How to move off WordPress without losing your Google ranking

Last week was a long one for anyone who runs a WordPress site. On 21 October, PHP, the language WordPress runs on, shipped emergency fixes for two critical flaws, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both let an attacker run their own code on a server without logging in, and attack attempts were reported within hours of the details getting out.

A WordPress update doesn’t fix them. The fix is the PHP version on your server, which usually means your hosting company, and PHP 8.1 and older get no official fix at all. A lot of business owners spent the week finding out which version their site runs on, and who is responsible for updating it.

For some, it’s the push to move to something simpler. If that’s you, the biggest risk in moving isn’t technical. It’s losing the Google ranking your site has built up over the years. We moved our own site off WordPress this month, so this is fresh: here’s what we did, in the order we did it.

First, do you need to move?

Not necessarily. WordPress itself wasn’t the flaw here, and a well-run WordPress site on a supported PHP version, with a host that patches quickly and a short list of maintained plugins, is a reasonable choice. Before you decide anything, ask your host three things: which PHP version your site runs, whether it’s been patched, and who applies these updates in future. If the answers are clear, you may be fine where you are.

Moving makes sense when the answers aren’t clear, or when the site has grown into something nobody wants to maintain: plugins no one remembers installing, a theme that can’t be updated, and a login page that gets attacked every day for a site that’s mostly brochure.

Our new site’s pages are built ahead of time and served as plain files, so there’s no PHP, no plugins and no admin login on the public site to attack. That suits a business site whose pages change a few times a month. It isn’t right for everything, and a shop or a membership site has different needs.

Why rankings drop after a redesign

Google doesn’t rank your business. It ranks individual pages at individual addresses. Your “Contact us” page, a blog post from 2021 and a service page each built up their own standing over time, through links from other sites, clicks from searchers and the age of the page.

When a new site launches with different addresses, all of that points at nothing. Searchers who click an old result land on an error page, and Google drops it. Multiply that across every page and the site starts again from close to zero.

The new site isn’t the problem. The missing addresses are.

Step by step

1. Find every address that matters. Export the pages report and the performance report from Google Search Console. Between them they list the addresses Google has indexed and the ones people actually click. Add any address you know is linked from elsewhere, such as directories, email signatures or printed material.
2. Decide what each one becomes. Every old address should go to the page on the new site that best answers the same question. An old service page goes to the new service page. A blog category goes to the new articles section. Only send something to the home page if there’s genuinely nothing closer.
3. Keep the content that earned its place. If an old post still brings in visitors, don’t delete it. Rewrite it for today, give it a home on the new site, and point the old address at it.
4. Set up permanent redirects. A permanent (301 or 308) redirect tells Google the page has moved for good and passes its standing to the new address. Temporary redirects and “page not found” don’t.
5. Test every one before launch. Run the full list against the new site and check that each address arrives at a real page, not an error and not a loop.
6. Launch, then tell Google. Submit the new sitemap in Search Console and request indexing for the key pages.
7. Watch for a month. Check Search Console’s pages report weekly for new 404s and “soft 404s”, which are pages Google thinks are empty or irrelevant. Fix them as they appear.

What it looked like for us

Our old WordPress site had built up the usual sprawl: blog posts, category and tag pages, author pages, portfolio pieces and service pages with long addresses. Search Console listed about 60 addresses worth keeping.

Here’s how a few of them were mapped:

Old address	New home	Why
A local SEO guide from the old blog	Its rewritten version in Insights	It still brought in searches, so it was updated rather than dropped
Blog categories, tags and the feed	The Insights section	The closest equivalent on the new site
Old portfolio pages for clients we still show	Each client’s new case study	Same work, better page
“About” and “Contact” pages with old names	The new About page and contact form	Same purpose, new address
Services we no longer offer	The services overview	Nothing closer, so the visitor at least sees what we do now

Every one returns a real page on the new site. Search Console had flagged two hard 404s and a handful of soft 404s on the old site, and those are now redirected too. The new sitemap went in on launch day.

Mistakes we see most often

• Redirecting everything to the home page. Google treats that much like a missing page, and visitors who wanted a specific answer leave.
• Launching on a Friday without a list. Once the old site is switched off, the only record of its addresses is in Search Console, and it fades as Google drops them.
• Changing the domain at the same time. It can be done, but it doubles the risk. If you can, move the site first and the domain later.
• Forgetting the small things. Page titles, descriptions and headings carry ranking signals too. Rewrite them deliberately, don’t let the new template blank them.

Before you sign off a new site

Ask whoever is building it three questions. Where is the list of old addresses? Where does each one go? How will we know if something breaks after launch? If the answers are vague, the ranking is at risk.

If last week has you thinking about moving off WordPress, or you’ve already launched a new site and the traffic has dipped, book a call. We’ll look at your site and your Search Console with you, and tell you honestly whether to move and how.