- Astro builds pages ahead of time, so visitors receive a finished file. WordPress assembles each page on the server for every visit.
- Client sites we move off WordPress get faster for real visitors, and page speed scores improve dramatically.
- Plugins drive WordPress security risk. Patchstack found that 91% of 11,334 new WordPress vulnerabilities in 2025 were in plugins, and 46% had no fix when made public.
- Astro sites now have editors that work much like WordPress, such as Pages CMS, so you can still update your own site.
What is Astro?
Astro is a free, open-source web framework for building content sites. When you build a content site with Astro, it turns each page into plain HTML before anyone visits that page. When someone opens a page, Astro sends their browser only the JavaScript that page needs, and often it doesn't need any.
In January 2026, Cloudflare announced that it had bought The Astro Technology Company, the team behind Astro. Astro remains open source. We've built more than 40 sites on Astro, including client sites and this one.
What is the difference between a static and a dynamic website?
On a dynamic website like WordPress, the server runs PHP code for each page request, pulls content from a MySQL database, assembles the page, and sends it to the visitor. Caching plugins and content delivery networks (CDNs) keep copies of finished pages so the server can skip that work. PHP, the database, and every plugin still sit on the server and stay reachable.
Astro builds pages once when content changes, while a dynamic site assembles them for each request. When someone visits an Astro site, the server only hands out the finished files.
Astro is a static site generator, and this approach is often called Jamstack. A CMS kept separate from the site's front end is called a headless CMS. Interactive parts still work on a static site. A contact form, for example, goes to a small server function that checks for spam and emails the lead.
Is Astro faster than WordPress?
Yes, Astro is faster by design. Its pages need no assembly on each visit, and Cloudflare serves the files from its network close to the visitor. The pages use little or no JavaScript, and images are resized at build time to fit each screen.
Client sites we move off WordPress get faster for real visitors, and their page speed scores improve dramatically. Google's PageSpeed Insights scores a page from 0 to 100, and 90 or above counts as good. Our own site, rebuilt on Astro, scores 99 for performance on phones and 100 for accessibility, best practices, and SEO.
Client sites see the same jump. Example of page speed improvement from a WordPress site we rebuilt in Astro.
How secure is WordPress?
In Patchstack's 2026 report, which covers 2025, Patchstack recorded 11,334 new vulnerabilities across WordPress plugins, themes, and core, up 42% from 2024. Patchstack sells WordPress security protection.
Plugins accounted for 91% of those vulnerabilities, themes for 9%, and WordPress core for just six, all low priority. The number of high-severity vulnerabilities, the kind used in automated mass attacks, more than doubled from 923 in 2024 to 1,966 in 2025.
By the time vulnerabilities were made public, 46% still had no fix from the plugin's developer, so keeping plugins updated leaves a gap. Attacks move quickly, too. About half of high-impact vulnerabilities were attacked within 24 hours of going public, and among the heavily exploited ones, 20% were attacked within six hours.
Hosting defenses didn't close that gap in Patchstack's tests. They blocked 12% of WordPress-specific attacks in one test and 26% in a broader one. The most common infections hide by serving spam pages to search engine crawlers. The owner and security scanners see a clean site until customers complain or rankings drop.
An Astro site has no plugins, PHP, or database on the live server, so the attack routes counted in those WordPress numbers don't exist there. Patchstack's own report page is built with Astro. You still need to protect the accounts around your site, including the Cloudflare account, code repository, and domain, with strong passwords and two-factor sign-in.
What does a WordPress hack look like?
In July 2026, a client's WordPress site was running WordPress 5.0 from 2018 on PHP 7.2, a PHP version that stopped getting security fixes in 2020. An attacker had added hidden, encrypted code to the site's main index.php file and planted a backdoor file with a name that looked like part of WordPress. The code pulled spam pages from the attacker's server and showed them to Google's crawler and to visitors.
Bing's crawler and SEO tools such as Ahrefs and Semrush got the normal page, so the usual checks showed nothing wrong. The host kept no access logs, which meant we couldn't trace how the attacker got in.
We removed the code and the backdoor, along with a hidden plugin the attacker had installed. We also changed the passwords and security keys. We then rebuilt the site on Astro in the client's own Cloudflare account, and it went live in August 2026. The live site now has no PHP, plugins, or database for that kind of code to hide in.
Can you still edit an Astro site yourself?
Yes. Astro sites now have content editors that work much like the WordPress dashboard. We use Pages CMS, a free, open-source editor. You sign in, open a page, and change its text, images, or business details such as hours in forms laid out like the page. You don't need a developer account or any code.
When you save, the site rebuilds and the change is live in about 1 to 2 minutes. Every save is kept as a version, so any change can be undone. If a change would break the site, the previous version stays live.
Pages CMS isn't a drag-and-drop page builder, so new layouts and page designs go through us. Other editors for Astro, such as TinaCMS, Decap CMS, CloudCannon, and Keystatic, do a similar job. We chose Pages CMS because your content stays as files in your own site and there's no license fee.
Where is an Astro site hosted?
We host Astro sites on Cloudflare's Workers platform. Each site lives in your own Cloudflare account and is billed to your own card, so you own the site and the hosting. Cloudflare doesn't charge for requests for a site's static files.
Cloudflare can also sit in front of a WordPress site, where it caches pages and blocks some attacks. The site's PHP code, database, and plugins still run on the WordPress server behind Cloudflare.
Is Astro good for SEO?
Yes. Astro sends finished HTML, so search engine crawlers and AI crawlers can read the whole page without running scripts. Google also uses Core Web Vitals, which measure loading speed, responsiveness, and layout stability, to judge page experience, and LCP is the loading measure.
Titles, meta descriptions, canonical tags, the sitemap, and schema markup live in the site's code. You don't need an SEO plugin for them, and a plugin update can't break them. Redirects live in one file, which Cloudflare applies before the page loads.
What if you need to stay on WordPress?
Some sites have a specific requirement that keeps them on WordPress, such as a WooCommerce store, a membership site, or a site built around a particular WordPress plugin. Some teams know the WordPress editor well and want to keep it.
In those cases, we make the WordPress site as fast and secure as it can be. We speed it up, keep its plugins lean and updated, and harden it against the attacks above. We also do SEO for WordPress sites.
How do you move a WordPress site to Astro?
When we move a WordPress site to Astro, we carry over the words, URLs, tracking, and other parts you already have in place.
- We keep your copy word for word unless you ask for changes.
- We keep every URL. Any page that moves gets a 301 redirect, a permanent redirect that tells Google where the page went, and we carry over page titles, meta descriptions, and schema markup.
- We move and test Google Analytics, Google Tag Manager, and call tracking.
- We rebuild your forms with spam protection.
- We keep the old WordPress site as a fallback for about two months after launch.
Astro website development at Complete SEO
We're Complete SEO, an SEO agency in Austin, Texas that designs and builds websites. Astro website development accounts for most of our new builds, and every site we build ships with the SEO setup described above. You can explore our website design work. If you're weighing a move off WordPress, get in touch, and we'll look at your current site and tell you what a move would change.
