Your website doesn't need a PHP server. Let us move it to Vercel.
The PHP vulnerabilities disclosed in October 2026 hit the software underneath most WordPress, Drupal and Joomla sites. If yours is a brochure site that rarely changes, you can stop running that software altogether.
What happened.
On 21 October 2026 the PHP project released fixes for two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”). Both are rated 9.2 out of 10 and can let an attacker run code on a web server without logging in.
They affect PHP 5.4 through 8.5.11, so almost every PHP website was exposed until its server was updated. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Large numbers of exploitation attempts have been reported, and the US agency CISA has urged everyone to patch immediately.
Updating WordPress, plugins or themes does not fix this. Only updating PHP on the server does.
Sources: CISA alert · php.net security advisory · Our plain-English explainer
If you run a PHP site today, ask your host or developer whether PHP has been updated to one of the fixed versions. If you're on PHP 8.1 or older, ask what they've done about it — the PHP project no longer ships fixes for those versions. Do this before you think about moving.
Why move instead of just patching?
Patching fixes this problem. Moving removes this whole type of problem — for sites that never needed a server-side runtime in the first place.
No PHP to patch.
The finished site is pre-built pages served from a global network. There's no PHP interpreter or database sitting on a server for anyone to attack or update.
No plugin update cycle.
No plugins or themes needing monthly updates, and no compatibility surprises when one of them changes.
Fast, everywhere.
Pages are served from a content delivery network close to each visitor, so they load quickly on phones as well as desktops.
Lower hosting bills.
For most small sites, hosting costs less than a managed PHP plan.
Certificates handled.
HTTPS is set up and renewed automatically. No expiring certificates to remember.
Preview before it's live.
Every change gets its own preview link, so you can check it before it goes live — and roll back in one click if needed.
Is your site a good fit?
Not every site should move. If yours is in the right-hand column, staying on PHP and keeping it properly patched may well be the better choice — and we'll tell you so.
Probably a good fit
- WordPress, Drupal, Joomla or a custom PHP build
- Mostly fixed content: services, about, portfolio, contact
- A small blog or news section
- Landing pages and campaign sites
- Edited rarely, or by an agency or freelancer
- Nobody is actively looking after the server
Probably not a fit
- WooCommerce or other shops with large catalogues
- Membership sites with complex logins and payments
- Online courses or learning platforms
- Forums and community sites
- Sites built around many interlocking plugins
How it works.
A fixed scope, a careful rebuild and a switch-over with no downtime.
- 01
Free site check
We review your current site: pages, plugins, forms, traffic and search rankings.
- 02
Fixed-scope proposal
You get a clear scope and a fixed price before any work starts.
- 03
Rebuild on Next.js
We match your current design, or refresh it if you'd like a change.
- 04
Protect your SEO
Same URLs wherever possible, 301 redirects where not, page titles and descriptions carried over, and a new sitemap.
- 05
Reconnect forms and tools
Contact forms, analytics and any other integrations are set up and tested.
- 06
Switch over
We change the DNS with no downtime. Keep your old hosting for a safety period, then cancel it.
Keeping your content editable.
Moving off PHP doesn't mean your site is frozen. There are two simple options.
We make the edits.
Send us the change by email and we make it, check it on a preview link and publish it. Covered by a small monthly retainer. Best if you update the site a few times a year.
You edit it yourself.
We add a lightweight content editor so you can change text, images and blog posts in your browser. Best if you publish regularly.
Who we are.
Salaro is a UK web consultancy that has been building software and websites for more than 30 years. With our development team in Pondicherry, India — at its peak in 2006–07, more than 20 people — we've built websites for nearly 1,000 customers around the world since the mid-2000s.
For much of that time we worked on Microsoft .NET and DNN. Today we build on Next.js and deploy to Vercel, using AI-assisted development to work quickly and carefully. This website is built that way.
Pricing
Every move is quoted as a fixed price after the free site check, so you know the full cost before you commit.
Questions.
If yours isn't here, ask it in the form below.
Is Vercel immune to hacking?
No — no platform is. What moving does is remove the PHP server from your website, and that server is exactly what the October 2026 vulnerabilities targeted. A static or Next.js site on Vercel has far less exposed to the internet, and the hosting platform itself is patched by Vercel rather than by you or your host.
Will I lose my Google ranking?
Not if the move is done carefully. We keep the same URLs wherever we can, set up 301 redirects where we can't, carry over page titles and descriptions, and submit a fresh sitemap. Rankings can wobble for a few weeks after any rebuild, so we track them before and after.
Can I still edit my site?
Yes. Either we make edits for you on a small monthly retainer, or — if you change things often — we add a simple content editor so you can update pages yourself.
What about my contact forms?
We rebuild them and connect them to the same inbox, with spam protection. We test every form before the switch-over.
What happens to my emails?
Nothing, if the switch-over is handled correctly. Your email runs on separate DNS records (MX records) from your website. We only change the records that point to the website and leave your email settings alone.
My site is WooCommerce — can you help?
Case by case. A small shop might move well to a hosted platform such as Shopify. A large catalogue with lots of plugins is often better off staying on PHP and being patched and maintained properly. The free site check will tell you which.
Find out whether your site should move.
Tell us where your site is. We'll look at it and reply with an honest answer: move it, keep it and patch it, or something in between.