Can you run WordPress without PHP?

Why people ask

Usually one of three things has just happened:

• A PHP security scare. In October 2026, PHP2Shell put every site on unpatched PHP at risk, and WordPress owners discovered they depend on their host to patch something they’d never thought about.
• A forced PHP upgrade. Your host retires an old PHP version, and an old plugin breaks. (Our guide to checking and updating your PHP version covers this.)
• Speed. Every uncached WordPress request boots PHP, loads every plugin and queries MySQL. Caching plugins help, until they don’t. See why WordPress is slow.

All three come down to the same wish: keep what’s good about WordPress (the admin, the editor, the content, the URLs) and lose the part that keeps causing problems.

The short answer

WordPress core: no. It is a PHP application, and WordPress.org recommends running it on PHP 8.3 or newer with MySQL 8.0+ or MariaDB 10.11+. Nothing about that is going to change.

Your WordPress site: yes, in the sense that matters for security and speed: PHP doesn’t have to be the thing answering your visitors. The four ways to get there differ in how much of WordPress you keep and how much PHP is left somewhere in the stack.

The four options

1. Static export: WordPress stays, but private

A static-site plugin or crawler renders every page of your WordPress site to HTML files, which you upload to a CDN or static host. Visitors never touch PHP. WordPress keeps running somewhere private (your laptop, a locked-down server) for editing.

Good for brochure sites and blogs that rarely change. Watch out for anything dynamic: comments, contact forms and search need a third-party service, every edit needs a re-export, and the private WordPress still needs patching (it’s just no longer exposed to the internet).

2. Headless WordPress: PHP moves to the back room

WordPress becomes a content API. A separate front end (often a JavaScript framework) fetches content through the REST API or GraphQL and renders the pages.

Good for teams with developers who want full control of the front end, and stores that must keep WooCommerce. Watch out for the fact that PHP and MySQL are still there: you now run two systems with two deploy pipelines, and previews, forms and many blocks need extra work. More on this on our headless WordPress page.

3. Move to a different CMS

Export your content and rebuild on another platform. Good for sites that were going to be redesigned anyway, with editors who aren’t attached to wp-admin. Watch out for what doesn’t export cleanly — custom fields, shortcodes, block layouts, SEO settings, redirects — and for retraining everyone who edits the site. Plan URL redirects carefully, or rankings suffer.

4. A WordPress-compatible runtime with no PHP

This is the newest option and what Presscomet is: the WordPress admin, block editor, data model, URLs and REST API, rebuilt to run on Node.js with a single SQLite file instead of PHP and MySQL. It contains no WordPress PHP code; it reproduces how WordPress behaves. Public pages are served from a static cache and regenerated when content changes, and you can still export the whole site to static files.

Good for content sites (blogs, publications, marketing sites, docs, portfolios) whose editors like wp-admin. Watch out for its limits: PHP plugins and themes don’t run (common plugin jobs are built in instead, and your theme’s look is captured during migration), WooCommerce isn’t supported, multisite networks move one site at a time, and it’s a young project — version 0.1 shipped in October 2026.

Side by side

Which option fits your site?

Four yes/no questions. The ranking updates as you answer and explains itself, so you can disagree with it.

If you pick option 4: what moves and what doesn’t

A Presscomet migration reads your site through the REST API (with an application password), a WXR export, an SQL dump or a small companion plugin, and it only ever reads your WordPress site. Here’s what comes across, based on the migration docs:

• URLs: slugs, permalink structure, category and tag bases, old-slug redirects, feeds and pagination keep their paths. Anything that can’t keep its URL gets a 301.
• Content: block markup, classic content, shortcodes, reusable blocks, revisions, custom post types and taxonomies, custom fields and ACF values.
• Users: roles, capabilities and application passwords; existing passwords keep working.
• Plugins: active plugins are matched to 19 bundled equivalents and their settings imported — Yoast SEO and Rank Math titles, Contact Form 7 forms, Redirection rules, ACF field groups and more.
• Theme: bundled default themes render natively; any other theme is captured as it renders today, so pages look the same on day one.

And honestly: removing PHP removes PHP’s vulnerabilities, not all vulnerabilities. A Presscomet site still needs updates, strong logins and backups. Our security checklist marks which items still apply.

Next steps

• Just want to be safe this week? Follow the PHP2Shell guide and ask your host whether PHP is patched.
• Leaning towards static or headless? Our post on exporting a site as plain files and the headless comparison go deeper.
• Want to see your own site without PHP? Run the free site check, compare on Presscomet vs WordPress, or let us host it on managed hosting.