Jay's Ideas
WordPress admins everywhere have just spent a week in emergency mode over PHP2Shell, a serious flaw in the server software that sits underneath WordPress. The short version: an intruder could take over a site without a password and without anyone on the site doing anything wrong. No careless click, no bad decision to point at afterwards.
If you are a client of mine, you already heard from me: we patched your website with the fix, and there was nothing for you to do. For everyone else, the part of this worth noticing is how the flaw was found in the first place. The researchers who discovered it published their own account, and the interesting bit is not the technical detail. It is how much of the tedious hunting was done by AI, work that used to take a rare specialist months.
One week in, here is my contrarian take. The server software and WordPress itself are not the worst of it. They are the easy part. I can update both in an afternoon. What worries me is everything else sitting on the disk.
Every site collects a graveyard of plugins and themes that nobody has touched in years. A plugin is whatever small piece of software adds a contact form or an image gallery. A theme is what decides how the site looks. Under normal circumstances an abandoned one was harmless, because nobody was picking through the bones of an old theme on a bakery's website. Now that AI automates the scrutiny of everything, those leftover bits are being read automatically, at volume, and that is how flaws keep getting found.
The bitter irony is that we spend a week modernizing the whole stack, and some little plugin that nobody remembers installing is what undoes it. The software does not care that you did the big work correctly.
A site gets built by one person, patched by a second, and inherited by a third. The plugin list is sitting right there in the dashboard, but it does not tell you which ones nobody maintains anymore, which are still doing something you need, or which would take the layout down with them. Nothing forces you to look until something breaks or an update is being weighed, and by then nobody remembers why half of it is there. The plugin nobody remembers is not a sign of carelessness. It is what ten years of ordinary changes leaves behind.
And you cannot always just delete the leftovers. Many of these plugins are no longer maintained, or they are trapped by dependencies. A theme pinned to an older version of a framework that cannot be upgraded, old plugins that depend on that version of the framework, and a page builder sitting on top with no upgrade path at all. Pull one piece out and the layout falls apart.
Even when an update does exist, the question is whether it is safe. Is the new version compatible with the WordPress you are running and the theme you actually have? Install it and find out, or leave it and take the risk. It is a judgement call, made dozens of times per site.
There is also a sunk cost that most security advice ignores. Hundreds of hours go into themes and layouts that are no longer viable. Telling someone to abandon that work is easy. Doing it is a different matter. The work was real, the site still looks fine, and that is exactly why the decision keeps getting postponed.
Then there is the catch-22. Do we switch on automatic updates for security, or do the updates invite more risk? A plugin author's account gets hijacked and a clean-looking release ships with something unpleasant inside it. Or the update is perfectly legitimate and breaks backward compatibility with something you depend on. Either way, somebody has to review every automated change that lands, and that review work is a non-stop distraction from the business the site exists to support.
Underneath all of it, WordPress is simply a big target. It powers most of the internet, so any single flaw, once found, gets exploited over and over again, far and wide, by everyone who can run a script. That is a structural disadvantage you cannot patch away, and it makes unfamiliar alternatives newly attractive. Security through obscurity is unfashionable, but it is a real effective solution, and more people are weighing it.
So the pull to leave WordPress grows a little stronger every month. Functionality that once seemed impossible to duplicate without a particular plugin can be reproduced in minutes with AI. Outdated, unsupported page builders can be left behind entirely, replaced by leaner backends that reproduce an exact replica of the site: the same result, without the convoluted mess underneath. Sites that once seemed too big to copy are now digestible, with proper planning, by models that can hold a whole site in view at once. And if a site really was compromised, it is fair to ask whether it is worth recreating the environment that created the problem in the first place.
I still host plenty of WordPress, and I am not about to argue it should all be torn down. It is not a bad platform. It is a popular one, which is a different thing. If a site is watched properly, patched underneath, compared against a known-good copy, and backed up somewhere far away, keeping WordPress is a perfectly defensible answer. That is roughly how things run at SRVpress, on a deliberately small client list.
What is not defensible is assuming the week of patching was the whole job. If you are not sure what old themes and plugins are still sitting on your server, or whether anything outlived its update path, get in touch. Call or email me at SRVpress and I will audit what is actually running, or we can talk about rebuilding the site as something leaner that does not carry twenty years of leftovers behind it.
