No PHP, no emergency shutdown

Website without PHP
built or converted

On 21 October 2026, DigiD, MijnOverheid, the Dutch House of Representatives and thousands of other websites went offline in a hurry. The cause: two critical vulnerabilities in PHP, the programming language underneath WordPress, Joomla and Drupal. Websites without PHP simply stayed up.

We build websites as static HTML: ready-made pages that the server serves without PHP. If your site currently runs on a CMS, we convert it completely, keeping your design, your addresses and your place in Google.

Request a website without PHP How we convert your site
  • No PHPNo CMS, no database, no plug-ins.
  • Stays onlineA PHP vulnerability will not take your site down.
  • Same addressesURLs and search rankings are preserved.
Converting a CMS site to HTML Website without WordPress Cannot be hacked Benefits of HTML without a CMS

What happened on 21 October 2026

On the morning of Wednesday 21 October, the PHP project announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, quickly dubbed “PHP2Shell”. Through these vulnerabilities an attacker could run their own code on a server running PHP without logging in, and so get at the data stored there. The details were already circulating on social media a day earlier, while the fix was not ready until 16.00.

Anyone running on PHP had to choose: go offline or take the risk. Overheid.nl, MijnOverheid and DigiD went dark as a precaution, as did the Dutch House of Representatives, the NCSC, hospitals, municipalities, news sites, web shops and countless SME sites. Rijksoverheid.nl and NU.nl stayed online, for the same reason: they do not run on PHP. See the statement from the Dutch government and how we kept our clients' servers safe that day.

The PHP developers released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. There will be no further update for PHP 8.1 and older: sites on such a version remain vulnerable until they are upgraded or move away from PHP.

It is not about this one vulnerability

Around seventy per cent of all websites run on PHP, often with a CMS on top, with plug-ins or extensions from dozens of different makers. Any of those layers could turn out to have a vulnerability tomorrow. According to the researchers, the vulnerable code from October had been in there for more than ten years and was found using AI. That same tooling is available to attackers too.

As a result, vulnerabilities follow one another ever more quickly, and each time a PHP website faces the same choice: take it offline, or patch as fast as possible and hope you were in time. A website without PHP does not face that choice: no PHP code runs when someone visits, so there is nothing to latch on to.

What a website without PHP is

A PHP website only assembles each page when someone requests it: PHP runs code, fetches the text from a database and wraps the theme and plug-ins around it. A website without PHP consists of ready-made HTML, CSS and JavaScript files. The web server merely passes them on. There is no database, no admin environment and no login page.

Static refers to the server, not to the screen. A drop-down menu, animations, a photo gallery, a map, a dark and a light theme: everything that happens in the browser remains perfectly possible. This very website is an example. More on that at HTML web design and benefits of HTML without a CMS.

Five kinds of gain

What a website without PHP gives you

Security is the reason, but not the only gain. This is what changes once PHP and the CMS are gone.

01

A PHP vulnerability will not take your site down

No PHP means no emergency shutdown when another vulnerability is found. No login page that is bombarded day and night, no database to break into, no third-party plug-ins. More on that at website that cannot be hacked.

02

No more keeping up with updates

No PHP version reaching end of life, no CMS core, theme or plug-in that needs updating and then no longer works with the rest after the update. You no longer get notifications and have nothing to remember.

03

Noticeably faster, on mobile too

The page is already prepared and does not have to be assembled on every visit. That saves waiting time, and better Core Web Vitals count towards how well you are found.

05

Lasts for years

Today's HTML and CSS will still work in ten years' time, without anything needing to be updated. And because it is standard code, any web developer can carry on with it. You are not tied to anything.

WordPress, Joomla or Drupal

Converting your website into a website without PHP

If your site runs on a CMS, we convert it completely into a static website. Not a half-working copy, but every page rebuilt in clean HTML and CSS. Your current site stays online throughout the entire process.

  1. Inventory: which pages, addresses, forms and functions are there, and what is actually used?

  2. Settling the design: carrying over your current look, or freshening it up right away.

  3. Extracting all content from the database and rebuilding it as static pages, including titles, texts and images.

  4. Setting up the contact form and redirects, so that no old address leads to a dead end.

  5. Testing, going live and clearing away the CMS and its database. After that, we keep an eye on things for the first few weeks.

By system

Which systems we convert

  • A

    WordPress

    Including sites built with a page builder such as Elementor, Divi or WPBakery. The plug-ins, /wp-admin and xmlrpc.php disappear; whatever they did for your visitors, we recreate where necessary. See also website without WordPress.

  • B

    Joomla

    We carry over templates, menus and articles; extensions and the /administrator-based admin environment are removed. If your Joomla site is already down, we can first get it working again.

  • C

    Drupal

    Nodes, taxonomy and views become ordinary pages and overviews. Especially for sites on a Drupal version that no longer receives security updates, this is the calmest way forward: not a major migration to a new Drupal, but no Drupal at all any more.

  • D

    Custom-built PHP or another CMS

    An old bespoke site in PHP, or a less well-known system: the principle is the same. What the visitor sees, we recreate in HTML; what ran behind it, we remove. You will find this explained more generally at Converting a CMS website to HTML.

