Nothing to patch, nothing to log in to

Most WordPress compromises arrive through a plugin vulnerability, a weak admin password, or an unpatched PHP install. A static site has none of those surfaces.

Why static

• No PHP. The host runs a file server. There is no interpreter to exploit and no code that runs per request.
• No admin login. There is no /wp-admin, no /wp-login.php, no xmlrpc.php. Requests for them are answered 410 Gone without touching disk, and repeat offenders are banned at the firewall.
• No plugin CVEs. The plugins are gone with the PHP. There is nothing to update on a Tuesday night and nothing to fall behind on.
• No database. Your content is files. There is no SQL to inject and no user table to dump.
• Strict headers. X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, HSTS on the app, and no server banner.

TLS and the edge

Certificates are issued on demand by Caddy when the first request for your hostname arrives, after our control plane confirms the domain belongs to a customer. Renewal is automatic. HTTP/1.1, HTTP/2, and HTTP/3 are all served. We do not put a third-party CDN between you and your visitors unless you choose Cloudflare in front of us.

What we store

• Snapshot archives of your public site (the crawl) and the built outputs, in object storage with checksums, so any version can be restored.
• The plugin inventory: versions, plugin names, counts, form notification addresses. No post content beyond what is public, no comments, no accounts.
• Form submissions, in your portal, until you delete them.
• Your account email and billing through Stripe. We never see card numbers.
• Access logs on the host, rotated after seven days, used for abuse blocking.

What the plugin sends

Nothing until an administrator clicks Connect, and then only to the control plane shown on its settings page. The crawl authenticates with a per-site secret so caching plugins are bypassed. Disconnecting deletes the pairing credentials; uninstalling removes every option the plugin stored. The complete disclosure, in the plugin's own words, is on the plugin page.

What about the WordPress site itself?

Once your domain points at us, your WordPress install is no longer reachable at that name. We suggest leaving it up for 14 days as a fallback, then cancelling the hosting. If you keep it running for editing on the Freeze plan, put it behind a private hostname and HTTP authentication; we will help you set that up.

Reporting a problem

If you find a security issue on a WPExit-hosted site or on this one, use the contact form on the pricing page and mark it urgent. We respond within one business day.