A WordPress alternative with no PHP to patch and no hosting bill
Move your website to Astro on Cloudflare: no database, no plugins and nothing on a server for hackers to break into. Pages load from Cloudflare's global network, hosting is free on Cloudflare's own plan, and you keep your design, content and Google rankings.
- Led by Muhammad Younus
- Building websites since 2019
- Top Rated Plus on Upwork
- Free migration audit
Written by Muhammad Younus, founder of Renozer. Last updated 23 October 2026. Editorial policy.
Same website. Nothing on a server to hack.
Static pages served from Cloudflare's network, with no PHP, plugins or database behind them.
Why WordPress sites are under attack right now
The October 2026 PHP flaws, in plain English.
On 21 October 2026 the PHP project shipped emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both score 9.2 out of 10, and both let an attacker run code on a web server without logging in. Cloudflare said it was already seeing attacks before the patches came out.
PHP is the language WordPress runs on, so every self-hosted WordPress site depends on its host installing PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. The UK's National Cyber Security Centre told organisations to update systems that use PHP or take them offline until they're patched. Sites still on PHP 8.1 or older don't get official fixes at all, and PHP 8.2 stops receiving security updates on 31 December 2026.
- The flaws
- CVE-2026-109618 and CVE-2026-109619
- Severity
- 9.2 out of 10 (CVSS v4)
- Fixed in
- PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12
- No official fix
- PHP 8.1 and older
- Who has to patch
- Your web host, or you if you run the server
- Not affected
- Static sites with no PHP, such as Astro on Cloudflare
Sources: BleepingComputer, Kaspersky and php.net supported versions.
It isn't only PHP: plugins are the bigger risk
What Patchstack found across the WordPress ecosystem in 2025.
Source: Patchstack, State of WordPress Security in 2026.
The hidden cost of a cheap WordPress site
Someone has to update PHP, WordPress, the theme and every plugin, check nothing broke, and do it within hours of a warning. If there's no budget for that, the site is quietly exposed. Our Website Care plan covers it from £79 a month, but plenty of small businesses don't want a monthly bill just to stand still.
What about Wix, Squarespace and Shopify?
An honest answer: they're safer than a neglected WordPress site, but you never stop paying.
Hosted builders don't run on a PHP server you look after, so PHP2Shell isn't your problem on Wix, Squarespace or Shopify. Each platform patches its own systems, and that's a real strength. The trade-off is that you rent the website. Plans typically cost around £10 to £35 a month on Wix or Squarespace and £19 to £65 a month on Shopify, the price climbs as you add features, and you can't take the site's code with you if you leave.
- Monthly fees for as long as the website exists
- Every app or add-on is code from another company that you have to trust
- A weak or reused password can still hand someone your account
- Leaving means rebuilding, because the site only runs on that platform
If you sell hundreds of products and need stock, payments and delivery in one place, Shopify is often still the right answer, and we'll say so in your audit. For a service business with ten to forty pages, there's a cheaper and safer option.
How an Astro website on Cloudflare works
Same design and content, with nothing on a server to break into.
Astro is a free, open-source tool that builds every page of your site in advance as plain HTML files. Those files go to Cloudflare Pages, which serves them from data centres around the world. When a visitor opens your site there's no PHP running, no database being queried and no admin login on the live site for anyone to guess.
Cloudflare's own documentation says requests to static assets are free and unlimited on both its free and paid plans, so a typical small business site has no hosting bill. You'll still pay for your domain name, usually around £10 to £20 a year, and for business email.
It isn't a niche choice. Cloudflare bought the team behind Astro in January 2026, and in April it launched EmDash, an open-source CMS built on Astro that it calls a modern successor to WordPress. The framework stays free and open source.
Sources: Cloudflare press release, 16 January 2026 and ITdaily on EmDash.
- No PHP, WordPress core or plugins to update
- No database to break into or corrupt
- Free hosting on Cloudflare's network, with SSL included
- Contact forms that still work, protected by Cloudflare Turnstile
- Pages that load fast on phones because they're already built
Edit your website from your phone with ChatGPT or Claude
The part WordPress, Wix and Squarespace can't offer you.
We connect your Astro website to your own ChatGPT or Claude account. You type what you want in plain English, the AI makes the change, and you get a preview link on your phone before anything goes live. Nothing is published until you say so.