Only the contact form still uses PHP

One part cannot do entirely without a server side: a completed form has to be processed somewhere and reach you as an email. For that we still use a small PHP script, unless another option is available. Together we choose what suits your site:

  • Dedicated form scriptOne small file with server-side validation and spam protection; the settings are kept outside the web root. The only bit of PHP on your site. See how a contact form works.
  • Form on a separate platformThe form is processed outside your web server. Then no PHP runs on your website at all. If payment also needs to be taken with the form, that can be done through our own FormulierMetBetaling.
  • No formAn email address, phone number and WhatsApp button are enough for many small businesses. Then the site is completely static.

And when the next PHP vulnerability comes along? Then we only switch the form off for a while. During those hours your visitors can still email, call or message you, and the rest of the website simply stays online. With a CMS site, the entire site gets locked down at a moment like that.

With and without PHP, side by side

The honest differences you notice in practice. You will find a broader trade-off at a CMS or not.

Item Website with PHP and a CMS Website without PHP
When a PHP vulnerability hits Take it offline or patch as fast as possible Site stays online; at most the form is switched off for a while
Updates PHP, CMS core, theme and plug-ins, at the rhythm the system sets No obligation to update
Login page and database Always present and reachable from the internet Do not exist
Speed The page is assembled on every visit; caching softens that The page is already there and is served straight away
Publish it yourself Always, through the admin environment Not yourself; you email or message the change and we handle it
Web shop and members' area Available off the shelf through extensions Not straightforwardly; a CMS or a separate service still makes more sense here
Costs after delivery Hosting plus maintenance, licences and security Hosting plus the changes you actually ask for

Honestly: when a site without PHP is not the right fit

A website without PHP is a trade-off. The main thing you give up is publishing yourself through a login. For most business sites that is no loss, but in these cases we advise against it:

  • You publish daily or weeklyThen an admin environment outweighs the peace of mind of going without PHP.
  • A web shop with many productsOrdering, stock and payments call for a system with a server side.
  • A private members' areaLogging in and displaying personal data cannot be done statically.
  • Several editors with rolesThen a CMS is more practical.

In that case the solution is not “no PHP”, but a well-maintained CMS on hosting that is updated quickly. We take care of that too.

What happens to my place in Google?

Google indexes pages, not the technology behind them. What you need to protect are your addresses. We keep existing URLs wherever possible; where an address does change, a 301 redirect is put in place. The typical PHP addresses too, such as index.php?option=com_content&id=12 for Joomla or ?p=123 for WordPress, are redirected to the new page. We carry over titles, meta descriptions and structured data, and a new sitemap goes to Google Search Console.

What it costs

The price depends on the number of pages and on whether we carry over your existing design or create a new one. You get a fixed price up front. For a typical business site we allow for a lead time of one to three weeks. The return comes in the years that follow: no maintenance subscription, no plug-in licences and no emergency updates. If you want to start on a tight budget, also take a look at having a website built cheaply.

Frequently asked questions

Was my website at risk from the PHP vulnerability of October 2026?

If your website runs on PHP — and that applies to virtually every WordPress, Joomla or Drupal site and to most bespoke sites — then it was vulnerable until PHP on the server had been updated. A static website without PHP was not affected at all: no PHP code runs when someone visits, so the vulnerability had nothing to latch on to.

What exactly is a website without PHP?

A website made up of ready-made HTML, CSS and JavaScript files. The web server simply passes them on when someone visits; no PHP runs, no database is queried and there is no admin environment. To your visitors it looks just like any other modern website, only it loads faster.

Can my WordPress, Joomla or Drupal site be converted into a website without PHP?

Yes. We fully convert the CMS site into a static website: every page is rebuilt in clean HTML and CSS, with the same texts, images, design and web addresses. The CMS, the database and the plug-ins or extensions are removed. Your current site stays online until the new one is ready.

Does a contact form work without PHP?

The form is the only part for which we still use PHP: one small, locked-down script with server-side validation and spam protection. If another option is available, such as a form that is processed on a separate platform, we choose that and no PHP runs on your website at all any more. In the event of a PHP vulnerability, we only switch the form off for a while; the rest of the site stays online.

Will I lose my Google rankings if my site no longer uses PHP?

Not if the conversion is done properly. Google looks at addresses and content, not at the technology behind them. We keep your URLs wherever possible, set up 301 redirects where an address changes, carry over titles and meta descriptions and submit a new sitemap. Because the pages load faster, things usually improve rather than decline afterwards.

Can I still edit texts myself on a website without PHP?

Not through a login, because that admin environment is exactly what gets removed. You email or message us your changes in plain language; we usually handle small text and image changes within one working day. If you publish yourself weekly or more often, we will discuss honestly whether a well-maintained CMS might suit you better.

What does it cost to have a website built without PHP?

That depends on the number of pages and on whether we convert an existing site or create a new design. You get a fixed price up front. After that, the costs of CMS maintenance, plug-in licences and emergency updates disappear; what remains is hosting and the changes you actually ask for.

Not keen on the next PHP emergency shutdown?

Send us the address of your current website. We will look at it free of charge, tell you honestly whether it can do without PHP and what happens to your form, and give you a fixed price.

Get in touch 073 ‑ 234 0321

A quick reply, always personal.