Should You Move From WordPress to Webflow After the PHP Flaw?

Key takeaways

• The flaw alone is not a reason to move. The remedy is updating PHP on the server. A WordPress site is fine when its host patches fast and a named person owns the routine. The facts and the order of work sit in our main guide to the PHP vulnerability and what to do now.
• The flaw is a good moment to ask a bigger question. Who will keep PHP, WordPress and plugins current next month and next year? If the honest answer is "nobody", that is the real reason to consider a move.
• Webflow runs no PHP for you to update. On its Trust Center, Webflow states that PHP is not what its core services run on, so they are unaffected and customers need to do nothing (checked 22 October 2026).
• Moving takes weeks, not days. Per our migration service page, a typical job runs four to ten weeks, shaped by page and post counts, content clean-up and any design change.
• You give something up. Plugins, full control of the server and some kinds of site logic do not come across as they are. Be sure you can live without them.
• Do not move in a panic. A rushed move is where rankings are lost. Patch first, then decide.

Start here: patch first, decide second

If your site runs WordPress today, it runs PHP today. One step comes first whichever way you lean: look up which PHP version you run, have the host raise it, and get confirmation that it happened. We walk through it in checking and updating PHP on WordPress, and you can copy the wording from our questions to ask your web host.

Why patch first? Because a move takes weeks, and your old site stays online and exposed until the new one is live. Updating PHP now protects you during the move, and it costs you nothing if you then decide to leave.

The php.net advisory dated 21 October 2026 names four patched versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. WordPress.org states that WordPress itself needs no update, and it suggests running PHP 8.3 or newer. Both pages were read on 22 October 2026.

When staying on WordPress is the right call

Staying is right in more cases than the headlines suggest. Use the list below as an honest test.

1. You have a person or a service that owns updates. That can be your host, a developer or a maintenance plan. What matters is that someone is named and answers quickly.
2. Your host patches PHP fast. Managed hosts often do this for you. Our guide to managed versus shared hosting and who patches PHP explains the difference.
3. Your site does real work that WordPress does well. A shop on WooCommerce, a membership site, a booking system or a large blog with many editors are good examples. Our note on WooCommerce shops and the PHP flaw covers the shop case.
4. Your plugins are few and well kept. Fewer plugins means fewer things to update and fewer things to break.

If most of these are true for you, keep the site, set a routine, and move on. A site that is updated is not a risky site just because it runs PHP.

When a move to Webflow or a static site makes sense

A move starts to make sense when the maintenance is the problem, not the flaw. Look at the table.

On the platform side, Webflow's Trust Center, which we read on 22 October 2026, says it is independently audited for SOC 2 Type II and certified ISO 27001 compliant, and lists Amazon Web Services as its infrastructure. It adds that PHP is not behind its core services and that customers have nothing to do about the October flaws. That is Webflow's own statement, so it tells you about Webflow's servers, not about every possible future flaw.

A static site is the lightest option. The site is plain files, and there is no PHP serving the pages. We moved amariq.com this way, and wrote what we learned moving off Webflow to a static site. It suits a small site that changes rarely. It does not suit a team that needs a visual editor every day, which is where Webflow earns its place.

For the platform comparison itself, including plan prices Webflow and WordPress publish, read our Webflow versus WordPress guide for a service business. We did not re-read Webflow's pricing page for this post, so check current plan prices there before you budget.

What a move involves

A good move is a rebuild with a plan. Our step by step guide to moving WordPress to Webflow without losing SEO goes into depth. This is the short version.

On timing, our Webflow migration page says migrations usually take four to ten weeks, and that the biggest drivers are the number of pages and posts, content clean-up, and whether the design changes at the same time. That is a range for planning, not a promise for your site.

Two habits protect you. Keep the WordPress site live until the new one is tested. And keep it patched until the day you switch, since the old site is the one still exposed in the meantime.

What you give up

An honest guide has to say this part clearly.

• Plugins. Some things that were one plugin in WordPress need a different approach in Webflow, such as a third party tool, an embed or custom code. Make a list of every plugin and what it does before you decide.
• Server control. On Webflow you do not choose your server or edit its files. That is the point for most owners, and a cost for a few.
• Complex site logic. Memberships, large shops with custom rules and unusual integrations may be better kept on WordPress, or handled with care in a new setup.
• A subscription for the platform. You trade WordPress maintenance for a Webflow plan. Our guide to website maintenance costs lays the two side by side.

When this advice does not apply

• You run a shop or a membership site. Relocating a store is a heavier choice than relocating a brochure site, so weigh it by itself.
• Your site is on PHP 8.1 or older. The PHP project gives no official fix for those versions. Update or move quickly, but the order matters. Protect the live site first. The dates are in our PHP end of life guide.
• Your site may already be compromised. Do not move a hacked site as it is. Clean it first. Start with how to check if your WordPress site was hacked.

Two things remain open. We have no verified number of hacked sites, and what your host did may differ from what its public notices claim. Neither of these changes the advice above, but they are reasons to ask your host for written confirmation.

How we help at Amariq

Our team works in WordPress as well as Webflow, so nothing pulls us toward either answer. We got WordPress sites onto a patched PHP version within a day of the advisory, which is why we say staying is sound for many owners. Where a move is the better answer, our Webflow migration page explains how URLs, content and rankings are carried across, with the timeline written there. Staying on WordPress? The WordPress PHP update gig on Fiverr takes care of the update. Reviews from Fiverr and Upwork clients are public, and the YouTube channel has walkthroughs of our work.

Frequently asked questions

Is the PHP vulnerability a reason to switch from WordPress to Webflow?

Not only because of it. Updating PHP is the cure, and a WordPress site that is looked after can have it fast. Move if the real issue is that nobody maintains the site and you want that burden gone.

Does the PHP flaw hit Webflow?

Webflow states on its Trust Center that PHP is not what its core services run on, so they are unaffected and customers need to do nothing. We read that on 22 October 2026. Webflow adds that it is looking at its non production systems where PHP is used.

How long does a WordPress to Webflow move take?

According to our migration service page, expect four to ten weeks. What moves the number most is how many pages and posts you have, how much content must be tidied, and whether the design is reworked in the same project.

Do rankings in Google drop after a move?

Not if the move is planned. Hold on to URLs where possible, send every changed one to its new home with a redirect, and bring titles and content along. Our migration guide lists the traps.

Is a static site safer than WordPress?

Pages on a static site are not served by PHP, so the flaw has nothing to hit there. It also has no CMS, so someone edits files or uses a build step. It suits small sites that rarely change.

Can I just update PHP and stay on WordPress?

Yes, and for many owners that is the right answer. Back up, update WordPress and plugins, move PHP to a fixed release, and test. To pass the job to someone else, see how to hire someone to update PHP safely.

What if I run a WooCommerce shop?

Treat it separately. A shop has orders, payments and plugins that a brochure site does not. Patch first, then weigh a move on its own merits.