Web Development Website Security
10 WordPress Alternatives for Business Websites (October 2026)
Ten WordPress alternatives judged on what matters after PHP2Shell: do you still run PHP, who patches it, can you edit it yourself, and the real price.
Until this week, choosing between WordPress alternatives was about design, price and how much you wanted to do yourself. Now there's another question: PHP. On 21 October the PHP project shipped emergency fixes for PHP2Shell, two flaws that can let a stranger run code on a server with one web request, and every self-hosted WordPress site runs on PHP. Singapore's Cyber Security Agency told anyone running PHP to patch immediately. With WordPress behind 39.6% of all websites, according to W3Techs, plenty of Singapore owners are asking whether to patch or leave.
My short answer: patch first, today. Then, if you want out, the best WordPress alternatives for a business website are a static site built with Astro and a headless CMS if you want it fast, PHP-free and still editable; Webflow or Framer if you want to design and edit it yourself; Squarespace or Wix if you want the simplest thing that works; and Shopify if you sell products. Below, all ten are judged on the same questions: do you still run PHP, who patches it, can you edit it yourself, what does it cost, and can you leave.
So you know where I stand: I build websites, including rebuilds off WordPress, so I have an interest here. I also build WordPress sites when WordPress is the right call, and I'll say where it still is. For what to do about the vulnerability itself, start with my plain-English guide to PHP2Shell.
I compared these WordPress alternatives on the questions that decide your security workload and your exit: whether you still run PHP, who patches the servers, whether you can edit the site yourself, what it costs, and what you can take with you if you go.
- PHP and patching. If you still run PHP, the next PHP2Shell is your problem too. If you don't, somebody else still patches something, and I name who.
- Price. From each vendor's own pricing page on 23 October 2026, per month on yearly billing unless I say otherwise. Shopify and Squarespace show Singapore visitors SGD prices, so I've used those; the rest are in US$. If you're not GST-registered, add 9%: IRAS requires GST-registered overseas providers to charge it on digital services sold to Singapore customers.
- Lock-in. Hosted builders take the patching off your hands, and in exchange your site lives on their platform. I've checked each one's help pages for what you can export.
This isn't a ranking of website builders by design and templates. My ranking of the best website builders in Singapore does that job. Here's the summary, with WordPress and the PHP-based CMSs at the bottom for comparison:
| Alternative | PHP you have to patch? | Who patches the servers | From, per month | Take it with you? |
|---|---|---|---|---|
| 1. Astro + headless CMS | No | Your host and CMS vendor | US$0 to US$20 hosting, plus the build | Yes, you own the code |
| 2. Next.js | No | Your host; your developer updates the app | US$0 to US$20 hosting, plus the build | Yes |
| 3. Hugo or Eleventy | No | Your host | Free software, plus the build | Yes |
| 4. Webflow | No | Webflow | US$15 (US$25 with the CMS) | Partly |
| 5. Framer | No | Framer | US$10 | No code export |
| 6. Squarespace | No | Squarespace | SGD 22 | Partly |
| 7. Wix | No | Wix | US$17.77 | No, data only |
| 8. Shopify | No | Shopify | SGD 29 | Data, not the store |
| 9. Ghost | No (Node.js) | Ghost, or you if self-hosted | US$15 | Yes, it's open source |
| 10. EmDash | No (TypeScript) | Your host; you update EmDash | Free software, plus hosting | Yes, it's open source |
| Self-hosted WordPress | Yes | You or your host | Hosting, plus upkeep | Yes |
| Joomla, Drupal, Craft, Statamic | Yes | You or your host | Hosting, plus upkeep | Yes |
Astro with a headless CMS is the WordPress alternative I'd pick for most business websites: the live site is plain HTML files on a CDN with no PHP, no database and no public login, and your team still edits content through a separate CMS. Astro is a free, open-source framework that builds every page ahead of time. The CMS (Sanity, Storyblok, Keystatic, or WordPress kept out of public view) holds the words and photos.
- Do you still run PHP? No. A visitor is handed a file, and nothing runs per request for a bug like PHP2Shell to reach.
- Who patches it? The host patches its servers, a hosted CMS vendor patches the CMS, and your developer keeps the npm packages current whenever the site is rebuilt.
