PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Patch tonight. Migrate to modern, AI-improved.

WordPress to Next.js: what moves, and what is rebuilt

Last updated: 2026-10-23 · Shawn Gants

Before

WordPress on a PHP server

  1. Web server

    Apache, nginx, or the host's edge

  2. PHP runtime

    PHP2Shell lives here, before the CMS

  3. WordPress

    Core, plugins, and theme. Still PHP.

  4. Database

    Whatever that PHP process can reach

After

Next.js, Netlify, Supabase

  1. Netlify CDN

    Prerendered pages and hashed static files

  2. Next.js

    TypeScript. No PHP interpreter in the path.

  3. Supabase Postgres

    Content in ordinary tables

  4. Row-level security

    The database decides who can see a row

Before: WordPress on PHP. After: Next.js on Netlify, with content in Supabase. Illustrative of the stack, not a measured speed score.

This is the guide behind the WordPress migration service. Prices are on the pricing page. Definitions are in the glossary.

WordPress vs Next.js

TopicWordPressNext.js 16 + Supabase + Netlify
Runtime you patchPHP. WordPress recommends PHP 8.3 or greater (requirements). PHP2Shell is fixed only by a PHP update (php.net)No PHP runtime on your host. You still update npm packages
FeaturesPlugins and themes. Unused plugins should be deleted (hardening guide)The features you keep, written in the app and reviewed
ContentPosts, pages, custom post types (register_post_type)Postgres tables rendered by Next.js
Custom fieldsPlugin fields, including Advanced Custom FieldsColumns decided in the audit
CommerceWooCommerce and its extensionsQuoted. $499 audit, credited toward the project
SEO fieldsTitles and meta descriptions in Yoast SEO or Rank MathCopied onto the new pages, plus a 301 for each old URL
HostingA host that runs PHP and a databaseNetlify for the app, Supabase for Postgres, auth, and files
SpeedDepends on the host, the theme, and caching. No number is claimed herePrerendered pages can be cached. No number is claimed here

A Drupal-specific version of this table is Drupal vs Next.js + Supabase.

What each WordPress object becomes

Posts and pages. WordPress stores them as post types. They become records in Postgres and routes in Next.js. The public slug is preserved unless you ask for a new one, and the old URL 301s either way.

Custom post types. A plugin or your own code registers these with register_post_type(). Each public type gets a mapping in the audit: its own table, or a shared content table with a type column. The rewrite slug becomes the new path prefix so existing links still resolve.

Advanced Custom Fields. ACF adds fields to edit screens and stores the values for each post. Simple text, numbers, links, and images become columns or file references. Repeaters, flexible content, and relationship fields are listed in the audit because the shape varies by site.

Media. Attachments and the uploads directory move to Supabase Storage. Image markup uses width and height so the new pages do not jump while loading. Alt text that was stored on the attachment is copied. Missing alt text is flagged for a person, not invented.

Users. WordPress accounts become Supabase Auth users when the site has members or multiple editors. The password approach is chosen in the audit: a reset email, or a one-time check of the old hash at first login. We do not claim every role plugin maps automatically.

Forms. A form plugin's PHP does not move. The form is rebuilt in React, submissions are stored in Supabase, and row-level security limits who can read them. The audit lists each form and where the mail goes today.

Redirects. Every URL that is public at audit time gets a 301. If a plugin stored extra redirect rules, those rows are reviewed and copied when they still make sense. A redirect to a URL we are also redirecting is chained once, not left as a loop.

Yoast SEO and Rank Math. When either plugin saved an SEO title or meta description on a post or page, that text is copied to the new page's metadata. Schema those plugins printed is not copied blindly. The new templates publish their own JSON-LD, and a person reviews it. Canonicals that pointed at the old host are rewritten to the new paths.

WooCommerce. Products, variations, orders, customers, coupons, shipping, and payment extensions are a different project from a brochure site. WooCommerce is the complex tier: a $499 audit, credited toward the migration, then a quote. It is not Standard at $999 and it is not the $4,999 overnight rebuild.

How the migration is done

  1. Export a URL list, the post types, the field groups, and the plugin list.
  2. Load posts, pages, custom post types, field values, and media into Postgres and Supabase Storage with a script that can be run again before launch.
  3. Rebuild navigation, forms, and search against that data. Leave plugin features that the audit marked unused.
  4. Attach the copied SEO title and description, and ship a redirect map with one 301 per old URL.
  5. Switch DNS, watch error logs, and hand over the Git repository.

What this guide does not claim

No traffic totals, no vulnerability counts, and no client results. PHP2Shell's affected versions and the WordPress PHP recommendation are the sourced security facts. Everything else on this page is the scope of the move.

FAQ

Can you migrate only the blog and leave WordPress running?

Yes, if you want a partial move. The audit says which URLs change and which stay. A partial move still needs redirects where the paths change.

Do custom post types keep their URLs?

They keep the public path unless you choose a new slug. Either way, the old path 301s to the new one.

What happens to ACF repeater data?

It is in scope, and it is mapped field by field. A repeater is not dropped, and it is not assumed to be a single column.

Is there a fixed price for WooCommerce?

No published project price. The paid audit is $499 and is credited toward the project. See pricing.

See the WordPress migration service

Sources on this page

  1. S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
  2. S55: WordPress.org: Requirements (recommends PHP 8.3 or greater; page last modified 2026-05-07)
  3. S57: WordPress developer docs: Hardening WordPress (update plugins; delete unused plugins)
  4. S59: WordPress developer docs: Registering custom post types (post, page, attachment, revision, menu)
  5. S60: Advanced Custom Fields: Resources (custom fields on WordPress edit screens)
  6. S61: WordPress.org plugin directory: Yoast SEO (on-site SEO titles and meta descriptions)
  7. S62: WordPress.org plugin directory: Rank Math SEO (SEO titles and meta descriptions)
  8. S63: WordPress.org plugin directory: WooCommerce (open-source ecommerce for WordPress)