Website security
Why we moved away from WordPress: rogue AI bots, plugin updates and what we use instead
Automated bots now test websites around the clock for weak logins and outdated plugins. Here is why WordPress sites carry most of that risk, and what we build on instead.
By Jonathan LeePublished 3 November 20267 min read
Are AI bots really attacking small business websites?
Yes. Automated scripts, increasingly steered by AI agents, scan the internet day and night testing login pages, outdated plugins and known security holes.
They do not choose targets by size or reputation. A two-practitioner clinic in Tauranga gets the same automated probing as a national brand, simply because it is online.
Why is WordPress the main target?
WordPress runs more than 40% of all websites, so a single flaw can open the door to millions of sites at once. That makes it the most efficient target for automated attacks.
Every page request on a typical WordPress site runs PHP code on a live server and queries a database. Most sites also run 20 or more plugins written by different authors, and most reported WordPress vulnerabilities sit in those plugins and themes rather than WordPress itself.
What does a compromised site actually cost a business?
Rarely anything dramatic on day one. More often the host suspends the account, Google shows a warning to visitors, or the enquiry form quietly stops sending emails for weeks.
Even without a break-in, constant bot traffic can slow a shared server to a crawl. Slow pages lose visitors and rankings long before anyone notices a problem.
Why did we move away from WordPress and PHP?
We built on WordPress for years. Over time the maintenance became the job: weekly plugin updates, emergency security patches and updates that broke something else.
Our clients were paying to stand still. So we moved our builds to modern edge technology, where their budget goes into improving the website rather than patching it.
What is an edge website, and why does it shrug off bots?
An edge website is built ahead of time and served from a global network close to each visitor. There is no WordPress login page to guess, no PHP to exploit and no stack of plugins waiting for updates.
Forms and bookings are handled by separate, locked-down services rather than the page itself. No website is unhackable, but the difference is how much there is to attack.
| Traditional WordPress | Modern edge website | |
|---|---|---|
| Code that runs on each visit | PHP and database queries on a live server | Pages are already built and simply delivered |
| Public admin login | Yes, usually at a well-known address | No public website login to attack |
| Third-party plugins | Often 20 or more, each needing updates | None to update |
| Effect of heavy bot traffic | Can slow or crash a shared server | Absorbed by a global network |
| Ongoing upkeep | Weekly updates and patches | Content changes and improvements |
Three things to check on your website this week
You do not need to be technical for any of these. Each takes under ten minutes.
- 1The plugin audit: log in and count your plugins. Note any that have not been updated by their author in the last year, because abandoned plugins are a common way in.
- 2The speed test: open your site on your phone over mobile data, not wifi. If it takes longer than two or three seconds, visitors and Google are both noticing.
- 3The backup plan: ask whoever hosts your site where the latest full backup lives and how quickly it could be restored. If nobody knows, that is your answer.
Should every business leave WordPress?
No. If your WordPress site is fast, patched every week and looked after by someone you trust, there is no need to rush off it.
It is worth moving when the upkeep costs more than the value, when updates keep breaking things, or when the site has already been compromised once. Moving can keep your Google rankings intact when every old page address is redirected to its new home.
Quick answers
Questions people ask about this
What are rogue AI agents?
Automated programs that use AI to scan websites, guess passwords and test known security flaws at scale, without a person directing each attempt.
Is WordPress safe to use in 2026?
WordPress itself is actively maintained, but most sites rely on many third-party plugins. It can be safe when those are kept updated weekly and the site is monitored, which is ongoing work and cost.
Will I lose my Google rankings if I move off WordPress?
Not if the move is planned properly. Each old page address should redirect to its new equivalent, and titles and content should carry across, so Google transfers the ranking history.
What does a website without PHP or plugins mean for me?
Fewer security updates, faster pages and less to go wrong. Your budget goes into content and improvements instead of emergency patching.
Still have a question about your own site? Ask us on a free call.
Keep reading
See how your own website scores
The free scorecard rates seven areas of your site in two minutes. Prefer to talk it through? Book a free website review and we will look at it with you.