- Can you edit it yourself? The content, yes. Layout changes and new page types go through your developer.
- Price: Astro is free, and Cloudflare Pages and Netlify host static sites on free plans. Vercel's free plan is for non-commercial use only, so a business there pays US$20 a seat a month. Most CMSs have a free plan that covers a small site.
- Can you leave? Yes. The code is yours, and any static host will take it.
- Suits: Service businesses, clinics, B2B firms, and anyone whose WordPress is mostly pages and posts.
This site, terris.sg, runs on Astro. So does MET Interior's 176-page site, which I moved off WordPress and its page builder: 75 filterable project pages, 12 BTO landing pages, a renovation cost calculator and a guide library, with the old URLs mapped across. Astro's company joined Cloudflare on 16 January 2026, and Astro stays open source and works on other hosts.
The trade-off: a static site still has accounts and form handlers to guard, which my static vs dynamic website guide lists. My headless CMS explainer covers how editing works day to day.
Next.js is the right WordPress alternative when your site needs logged-in areas, live data or app-like features, because it can mix pre-built pages with code that runs on the server; for a plain business site it's more machinery than you need. It's free and open source, made by Vercel and built on React.
- Do you still run PHP? No. But a Next.js site that renders pages on the server runs Node.js code on every request, and that code needs patching too.
- Who patches it? The host patches its servers. Your developer updates Next.js and React, which matters more here than on a static site.
- Can you edit it yourself? Yes, with a headless CMS attached.
- Price: Free. A fully static Next.js site can sit on the same free hosting plans as Astro; a server-rendered one usually means a paid plan, such as Vercel Pro at US$20 a seat a month.
- Can you leave? Yes, though a server-rendered site needs a host that runs Node.js.
- Suits: Member areas, customer portals, sites that pull live stock or prices.
Leaving PHP doesn't mean leaving patching behind. On 3 December 2025, React disclosed React2Shell (CVE-2025-55182), a flaw in React Server Components rated 10.0, the maximum. Next.js sites using the App Router on versions 15 and 16 were affected, and AWS reported China-linked groups exploiting it within hours. React's advisory said apps whose React code doesn't use a server weren't affected, which is the case for building static unless you need the server.
I built Ingleside, a restaurant on Tras Street, as a Next.js front end with headless WordPress behind it. For speed and cost side by side, read my Astro vs Next.js vs WordPress comparison.
Hugo and Eleventy are free static site generators that turn text files into a website, so there's no PHP or database anywhere; they're excellent for developers and awkward for owners, because there's no editing screen unless you add one.
- Do you still run PHP? No. Hugo is written in Go and Eleventy runs on Node.js, and both only run when the site is built, never when someone visits.
- Who patches it? Your host. There's nothing running on the live site.
- Can you edit it yourself? Only if your developer adds a git-based CMS such as Decap, or you're happy editing Markdown files.
- Price: Free software, on the same free static hosting as Astro.
- Can you leave? Yes. Your content is plain text files.
- Suits: Documentation, simple brochure sites and blogs run by someone technical.
If you're an owner who wants to change a price on a Sunday night, pick option 1 or a hosted builder instead.
Webflow is the best hosted WordPress alternative for a business that wants a designer-grade site it can edit visually, because Webflow runs and patches the hosting and has a CMS built in; the catch is that the site can't fully leave Webflow.
- Do you still run PHP? No. There's nothing for you to run at all.
- Who patches it? Webflow.
- Can you edit it yourself? Yes. Designers work in the Designer; your team edits text and CMS items in a simpler editor.
- Price:Basic is US$15 a month billed yearly (US$25 monthly). Premium, the plan with the CMS for blogs and case studies, is US$25 yearly or US$39 monthly.
- Can you leave? Partly. Code export needs a paid Workspace plan, and Webflow's pricing page says "Dynamic content (CMS items/pages) can't be exported." CMS content comes out as CSV files, one collection at a time, with images still pointing at Webflow's servers.
- Suits: Design-led brands, marketing teams, agencies.
The Designer feels closer to design software than to Wix, so most owners hire someone to build it. If you do, make sure the site sits in a workspace your company owns.