That covers the jobs small businesses usually pay a developer for: a new price, a team photo, an opening-hours change, a seasonal offer or a whole new landing page for an advert. Your site keeps its design rules, so a quick edit can't break the layout, and every change is saved, so any edit can be undone.
- AskType the change into ChatGPT or Claude on your phone.
- CheckOpen the preview link Cloudflare builds in a minute or two.
- PublishApprove it and the change is live, or ask for another tweak.
You'll need your own ChatGPT or Claude account, usually a paid plan. We set up the connection and show you how to use it on a short call.
Build a landing page in two sentences
Build a landing page for homeowners in Stockport with a leaking roof to book a free roof inspection.
Use our brand and reviews, add the quote form and our phone number, and publish it at /roof-repair-stockport/ once I approve the preview.
Fill in the highlighted parts:
- Who it's forThe customer and the town, as specific as you can
- What you want them to doBook, call, get a quote or buy
- Where it livesA short web address, such as /offer/
Add a third sentence for anything special: an offer end date, a photo to use or a question to answer.
WordPress, website builders and Astro compared
How the three options differ for a typical service business with ten to forty pages.
| WordPress | Wix, Squarespace or Shopify | Astro on Cloudflare | |
|---|---|---|---|
| Hosting cost | Around £5 to £30 a month | In a plan of £10 to £65 a month | Free on Cloudflare |
| Security updates | Often, by you or your host | Handled by the platform | Very few, no server code |
| Exposed to PHP2Shell | Yes, until PHP is patched | No | No |
| Plugin or app risk | High, 91% of flaws | Some, through third-party apps | None on the live site |
| Speed | Depends on host and plugins | Good | Very fast, from a global network |
| Who owns the site | You | The platform | You, every file |
| Editing | Dashboard | Drag and drop | Simple editor, or we make changes |
| Best for | Memberships and complex features | Large shops and DIY design | Service businesses that want low running costs |
Prices are typical UK figures from our website cost guide and change over time.
Why it's faster, and why Google notices
Finished pages travel quicker than pages built on demand.
A WordPress page is usually assembled on the server each time someone visits: PHP runs, the database is queried and plugins add their scripts. An Astro page is already finished, so Cloudflare can hand it over straight from a data centre close to the visitor. That cuts the wait before anything appears on screen, which is exactly what Google's Core Web Vitals measure on phones.
This website works the same way. renozer.com is static pages on Cloudflare, and in our own mobile Lighthouse tests on 22 October 2026 the homepage scored 97 for performance and 100 for SEO.
- Pages served from the data centre nearest each visitor
- No server processing before the first byte arrives
- Images and scripts trimmed when the site is built
When Astro isn't the right choice
We'll tell you in the audit if it doesn't suit your business.
Wix or Squarespace, where you're in full control of the design.
Shopify, or WooCommerce on a well-maintained WordPress site.
Custom development, scoped and priced on its own.
Astro on Cloudflare, with a simple editor or changes made by us.
How we move your site to Astro and Cloudflare
Most service websites move in three to six weeks. The full sequence is on how it works.
- Week 0Free migration audit
We list every page, form, plugin and ranking keyword on your current site.
- Week 1Redirect map
Each old address is matched to its new one, so your Google rankings carry over.
- Weeks 1 to 4Rebuild in Astro
Your design or a refresh, built as static pages and tested on phones.
- Week 5Move to Cloudflare
Your domain points to Cloudflare Pages, with SSL, forms and spam protection set up.
- Week 6Launch and checks
Redirects, Search Console and tracking checked, then the old hosting can be cancelled.
Younus has built WordPress sites since 2017 and moved client websites from WordPress, Wix and Squarespace to Astro, with every old page redirected so rankings carry over.
WordPress alternative questions
See also our FAQ page.
Why are people moving away from WordPress?
Is Astro more secure than WordPress?
Is Cloudflare hosting really free?
Was my WordPress site affected by PHP2Shell?
Will I lose my Google rankings if I move?
Can ChatGPT or Claude really edit my website?
Can I still edit my website?
Can you move a Wix, Squarespace or Shopify site?
What does moving to Astro cost?
Get a free WordPress alternative audit
We'll check your PHP version, plugins and hosting costs, list every page that needs a redirect and send a fixed quote for moving to Astro on Cloudflare, within two working days.
