Plugin security upkeep
Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before, and 91% of them were in plugins. Every plugin is something to update and watch.
Source: Patchstack
Keep WordPress as the place you edit content, or move it to Sanity or Payload. We rebuild the public site in Next.js, keep your permalinks, carry over every SEO field, and monitor search for 90 days after launch.
WordPress still runs more websites than any other CMS. The pressure is on how WordPress sites are built, with too many plugins and slow themes.
Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before, and 91% of them were in plugins. Every plugin is something to update and watch.
Source: Patchstack
In HTTP Archive data from November 2025, 46% of WordPress sites passed Google’s Core Web Vitals speed checks, the lowest of the six CMS platforms compared.
Source: Search Engine Journal
WP Engine and Automattic, two of the biggest companies in WordPress, have been in court since 2024 and were still there as of October 2026. For some teams, that was a reason to depend less on one plugin or host.
Source: The Register
Your content and SEO settings come across as they are. Anything a plugin used to draw on the page is rebuilt as a component.
| Item | What happens | How we handle it |
|---|---|---|
| Posts, pages, and custom post types | Moves unchanged | Read directly from WordPress if you keep it for editing, or imported into Sanity or Payload. |
| SEO titles, descriptions, and canonical tags | Moves unchanged | Yoast or Rank Math settings carry over to each page, including the canonical tag that tells Google which version of a page to rank. |
| Categories, tags, and authors | Moves unchanged | Archive pages are rebuilt at the same URLs. |
| Media library | Moves unchanged | Images are resized and compressed automatically; old /wp-content/uploads/ URLs keep working or redirect. |
| Gutenberg blocks and ACF fields | Moves, with changes | Each block type becomes a React component. With headless WordPress, editors keep the same blocks; in Sanity or Payload, we recreate them as matching content blocks. |
| Shortcodes and page-builder layouts | Rebuilt | Elementor, Divi, and shortcode output only works inside WordPress, so it’s rebuilt as components. |
| Forms, search, and plugin features | Rebuilt | Replaced with a lightweight equivalent or a connection to an outside service, agreed with you item by item. |
| Comments | Moves, with changes | Kept in WordPress, moved to a third-party service, or archived, depending on whether they matter to you. |
Redirects and URLs
If the permalink structure stays the same, most URLs never change. The risk is in the URLs WordPress creates that nobody thinks about.
WordPress URLs end in a slash; Next.js leaves it off by default. We set the new site to match, so old links land directly on the right page.
Category, tag, author, and date archives, plus /page/2/ pagination, are either rebuilt or redirected on purpose.
/feed/ URLs, ?p=123 shortlinks, and attachment pages are easy to forget. Each one gets a rule.
Images under /wp-content/uploads/ are often linked from other sites and appear in image search. They keep working after launch.
Editors still need to preview drafts. We set up previews so your publishing routine works the same after the move.
The right place to edit content depends on who edits the site and how structured the content is.
Editors keep the WordPress admin they know. Next.js renders the site. Lowest change for the content team.
A hosted content platform with real-time editing. Strong fit for marketing teams that reuse content across pages.
An open-source CMS that runs inside the Next.js app. Strong fit when you want one codebase and full data ownership.
Send your site. We review it and send a quote and timeline within one business day.
We map every old page to its new address, rebuild your templates, and move content, images, and SEO settings on a private preview site you can check.
We compare the old and new sites page by page, point your domain to the new site, tell Google about the new pages, and test each redirect once it’s live.
For 90 days we watch which pages Google indexes and how much traffic your moved pages get. Anything our work caused, we fix at no cost, with reports at 30, 60, and 90 days.
Send your site and we’ll quote it within one business day.
For marketing sites run by an in-house team, with a blog or resource library.
From$9,500
Typical timeline6–10 weeks
“From” is the starting price for the kind of site described. Prices depend on your site’s size and setup. You get a quote before any work starts, and we don’t bill by the hour.
Nobody can promise rankings after a migration, and we don’t. We commit in writing to the process that protects them.
Every address we find in your sitemap, Search Console, analytics, and backlinks gets a destination: a matching page, the closest match, or a planned removal. You see the full list before launch.
Pages you choose to retire are removed on purpose. If any other old link stops working after launch, we fix it.
We watch which pages Google indexes, any errors it reports, and traffic to your moved pages for 90 days, with a report at 30, 60, and 90 days.
If something we missed or broke causes a problem in those 90 days, we fix it at no cost.
The guarantee covers our work. It doesn’t cover Google algorithm updates, content you change after launch, pages removed at your request, or problems caused by your host, third-party plugins, or other vendors.
If the site is slow because of one page builder, a heavy theme, or cheap hosting, cleaning up WordPress costs far less than going headless. Headless adds a second system to run. If nobody on your team will own a Next.js codebase, a well-built WordPress site is the better choice.
Ask if you should stay on WordPressCommon questions about moving from WordPress to Next.js.
No. Headless WordPress keeps the WordPress admin for editing and uses Next.js only for the public site. Many teams start there.
Only if you want them to. We rebuild routes to match your permalink structure, including trailing slashes, and redirect only what has to change.
On WordPress moves, traffic usually leaks through archives, /page/2/ listings, feeds, attachment pages, and image URLs. We cover each of those, carry over your Yoast or Rank Math settings, and monitor search for 90 days after launch.
Plugins that work behind the scenes, like SEO fields and custom fields, keep working when WordPress stays as the editor. Plugins that draw parts of the page, like page builders and sliders, are rebuilt as components.
Headless WordPress changes least for editors. Sanity suits structured, reusable marketing content. Payload suits teams that want everything in one codebase. We recommend one based on your team before work starts.
Usually a Vercel plan for the site (its Pro plan is billed per team member) plus your CMS plan. We give you the expected monthly total with your quote.
Most sites with up to 25 templates take six to ten weeks. You get the scope and timeline with your quote.
Share your site and we’ll send a quote and timeline within one business day.