WordPress has become nightmare fuel.
Since 2013, I’ve built over 200 websites on WordPress. There are 80+ I still actively manage, and the rest are self-managing (which is terrifying).
When php2shell happened, I had to take every site offline at a moment’s notice. And then I sat around for half the day waiting for the patch. To be fair, I did get the servers patched and the sites back online before many of the larger web hosts out there. But it made me think…
I never wanted to get into web hosting. It was a necessary evil because the “mainstream” choices kept getting slower, harder to use, and somehow also more expensive. Clients kept hitting snags and were like, “Mike, is there any other option for web hosting?”
So I put together my own service offering I called “Managed Web Services”, which included hosting, WordPress updates and maintenance, uptime monitoring and automated backups – on dedicated or containerized droplets. Pretty neat.
This made WordPress sites faster than normal. It helped clients rank better in Google search (and even AI search). It ensured WordPress Core, the theme framework, and plugins stayed updated without breaking anything. And it was nice to have some recurring revenue that was fairly hands-off.
But AI sort of forced the plot twist. Starting around the release of Mythos in April 2026, the ground began to shift. Suddenly, my Wordfence briefings were full of hundreds of security vulnerabilities on a weekly basis. And they weren’t little bugs. They were major security holes in WP core, themes, plugins, and even software at the server level.
After PHP2Shell, I set up a Claude scheduled task with a list of every theme, plugin, and piece of software I use across all sites I’ve built over the last 13 years, and I set it to monitor news websites, security agency alerts, and various forums – and then alert my phone 4x per day with push notifications of anything that needs to be patched. Keep in mind, I’m allowing these alerts while I religiously keep all other notifications on my phone turned off.
This setup has already saved my butt a few times. But it’s exhausting.
And what exactly are the benefits of WordPress? Well, most clients think they want to be able to edit things themselves. But then they don’t actually. It’s easier to email me and have me do in 5 seconds what would have taken them 10 minutes. A handful of my clients actually add team members and post blogs – but you don’t actually need WordPress for that.
And what are the downsides of WordPress?
- It’s slow and clunky
- It’s ugly and not exactly user-friendly
- Crucial, basic functionality requires plugins
- Plugins aren’t auto-updated unless you enable that, and routine updates can send the site into the dreaded “maintenance mode”, requiring FTP access to fix
- Almost every site uses Elementor, Divi, or some other horribly bloated page builder (I went from Ark to Bricks, and Bricks is pretty amazing fwiw)
- Clients drag-and-drop edits without considering the SEO or accessibility implications
- And without going on forever, there are those pesky security issues
So what’s the alternative? I went on the hunt and educated myself. And the same framework kept coming up from expert after expert. Astro.
Astro is a web framework for content-driven websites. And that’s great, because I design content-driven websites.
For nerds: it renders components on the server (or Cloudflare) before sending lightweight HTML to the browser with zero unnecessary JavaScript overhead. And it leverages “islands” (interactive UI components that float within a page of otherwise static, server-rendered HTML) to do neat things without getting in the way of the rendering process.
So in short, Astro is:
- Insanely fast
- Essentially free to host
- Immune to virtually all security exploits (because sites are static)
- Client editable (if you want certain parts to be) with a lightweight tool like PagesCMS
- Version-controlled with Git, so you get unlimited and instant backups, branches, reverts
- Seemingly the preferred framework of AI tools (Claude works great with it, super token-efficient)
And Claude can take client WordPress sites and convert them into pixel-perfect matched Astro sites. I can then edit the files in my text editor or Markdown or set up PagesCMS for things like team bios, blogs, or whatever else needs to change frequently.
My goal is to convert every client WordPress site I manage into Astro by the end of the year – free of charge if they sign up for a Partner Plan.
Partner Plans include an allotment of monthly edits/updates, periodic reviews (for SEO, AI search, and accessibility) and strategy sessions, priority turnaround and the obvious perks of free hosting using a serverless setup, SMTP for forms, no maintenance required, and zero security worries.
A few clients have good reasons to stay on WordPress for now, and I’ll keep managing those on a dedicated, closely monitored server. Anyone else who wants to stick with WordPress, I’ll move to the web host of their choice, where they’ll manage updates themselves – which I don’t recommend.
There’s no way a one-man shop (even one assisted by a swarm of AI agents) can stay on top of these AI-era security issues across 80+ sites. It’s an endless game of cat and mouse: finding exploits, patching exploits. So I’m opting out. The room’s on fire, and I’m stepping outside.