Moving off WordPress
Your website is a supply chain.
You don’t own the top of it.
You already live with four of the reasons: plugin sprawl, the security surface, an editor nobody asked for, and speed you keep buying back. In 2024 a fifth one arrived, and it isn’t a trade-off. It’s a question about who controls your site.
$ foothills audit-the-stack$ foothills strip-the-builder$ foothills map-every-url$ foothills move-the-media-library$ foothills run-both-then-cut-over
Four reasons before you get to the lawsuit
None of these is new, and none of them makes anybody panic. They’re the bill you’ve been paying quietly for years.
The plugins are the product
Very little of what your site does is WordPress. It’s thirty pieces of somebody else’s code, each with database access and its own release schedule, several last touched years ago by a volunteer who moved on. Nobody signed anything. When one breaks, your support line is a forum.
Security follows the plugins
Core gets patched quickly and often, and core is rarely where sites are lost. The way in is usually an ageing plugin, a theme nobody has the source for, or an admin account that outlived its owner. Your attack surface isn’t the software you chose. It’s everything bolted on since.
Nobody likes the editor
Gutenberg landed in 2018 and your team is still fighting it. Layouts look right in the editor and wrong on the page, formatting vanishes on paste, and sites keep installing the Classic Editor plugin rather than learn the new one. When people avoid the editor, you’ve got a content problem, not a taste problem.
Speed gets bought back
A stock install is quick. Yours runs thirty plugins’ worth of queries on every request, so you buy the speed back with a caching layer, a CDN and a bigger box. That’s more to pay for, more to configure, and more things to get woken up by.
The fifth reason
Then, in late 2024,
it turned legal
The four above are trade-offs you can price. This one is different, because it is not about your install at all — it is about who controls the infrastructure every WordPress site updates from, and what they are willing to do with it.
Automattic, the company behind WordPress.com, spent the autumn of 2024 in a public fight with the managed host WP Engine over the WordPress trademark. Co-creator Matt Mullenweg called the company “parasitic” and a “cancer” on the ecosystem in posts on WordPress.org.
It did not stay between the two of them. WordPress.org cut WP Engine off from core updates and the plugin repository. A plugin running on more than two million sites was forked and pushed out in place of the original. A federal judge eventually ordered access restored, and the litigation is still live.
None of those sites did anything. Their owners had picked a host, and that turned out to be enough. No plugin fixes this, and neither does a better server.
Each timestamp opens How WordPress Is Eating Itself Alive at the moment it is discussed. The quoted words belong to the people who said them, and WP Engine’s claims are allegations in an active lawsuit we are no part of.
- September 202419:33
The trademark bill
Automattic asked WP Engine to pay for a commercial license to use the WordPress trademark. Talks collapsed. At WordCamp US, WordPress co-creator Matt Mullenweg named WP Engine from the stage, and followed it with posts on WordPress.org calling the company "parasitic" and a "cancer" on the ecosystem.
Two companies, one argument about money. Nothing in it concerned the people whose sites were about to be caught in the middle.
- Days later22:12
The pipe closed
WordPress.org cut WP Engine off from the core update infrastructure and the plugin repository.
Thousands of sites simply stopped being able to update. Not because anything was broken on them, and not because of anything their owners had chosen — they were hosted in the wrong place during somebody else’s dispute.
- October 202425:22
A plugin changed hands overnight
WP Engine owned Advanced Custom Fields, running on more than two million sites. WordPress.org forked it into Secure Custom Fields and pushed the fork out to installations in place of the original.
Software you did not choose replaced software you did, on your server, with no prompt and no opt-out. If you build for clients, that is the week you found out your update channel is not neutral.
- Also October26:38
A box you had to tick
For a short period, logging in to WordPress.org required confirming you had no financial or other affiliation with WP Engine.
A loyalty declaration, to download a plugin. Small, quickly reversed, and the clearest possible answer to whether the commons is run at arm’s length.
- Through the autumn24:02
159 people left
Automattic offered a buyout to employees who did not align with Mullenweg’s strategy. A hundred and fifty-nine took it, among them long-standing contributors and community leads.
The people who maintained the parts of WordPress nobody thinks about walked out of the building. That bill does not arrive in the same quarter as the argument.
- Since27:32
Courts, and a second pipe
WP Engine sued Automattic and Mullenweg personally, alleging trademark abuse, extortion and antitrust violations. A federal judge granted a preliminary injunction that forced WordPress.org to restore access and roll back some of the restrictions. Separately, veteran contributors launched alternative package managers under the Linux Foundation.
Access came back by court order rather than by agreement, and the people closest to the project responded by building somewhere else to get their code from. Both of those are worth knowing before you commit another five years to the platform.
The proof
Don’t take our word for any of it
Everything above is a supplier’s summary, and you have no reason to trust one. So here is the whole thing on the record — what was said, who said it, and what it did to the people running sites in the middle of it. Most people remember a spat. It was considerably worse than that.
Not our film, and not our channel. It loads from YouTube when you press play, and not a moment before.
