilt as React forms | Submissions go to Supabase. We do not run the old PHP form plugin |
| Redirects | A 301 for every current public URL | Extra rules stored by a redirect plugin are listed in the audit before we copy them |
| SEO metadata | Title and description copied when Yoast SEO or Rank Math saved them | Both plugins manage on-site titles and meta descriptions (Yoast SEO, Rank Math). Rankings are not guaranteed |
The field-by-field version of this table is the WordPress to Next.js guide. Terms are in the glossary.
Pricing
The tiers match Drupal migration pricing. Page count is not a price. The quote follows custom functionality, member logins and user data, and integrations.
| Tier | Fee | When it applies |
|---|---|---|
| Standard | From $999 | A WordPress site whose custom work, logins, and integrations fit this tier. The quote rises with that complexity |
| Emergency overnight | $4,999 | The site is down, and it is not a complex rebuild. This is a new site, not a PHP patch |
| Complex audit | $499, credited toward the project | WooCommerce, several integrations, or other heavy custom work. You get a quote after the audit |
There is no emergency PHP patching service. If PHP is unpatched, your host updates it. Use the free PHP check.
How a WordPress migration works
- Audit the public URLs, post types, fields, media, users, plugins, and integrations.
- Model posts, pages, and custom post types as Postgres tables. Member access becomes row-level security.
- Build the Next.js pages and rebuild the forms you still need.
- Copy SEO titles and descriptions from Yoast SEO or Rank Math when those values are stored, and write a 301 for every old URL.
- Cut DNS over, monitor, and hand you the repository.
When not to migrate
- The site is current, the plugin set is small, and your editors want to stay in WordPress. Staying can cost less.
- You need this week's PHP fix. That is your host's update, documented in the patch guide, not a migration.
- The store depends on a web of WooCommerce extensions. Get the $499 audit before you assume a fixed fee.
FAQ
Do you migrate WordPress the same way you migrate Drupal?
The destination stack is the same: Next.js 16, Supabase, and Netlify. The source is different. WordPress content is posts, custom post types, and plugin fields. Drupal content is content types and modules. The Drupal migration service describes that path. Prices are the same tiers.
Does updating WordPress fix PHP2Shell?
No. The bugs are in PHP (php.net). WordPress recommends PHP 8.3 or greater (requirements). An older or unpatched PHP version is your host's update.
Is WooCommerce included in the $999 migration?
No. WooCommerce is quoted. The next step is the $499 audit, and that fee is credited toward the project.
Will SEO titles from Yoast or Rank Math be kept?
We copy the SEO title and meta description those plugins saved on each post or page, and we 301 the old URLs. That does not guarantee rankings.
Do you patch PHP on a WordPress host?
No. There is no emergency PHP patching service. The version check only reads the version string you paste.
Sources on this page
- S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
- S55: WordPress.org: Requirements (recommends PHP 8.3 or greater; page last modified 2026-05-07)
- S57: WordPress developer docs: Hardening WordPress (update plugins; delete unused plugins)
- S58: WordPress.org: Site Health screen (outdated PHP, plugins waiting to be updated, uploads and user info)
- S59: WordPress developer docs: Registering custom post types (post, page, attachment, revision, menu)
- S60: Advanced Custom Fields: Resources (custom fields on WordPress edit screens)
- S61: WordPress.org plugin directory: Yoast SEO (on-site SEO titles and meta descriptions)
- S62: WordPress.org plugin directory: Rank Math SEO (SEO titles and meta descriptions)
- S63: WordPress.org plugin directory: WooCommerce (open-source ecommerce for WordPress)