At least 13,000 WordPress sites get hacked every day. That number's been floating around since February and nobody's had to correct it since. For a while I was part of the herd clicking "update all" every couple weeks, telling myself that fixed something, when all it did was push the next window a bit further out.
But the real question was never how fast I patch. It's why I kept running an entire system built for a job I don't have anymore. So I ripped it out. Every personal site I run now is plain HTML. No plugins, no admin panel to lock down, no CMS at all. Whether that actually holds up, or whether I just moved the problem somewhere else, that's the part I still have to answer.
The Patch Treadmill
91% of WordPress vulnerabilities live in plugins, not in WordPress core. You can run a perfectly patched core and still get owned through a contact form widget you installed in 2022 and forgot existed. The median window between a vulnerability going public and mass exploitation starting is 5 hours. Not 5 days. By the time most people read the changelog email, the automated scanners have already been through your login page twice.
And 87.8% of these exploits walk straight past whatever your host bundles as "security." Managed hosting firewalls catch the obvious stuff. They don't catch a plugin with a broken nonce check that got 40,000 installs before anyone noticed.
So the treadmill looks like this: log in, check for updates, read just enough of the changelog to see if it's a security fix or a feature nobody asked for, click update, hope the theme doesn't break, check the site still loads, close the tab. Repeat every couple weeks per site. It's the same boss fight on loop, you clear it, the game respawns it with slightly different stats next patch cycle. Multiply that by every WordPress site you're responsible for, and it stops being maintenance. It becomes a second job you never applied for, protecting a threat surface you didn't choose and can't fully see.
Why WordPress Existed (And Doesn't Anymore)
WordPress wasn't selling simplicity. It was selling translation. At some point, publishing anything online without knowing how to code meant you needed a layer between "this is what I mean" and the actual markup that displayed it. That's the whole product. An entire content management system, a plugin ecosystem, a hosting industry, built around a single job: let someone who can't write code change a website without touching the source.
That job made total sense in 2005. It still makes sense for a lot of people today, genuinely, no argument there. What's changed is narrower than "WordPress is bad." Claude Code writes and maintains HTML and CSS directly from a plain description of what I want. Not a plugin that generates HTML behind an interface (the actual file, the actual markup, based on me typing what I mean in a terminal). The translation layer isn't providing a service I need anymore.
If the human-to-code translation isn't the bottleneck, what's left to justify a full CMS on a 5-page personal site? That's the part I had to actually go test, not just argue about.
What Claude Code Actually Did
I pointed it at my personal sites, the ones that aren't client work, and asked it to rebuild them as static HTML and CSS. Not a plugin export, not a "convert to static" tool bolted onto WordPress. A rewrite from scratch, structure and content pulled straight from what was already live.
The process was less dramatic than I expected. Describe a page, get a page. Ask for a nav bar that matches the rest of the site, it matches. Point out that a heading looks off on mobile, it gets fixed in the same breath. It's closer to editing a document than writing code, which, fine, I know that phrase gets overused, but here it happened to be literally true.
I'll admit I don't read most of what it generates line by line. That's not new, it's how I've worked with Claude Code for a while now, following the scope discipline I use before Claude Code touches production, not a corner I'm cutting here specifically, it's just the workflow. What I check is the rendered page, not the markup underneath it. Funny thing, the last time I hand wrote raw HTML was high school, table-based layouts, the actual <marquee> tag, the one that scrolled text sideways like a stock ticker nobody asked for. 20-something years later and I'm back to HTML files, just with a very different set of tools doing the typing.
But rebuilding the site is the easy part to demo. The article I wrote back in June was a warning shot about exactly this kind of thing: the mechanic problem I raised in June, stacks that an AI writes from scratch and nobody else can service when they break. So what happens when one of these sites breaks and I'm not the one who can fix it?
The Numbers: 2x Faster, $0 Cost
Here's where the WordPress-is-dead article from June actually cuts against me if I'm not careful, so let's deal with it directly. That piece was about dynamic, AI-coded stacks with no shared standard, the kind where every project invents its own conventions and nobody, including future me, can orient fast in someone else's mess. A static site under 10 pages doesn't have that problem. There's no backend to misunderstand, no dependency tree to untangle, no framework choices to reverse-engineer. It's HTML and CSS. The "no mechanic" risk needs moving parts to attach to, and there aren't any left to break.
What I actually got: every migrated site loads roughly twice as fast, because there's no PHP running, no database query, no plugin stack initializing on every request. Hosting is free, GitHub Pages or Vercel depending on the site, because static files don't need a server that thinks. And the list of things I patch went from "whatever plugin got flagged this week" to nothing, because there's nothing installed to flag.
That's not a marginal win. The patch treadmill just stops turning for the sites where it applies.
You can't get hacked through a plugin you didn't install. 🤷♀️
The Line: Under 10 Pages, Vanilla Wins
This isn't a new rule I invented for this article, it's the one I already use day to day: under 10 pages, plain HTML and CSS on free hosting. Past that, I reach for Astro instead.
The reasoning is boring but it holds. Below that line, the pages are different enough from each other that a templating layer buys you nothing, you're abstracting patterns that don't repeat often enough to matter. Past it, the same header, the same footer, the same card layout start showing up on page after page, and copy-pasting HTML blocks stops being a style choice and starts being a maintenance liability of its own, just a different one than plugin updates.
I think 10 is roughly the right spot for that shift, could be I'm off by a couple pages either way honestly, I haven't run the actual math on exactly where the abstraction starts paying for itself versus where it's premature. It's a threshold I trust from doing it repeatedly, not one I derived on a whiteboard.
Where Vanilla Stops
Vanilla HTML doesn't replace WordPress for everything, and pretending otherwise would be dishonest. A blog publishing 3 times a week, edited by someone who doesn't touch code, still wants WordPress. Same for an online store, forms that need to do anything complicated server-side, or content written by multiple people who aren't going to learn Git to fix a typo. That's WordPress's actual job, and it still does it.
What I have now is narrower than that, and it's already running. My personal sites sit on GitHub Pages, free, no backend, no dependency to patch because there isn't one. I don't open the WordPress security mailing list in the morning wondering if today's the day it's my turn. That's the whole state of it. Under 10 pages, vanilla. Past that, Astro. No bigger theory attached.
Sources
- 43 WordPress Security Data Points That Should Change How You Build Sites in 2026, DEV Community, citing Patchstack State of WordPress Security 2026
- 40+ WordPress Hacking Statistics & Security Data (2026), Colorlib, citing Patchstack State of WordPress Security 2026
This post may contain affiliate links. If you click them, I might earn a small commission — costs you nothing, and helps me keep shipping quality articles every day for your reading pleasure.
Top comments (0)