Framer is a hosted website builder for quick, design-led marketing sites, with Framer patching everything; it's the fastest way to get a polished site live and the hardest to take elsewhere, because there's no code export.
- Do you still run PHP? No.
- Who patches it? Framer.
- Can you edit it yourself? Yes, visually, with a built-in CMS for blog posts and listings.
- Price:Basic is US$10 a month and Pro US$30, billed yearly. There's a free plan for trying it out.
- Can you leave? No. Framer's help centre says "Framer does not offer HTML export for self-hosting."
- Suits: Startups, product launches, portfolios, campaign sites.
For a 10-page site you'll redesign in two years anyway, that barely matters. For a content library you plan to grow for a decade, it does.
Squarespace is the easiest all-in-one WordPress alternative for small service businesses, portfolios and simple shops: the templates are polished and Squarespace handles hosting and security, but its export leaves a lot behind.
- Do you still run PHP? No.
- Who patches it? Squarespace.
- Can you edit it yourself? Yes, by drag and drop.
- Price: On Squarespace's Singapore pricing page, Basic is SGD 22 a month billed yearly, Core SGD 31 and Advanced SGD 44. The Plus plan isn't sold in Singapore.
- Can you leave? Partly. The export file carries regular pages and one blog, and leaves out store and product pages, styles and custom CSS.
- Suits: Photographers, consultants, studios, a café with a menu and a booking link.
Wix is the most flexible drag-and-drop WordPress alternative for owners who want to build alone, with a big app market and Wix handling all the patching; it's also the hardest to leave, because a Wix site can only run on Wix.
- Do you still run PHP? No.
- Who patches it? Wix.
- Can you edit it yourself? Yes, and you can move anything anywhere.
- Price:Light is US$17.77 a month billed yearly, Core US$29.77 and Business US$39.77. Wix shows US$ "for reference only" and says prices vary by location, so check the checkout price.
- Can you leave? No. Wix says a site "needs to be hosted and operated on Wix's servers". Your CMS collections and store products export as CSV files, and the design stays.
- Suits: Small businesses that want bookings, a simple store and plenty of add-ons without a developer.
Shopify is the WordPress alternative for anyone selling products online, replacing WooCommerce with a hosted store where Shopify runs and patches the servers; for a site that doesn't sell anything, it's the wrong tool.
- Do you still run PHP? No.
- Who patches it? Shopify, including the checkout.
- Can you edit it yourself? Yes: products, collections, pages and a basic blog.
- Price:Shopify's Singapore page lists Basic at SGD 29 a month billed yearly (SGD 39 monthly), Grow at SGD 99 and Advanced at SGD 399, plus card fees from 3.2% + SGD 0.50 a transaction.
- Can you leave? Your data can, the store can't. Products export as a CSV file, though Shopify notes the product images aren't included in it, and your theme only runs on Shopify.
- Suits: Product businesses of any size, especially ones outgrowing a WooCommerce store that keeps breaking on updates.
Ghost is an open-source publishing platform built on Node.js, with newsletters and paid memberships built in, which makes it the strongest WordPress alternative for blogs and media businesses; Ghost(Pro) hosts and patches it for you, or you can host it yourself.
- Do you still run PHP? No. Ghost is MIT-licensed and runs on Node.js.
- Who patches it? Ghost, on Ghost(Pro). Self-host it and that job is yours: Ghost's own install guide expects you to keep Ubuntu, Node.js, MySQL 8 and NGINX current.
- Can you edit it yourself? Yes, in one of the cleanest editors around.
- Price:Ghost(Pro) Starter is US$15 a month billed yearly (US$18 monthly), Publisher US$29 and Business US$199, for up to 1,000 members. The price rises with your member count.
- Can you leave? Yes. The export includes posts, pages, members, themes and redirects, and the software is open source, so you can run it anywhere.
- Suits: Newsletters, publications, paid communities. Not a natural fit for a service business's brochure site.
EmDash is a free, open-source CMS from Cloudflare that works like WordPress, with an admin and plugins, but is written in TypeScript on Astro with no PHP; it reached a stable 1.0 on 28 September 2026, so it's promising and very new.
- Do you still run PHP? No. It runs on Cloudflare Workers or on any Node.js server.
- Who patches it? Your host patches its servers. Updating EmDash itself is on you or your developer.
