Developer & DevOps guy Building https://xitter.cf/t.co/WSQ78rlpYv & https://xitter.cf/t.co/t5zKvuasVN
Berlin, Deutschland
Joined March 2016
- Tweets2.3K
- Following340
- Followers1.3K
- Likes3.2K
The PHP vulnerability affected everyone in the WordPress ecosystem (and beyond that!).
Many people (including me) had a long, exhausting day, and that's fine; keeping our customer sites and data secure is (and should be) our top priority.
But it really pisses me off to see certain hosting providers claim they were safe "immediately" and use that to make a few extra sales.
Instead of doing this bullshit, why not make it accessible to everyone? Tons of reputational damage around WP could have been prevented (and yes, I know it was PHP and not WP).
You know what?
Zero of our customers have been impacted AT ALL; their static versions kept running, we disabled booting up WP during the patch implementation, and that's it.
Do I comment under every post that "We have been safe immediatly"? No, because we are all in this together, making the web a better (and safer) place - at least I thought so.
Sorry, I'm just a bit tired.
This is serious.
I'm already hovering my finger over the upgrade button to upgrade all Studio instances right away.
Sometimes, I'm really glad we are less impacted because our sites aren't running all the time 😅
Maybe it's time to reconsider your WordPress stack: simplystatic.com/tutorials/t…
Patrick Posner retweeted
I rebuilt Roots & Fruit as a static site that costs $0/month on Cloudflare Pages.
But I didn't ditch WordPress.
I start with my CDS (Core Design System). It has a WordPress compiler that generates a theme, stylesheets, and patterns. I've open-sourced it so you can fork it and adapt it to your own brand.
Then I build locally. When I'm ready to publish, Simply Static generates the static site, and Cursor deploys it to Cloudflare. That means that Studio is my staging.
I really like this separation of concerns. I keep WordPress for what it's good at: content management, semantic layouts, and plugins that let me extend the site programmatically.
But I don't have to pay to host all that infrastructure, and I don't need PHP running on a public server just to serve HTML, CSS, and a little JavaScript.
WordPress is a great platform for AI-assisted web development, and I think people need to take its strengths more seriously.
My CDS + WordPress setup gives an AI agent the guidelines, components, and context it needs to build something accurate and compelling, consistently and reliably.
I wrote up the whole process, with GitHub links so you can adopt the approach and make it your own.
rootsandfruit.com/articles/s…
Patrick Posner retweeted
Automattic has also released a beta WordPress plugin for Spacefast, its newly soft-launched agent-first hosting service, that publishes static snapshots of WordPress sites or rebuilds headless projects when content changes.
→ github.com/spacefast/wordpre…
(h/t: @therepositorywp)
Uptime is binary. Your website responds, or it doesn’t.
Our Website health is much broader:
• redirects still work
• pages remain indexable
• performance hasn’t dropped
• URLs haven’t broken
• SEO metadata is still correct
A site can be online and still have plenty wrong.
Patrick Posner retweeted
We're super excited to announce Statamic Summit 2027 🎉
It's a relationship-forward conference for anyone building with Statamic. We'll have talks, workshops, breakout groups, shared meals, & three nights under the same roof. Of a castle. 🏰
Hope to see you there!
statamicsummit.com
Backups and rollbacks solve different problems.
A backup restores your CMS and data.
A rollback restores the version visitors were seeing.
That's why we handle both with static.studio
The easiest way to decide whether a WordPress site can go static:
Look at what visitors need to do.
Reading pages? Easy.
Forms? Solved.
Search? Solved.
Logged-in dashboards, carts, or highly personalized content?
Good luck! 😂
We use WordPress to run simplystatic.com.
The public website isn’t WordPress.
WordPress handles:
• writing
• editing
• media
• SEO
• publishing
The public site is the static result (including several fancy JS apps).
We’ve been running our own site this way for years.
A simple WordPress security check:
Open your plugin list.
For every plugin, ask: “Do we still need this?”
If the answer is no, remove it.
Deactivated, forgotten plugins don’t help anyone.
Follow me for more super advanced WP security tips 😂
We already have a solution: WordPress Playground and the community.
I built something for @BuildWithOllie a while ago that could move the needle here (not public yet, sorry!), but it would require all the big hosting companies to follow suit:
Host a free instance of Playground - include your hosting-specific plugins for upsells if you like, but no account, no payment plan.
Give your hosted instance an MCP and make it a convention across the web - mcp.hostingcompany.com
Add these to the app directories for Claude and OpenAI.
Wait until the next training season and see the results yourself.
Many hosting companies have built incredible trust on the web over decades; they all offer WP hosting, and it's gonna be impossible for AI to ignore once you remove the friction to get started.
Bonus points if you include an HTML-to-blocks converter in your Playground instances and handle it on the fly - Claude sends HTML, WP converts, and sends a preview link back.
Thanks for coming to my TED talk.
Search doesn’t require a WordPress database query every time someone types something.
For static sites, you can use:
• a client-side search index for smaller sites (like Fuse.js)
• a dedicated search service for larger ones (like Algolia)
The website can stay static either way.
If a plugin update breaks a normal WordPress site, your live site can break with it.
With Static WordPress, the previously published version stays online.
Fix WordPress.
Test it.
Publish again.
WordPress IS your staging environment.
I wonder what can be done in @SimplyStaticWP to make the process smoother with @SpacefastHQ
We recently shipped abilities, and we also have WP-CLI, but only in the Pro version - maybe a stripped-down version specifically for the free plugin would help?
Maybe even a version without a UI?
Like agent-only with faster runtime?
Security plugins protect a public WordPress installation.
With Static WordPress, the public website isn’t the WordPress installation.
That’s why tools like Wordfence, Sucuri and NinjaFirewall usually don’t belong in the static delivery layer.
Different architecture.
Different security model.
Both have their uses, but don't mix them together.