Move off WordPress, Joomla or another platform without losing a page
A business site should not depend on dozens of strangers keeping their code safe. We move it to a site with no plugins to patch and no WordPress login to attack, and keep every page and address where it was. In October 2026 two flaws in PHP itself, the language WordPress and many other systems run on, joined the US government's list of exploited vulnerabilities.
In 2025, 11,334 security flaws were disclosed across WordPress, its plugins and themes. Nine in ten were in plugins, nearly half had no fix on the day, and the first exploit attempt on the flaws attackers cared about came a median of five hours later. In 2026 the trouble reached the update channel itself: script served by one plugin vendor to more than a million sites was tampered with for several hours in June.
A WordPress page
- The visitor's browser asks for the page
- The web server starts PHP
- PHP asks the database for the content
- Every active plugin and the theme run, on every visit
- The page is built, then sent
A page on a site we build
- The visitor's browser asks for the page
- A file already built is sent from the nearest of a global network of servers
For a page like this, nothing runs on the server, so there is nothing on it to attack.
Other platforms
The method does not depend on WordPress. A site on Joomla or another platform is moved the same way: every page and address listed, the content carried across and checked, a redirect map you see before launch, and no code from the old site. The figures above come from our research into WordPress.
How it works
Audit
Every page, address, product, form, file and image on the current site, listed and measured. A Website Risk Analysis covers this.
Plan and fixed price
What moves, what is retired and why, what the editor and forms must do. Nothing is retired without your agreement.
Build
The new site is built beside the old one. Content comes across, checked. No code does.
The redirect map
Every old address listed against its new one, with a permanent redirect where it changes. You see the list before launch.
Launch
The domain is pointed at the new site; the old one serves until that moment. No downtime.
Care
Thirty days included, then ongoing care if you want it.
See a redirect list
| Old address | Goes to | Code |
|---|---|---|
/services/website-development/ | /services/websites/ | 301 |
/case-studies/why-speed-matters/ | /insights/what-makes-a-website-fast/ | 301 |
/services/seo/ | /website-risk-analysis/ | 301 |
/products/ | /work/ | 301 |
/writing/* | /insights/:splat | 301 |
What stays, what changes
Stays
Your addresses, your content, your forms and where they deliver, your search standing, your team's ability to edit (see the editor), and your design if it works.
Gone
The plugins, the WordPress login, the database and the application running for each visitor.
Added
Pages usable on a mobile phone in under two seconds, measured and shown; every change saved with a history; a simple editor with two-factor sign-in; code, domain and hosting in accounts in your name, or transferable to you on request.
What we promise, and you can check
- Every address kept or redirected, with the list shown to you before launch.
- No plugins to patch and no WordPress login to attack.
- Main content on screen in under two seconds on a mobile phone, measured and shown.
- Your team edits the site as easily as before, and every change is saved and reversible.
- The code, the domain and the hosting are in accounts in your name, or transferable to you on request.
If you have a shop
A WooCommerce shop is harder to leave than a website, because the business logic lives in it. We move a shop in phases onto the pattern we built for OpenThrottle's new trade shop, with customers and prices carried across and every price re-checked on the server. Shops are quoted after an audit.
If you have been hacked
Do not rebuild in place. Put a holding page up, change every password, and tell us. The migration becomes the fix rather than a cleanup that leaves the back door in.
Who should stay
A WordPress site with a few maintained plugins, a team that knows it and someone patching within 14 days is a reasonable choice. We look after such sites under ongoing care and will say plainly if yours is one.
Who this is not for
- A site whose owner wants a visual page builder and will not accept a simpler editor.
- A site that depends on logged-in members or real-time data on every page, where a server-rendered application is the better tool.
- A well-run WordPress site with a small plugin set, a team that knows it and a budget for care. See Who should stay.
How we price it
We quote every migration after the audit, and the price is fixed from then.
Questions people ask
Will we lose our Google ranking?
No, if every address is kept or redirected, and we show you the list before launch. Google treats a permanent redirect as the signal that the new page is the one to index. We watch the old addresses in Search Console for 90 days. How to leave WordPress without losing a page
How long are we offline?
Not at all. The new site is built beside the old one, which serves until the domain is pointed at the new one. We measure both on launch day. How a project runs
What if we want to go back?
Your old site is archived before launch and can be restored. Your content is plain files in a repository in your name or transferable to you on request, readable by any engineer. You are not locked in. About
Tell us the address and what the site needs to do.
An engineer will reply within one working day with what it would take.
Talk to an engineer about your site