Why We Move Client Websites From WordPress to Astro

We have been moving client websites off WordPress and onto Astro. Not every site, and not because WordPress is bad software, but because for the kind of site most Kenyan businesses actually need, the trade WordPress asks you to make has stopped being worth it.

This post is the reasoning in full: what the security numbers say, what the speed data says, how the two platforms differ structurally, what you lose by moving, and who should stay exactly where they are.

The Security Numbers

Patchstack, which tracks vulnerabilities across the WordPress ecosystem, reported 11,334 new WordPress vulnerabilities in 2025, a 42% rise on the year before.

Source: Patchstack, State of WordPress Security in 2026, covering 2025.

Two more figures from the same report matter for anyone deciding how fast they need to patch. Patchstack rated 17% of those vulnerabilities as carrying a high risk of mass exploitation, and found that for the heavily exploited ones the median time to mass exploitation was about five hours.

Five hours. That is the window between a flaw becoming public and automated attacks arriving at your site. No Kenyan SME is applying updates inside five hours by hand.

Why WordPress Gets Hacked

It is not that WordPress developers are careless. It is arithmetic. WordPress runs about 40.1% of all websites, so it is the most valuable target on the internet, and the typical site runs fifteen to thirty plugins, each written by a different author, each with its own update schedule and its own idea of security.

Every one of those plugins is PHP code executing on your server, usually with full access to your database. One abandoned plugin from 2022 that still sits in your installation is a live door into the whole site. That is why 91% of the disclosures are plugin flaws, and why the fix is never just "use a better theme".

Add the standard pattern we find on Kenyan sites we inherit: admin passwords reused across accounts, no two-factor authentication, PHP versions years past end of life, and updates postponed because the last one broke the layout. The site is not hacked because somebody targeted this business. It is hacked because a bot scanned the whole internet for a known plugin flaw and found it.

What Astro Does Differently

Astro describes itself as "the web framework for building content-driven websites", and its own documentation states the aim plainly: "Websites run faster when they render HTML on the server."

In a static Astro build, the pages are generated once on a build machine, then uploaded as finished HTML. When a visitor arrives, the server hands over a file. There is no PHP interpreting code, no database query, no plugin running on the public host.

The security consequence is structural rather than clever. SQL injection, which OWASP defines as injecting a query through input data to read or modify database contents, needs a database attached to the live site. A prebuilt HTML page does not have one. The 91% of WordPress disclosures that live in plugins need plugin code executing on the public server, and there is none.

Astro also ships far less JavaScript. Its islands model renders components "to static HTML with no client-side runtime", and only the pieces that genuinely need interactivity get any JavaScript at all.

The Speed Evidence

Speed claims deserve third-party data, not a vendor chart. The HTTP Archive Core Web Vitals Technology Report measures real visits to millions of real sites. Writing up that data in May 2026, Search Engine Journal reported roughly 67% of Astro sites passing Core Web Vitals, against roughly 49% of WordPress sites.

Read that honestly. It is a correlation across everything built with each tool, not a controlled experiment. WordPress carries millions of old sites on cheap shared hosting, while Astro adopters skew towards newer, more technical teams. The gap is real but it is not a promise that moving your site automatically doubles its score.

What is causal is the mechanism: fewer database queries on the critical path, less JavaScript parsed on a mid-range Android, and files served straight from a CDN edge. Those are exactly the things that move Largest Contentful Paint and Interaction to Next Paint, which Google puts at 2.5 seconds and 200 milliseconds respectively.

Where WordPress Still Wins

We still build and maintain WordPress sites, and for some clients we recommend it over Astro.

• Editing without a developer. WordPress has a mature admin that non-technical staff already know. Astro content lives in files or a separate CMS, which is an extra decision and sometimes an extra cost.
• The plugin ecosystem. Memberships, bookings, learning management, multi-vendor marketplaces: WooCommerce and its neighbours have ready answers, and rebuilding that in Astro is rarely sensible.
• Hiring. At 40.1% of the web, WordPress has the largest pool of people who can pick up your site after us. That is a genuine business risk reducer.
• Complex logged-in features. Anything heavily dynamic, with user accounts and per-user dashboards, is not a static site's natural shape.

What You Give Up by Moving

Four honest costs, all from Astro's own documentation and our own experience doing the work.

1. A build step. Content changes are published by rebuilding and redeploying the site, not by hitting Update. We automate this, but it exists.
2. A content decision. If staff need to edit without touching code, you choose a CMS. Astro documents dozens of options, and WordPress itself can serve as the editor behind a static Astro front end.
3. Forms and anything dynamic need a plan. Astro's docs are explicit that actions such as form handling require on-demand rendering or a service to receive the submission.
4. Developer involvement. Astro runs through a command line and needs Node.js. This is a tool for a team that has someone technical, whether that is us or your own staff.

Who Should Move, and Who Should Not

How a Migration Runs

Pricing follows our normal build pricing, because a migration is a build: KES 20,000 to 30,000 for a basic site, KES 50,000 to 120,000 for a professional business site. If you want to see the general approach first, read our guide to web design frameworks and the security and speed audit checklist you can run on your current site today.

Frequently Asked Questions

Is Astro more secure than WordPress?

A static Astro site removes the parts that are most often attacked: there is no PHP running and no database attached to the live site, so plugin vulnerabilities and SQL injection have nothing to act on. Patchstack recorded 11,334 WordPress vulnerabilities in 2025, with 91% of them in plugins. That said, no site is unhackable. Your build pipeline, your dependencies, any content management system you log into and any form endpoint remain attack surface.

Is Astro faster than WordPress?

On the available evidence, generally yes. Reading the HTTP Archive Core Web Vitals Technology Report in May 2026, Search Engine Journal reported roughly 67% of Astro sites passing Core Web Vitals against roughly 49% of WordPress sites. That is a correlation across all sites built with each tool, not a controlled test, so treat it as a strong signal rather than a guarantee for your specific site.

Can my staff still edit the website after moving to Astro?

Yes, but you have to choose how. Astro content can live in files edited through a Git workflow, or in a content management system connected to the site. Astro documents dozens of options, and WordPress itself can stay as the editor behind a static Astro front end, which is often the right answer for a team that already knows the WordPress admin.

Will migrating to Astro hurt my Google rankings?

Not if URLs are preserved. Keep every address the same where possible and set 301 redirects where not, keep the page structure and content, and submit the sitemap afterwards. Rankings are lost in migrations that change or drop URLs, not by the change of framework itself.

Who should stay on WordPress?

Large WooCommerce stores, membership and booking platforms, sites with heavy logged-in functionality, and any business whose staff edit content daily and will not accept a new workflow. WordPress also has the largest pool of developers in Kenya, which is a genuine risk reducer.

What does a migration cost?

A migration is priced as a build: KES 20,000 to 30,000 for a basic site and KES 50,000 to 120,000 for a professional business site, depending on how many pages and integrations come across. We quote after looking at the current site.