Migrating from WordPress and legacy CMS platforms

A lot of company websites run on a PHP server that someone has to keep up to date: PHP itself, the CMS, the theme and every plugin. Once that stops happening, the site becomes a liability. We move it to a headless setup where the content lives in a separate CMS and the pages are served as ready-made HTML, so there's no PHP server left to patch.

Why PHP sites need a look now

In October 2026, PHP2Shell was disclosed: two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619) that let an attacker run their own code on the server without signing in. The flaws are in PHP, not in the site's own code, so every site on a vulnerable PHP version is exposed. Fixed versions are out, but PHP 8.1 and older get no new official releases, and PHP 8.2 loses security support on 31 December 2026. Sources: PHP's changelog for 8.2.35 and 8.4.27 (22 October 2026) and PHP's supported versions.

What we migrate from

• WordPress, including the theme, page builder and plugins
• Drupal and Joomla
• Custom-built PHP sites
• Older versions of Umbraco and other CMSs that no longer get security updates

Umbraco runs on .NET and isn't affected by PHP2Shell, but older versions share the underlying problem: without security updates, they get harder to keep safe every year.

How the migration works

• We audit the site: pages, content types, forms, plugins, integrations and which pages get traffic.
• We build a content model in the new CMS around how you edit, not around what the old system demanded.
• Text, images, documents and metadata are moved over automatically, so nobody has to paste pages in by hand.
• Every old address gets a 301 redirect to its new page, so links keep working and search engines find the right place.
• The new site runs alongside the old one until everything is checked, and the switch happens with no downtime.

If the site needs securing today

A migration happens in stages. If your site is exposed right now, we start by checking which PHP version it runs and whether the fixed releases are installed, and we help you or your host upgrade so the site is protected while the new one is built.

What you get

A site served as ready-made HTML with no PHP server to keep updated, a CMS your editors are happy working in, and the code, content model and documentation in formats you can use yourselves. We always propose that you own all of it, and where that isn't fully possible, the contract says so.