Foothills Digital—Sentrello Premier Partner
- AWS
- Azure
- Google Cloud
- DigitalOcean
- On-premises Linux
- On-premises Windows
Every one of our people holds active certifications on the platforms they work on.
Sentrello is our only partnership. On the clouds, it's our people who hold the certifications. We don't claim a partner tier, and we'll keep saying so until that changes.
Where this usually starts
It started simple. It isn’t now
WordPress rarely breaks on its own. It buckles under everything that got added to make it do what you needed.
- A page builder owns the layout, and its output is shortcodes that mean nothing anywhere else.
- Plugins have piled up for a decade. Several haven’t shipped an update since 2021.
- Security patching is somebody’s Friday afternoon, and Friday keeps slipping.
- Someone edited the theme directly instead of using a child theme, so every update breaks the design.
- The hosting’s tuned as far as it’ll go and the admin still crawls.
What we do instead
We pull the content out from under the builder
We extract through the database and the REST API, not the builder’s own format, so you get structured text and media instead of a wall of shortcodes. The plugin stack gets audited as part of the inventory. Some plugins become a feature on Strapi, Payload or your custom build, some become nothing at all, and you’ll know which is which before work starts.
How it works
How a WordPress move goes
Audit the stack
Every plugin, custom post type, taxonomy and shortcode in use. This is where we find the form handler nobody remembered was processing orders.
Strip the builder
Content comes out as structured fields. The layout gets rebuilt on the new platform, not transliterated, because a shortcode isn’t content.
Map every URL
Permalinks, category and tag archives, attachment pages, plus whatever redirects a previous migration left lying around. All of it maps one to one.
Move the media library
Originals, not the resized copies. Alt text travels with them; lose it and you’ve taken a hit on accessibility and on search at the same time.
Run both, then cut over
The new site runs alongside until the redirects pass as a build gate. Then DNS moves, and it can move back.
What comes across
Posts, pages and custom types
Including the custom post type somebody registered in functions.php five years ago. That’s usually where the useful content turns out to live.
Categories, tags and taxonomies
Structure as well as content. A proper content model is what stops the new site turning back into the old one.
The media library
Original files with their alt text and captions. The new platform regenerates the thumbnails itself, so we don’t haul the old ones across.
Every URL you have
Permalinks, archives, attachment pages and the redirect table, each checked one to one as a build gate.
Forms and what they do
Where each form posts, who it notifies, what it stores. Forms are the thing most likely to stop working after a migration without anyone noticing for a month.
Users, if you need them
Accounts and roles, wherever the new platform has somewhere to put them. Passwords don’t travel, so people reset theirs once.
What people ask next
These five come up on nearly every WordPress call, in roughly this order.
Is WordPress dying?
No, and anyone who tells you it is wants to sell you something. It runs an enormous share of the web and it’ll still be running it in ten years. The better question is narrower. Who controls the infrastructure your site depends on, and what did they do the last time they were angry? Before September 2024 nobody could have told you. Now there’s an answer.
It’s open source. Can’t the community just fork it?
Some of them did. Veteran contributors launched alternative package managers under the Linux Foundation, precisely so that fetching a plugin no longer means depending on WordPress.org. That’s a real answer. It’s also the tell: the people closest to the project responded to the crisis by building a way around its plumbing.
We’re hosted with WP Engine. Are we exposed?
You were, for a stretch of late 2024, through nothing you did. Access to core updates and the plugin repository was cut off, and a federal judge ordered it restored. It has been. Whether you want your update path to be a term in somebody else’s lawsuit a second time is a judgement call, and it’s yours to make, not ours.
Hasn’t this all blown over?
The injunction settled the immediate access question. But the litigation is live, the contributors who left haven’t come back, and the governance that let a plugin be replaced on two million sites is the same governance as before. Calm isn’t the same as resolved.
So should we leave?
Often, no. A small brochure site on a maintained theme with four plugins is cheap to keep and boring to run, and moving it would mean us taking your money for nothing. That changes with scale and stakes: dozens of plugins, custom post types holding real business data, a builder nobody can export, or a compliance obligation that makes an unplanned forced update somebody’s problem. Send us your plugin count and we’ll tell you which kind of site you’ve got.
Related
Platform Migration
Applications, infrastructure, the legacy system nobody dares switch off, and every CMS from WordPress to Joomla. However old it is and whatever it’s called, if your business runs on it, we can move it.
Application Development
A two-screen booking tool or the system your whole company runs on. One team from the first whiteboard to the fortieth patch, so nobody inherits code they’ve never seen.
Sentrello
Sentrello is a self-hosted, source-available unified business management platform. We’re a Sentrello Premier Partner, and our own invoices, net terms and subscriptions all come out of it.
How many plugins?
It’s the quickest way to size a WordPress move, and everybody knows their number.
Send us that, the page count and where you’d like to end up. We’ll tell you what the move looks like and where it’ll get awkward.
- What we arePlan, create, launch, maintain
- What we areSentrello Premier Partner
- What we areEvery quote written for you