- Can you edit it yourself? Yes, in a WordPress-style admin.
- Price: Free and MIT-licensed. You pay for hosting.
- Can you leave? It's open source, though Search Engine Journal argues many of its features lean on Cloudflare's own infrastructure.
- Suits: Developers and early adopters, for now.
Its big idea is plugin safety: each plugin runs in its own sandbox with only the permissions it declares. Cloudflare's launch post cites Patchstack's finding that 96% of WordPress security issues come from plugins, so that's the right target. It went stable in September, six months after a developer beta. I'd watch it for a year before moving a business onto it.
Joomla, Drupal, Craft CMS, Statamic and Concrete CMS all run on PHP, as do the store platforms WooCommerce, Magento, PrestaShop and OpenCart, so moving to any of them keeps you exposed to flaws in PHP itself, including PHP2Shell. If PHP is the reason you're leaving WordPress, they're a sideways move.
This isn't theoretical. Wiz Research, one of three teams the PHP Foundation credits with finding PHP2Shell, demonstrated the attack against the then-latest WordPress, Drupal and Joomla container images, and said every PHP version released in the last decade is affected by at least one of the two flaws. The application's own code being secure didn't help, because the bug sits in PHP underneath it.
None of that makes them bad software. A patched, maintained PHP site is a reasonable thing to own. The patching job just stays with you.
You can keep WordPress and take PHP off your public website in two ways: export the site to static HTML and keep WordPress where only your team can reach it, or run WordPress headless behind access control with a separate front end; either way, the WordPress server still needs PHP updates.
- Static export. A plugin such as Simply Static turns your WordPress site into plain HTML files for a CDN. Forms and search need its paid tier or a replacement. My guide to moving off WordPress to a static site compares this with a full rebuild.
- Headless WordPress. Your team keeps the WordPress admin, and an Astro or Next.js front end shows the content. Put the WordPress server behind something like Cloudflare Access so strangers' requests never reach PHP.
The third answer isn't an alternative at all: stay on WordPress, properly maintained. For WooCommerce stores and membership sites it's often the right call. Pick a host that patches PHP fast (SiteGround says it patched all its servers on 21 October) and have someone keep plugins and PHP current. I do that on a website maintenance retainer from SGD 550 a month.
The best WordPress alternative for a small Singapore business depends on who edits the site and how often: a static Astro site if it rarely changes, Astro with a headless CMS if a team publishes weekly, Webflow or Squarespace if the owner does it all, and Shopify for a shop.
| Your situation | What I'd pick |
|---|---|
| 5 to 20 pages, changes a few times a year | A static Astro site, with your developer making the edits |
| A team publishing posts, menus or case studies every week | Astro or Next.js with a headless CMS |
| You want to design and edit every page yourself | Webflow or Framer |
| You want the simplest thing that works | Squarespace or Wix |
| You sell physical products | Shopify |
| A newsletter or paid membership is the business | Ghost |
| You depend on WooCommerce, membership or booking plugins | Stay on WordPress, patched and maintained |
If you'd like me to build it, a static Astro rebuild starts at SGD 2,535 for up to 10 pages (Starter), or SGD 3,545 for up to 20 pages, live in seven days (One Week Website). Neither includes a CMS you edit yourself. That starts at Growth, from SGD 7,585, with WordPress or a headless CMS. All three are on my website design packages page.
The most secure alternative to WordPress for a business website is a statically built site, such as Astro or Hugo served from a CDN, because there's no PHP, database or login page on the live site for an attacker to reach; hosted builders come next, because the platform patches everything for you.
"Most secure" still leaves you some work. Turn on two-factor login for the domain registrar, the host, GitHub and the CMS, and remove ex-staff from all of them. Those accounts are the way into a static site.
People are moving away from WordPress mainly because of upkeep: every plugin, theme and PHP version needs regular updates, sites slow down as plugins pile up, and weeks like this one, when PHP itself needs an emergency patch, make that cost hard to ignore.
MET Interior put it in their own words: WordPress had "started charging them in page weight for every plugin". Still, "moving away" is relative. WordPress runs about four in ten websites, and for stores and membership sites it's still a sensible choice.
WordPress is still worth using in 2026 for WooCommerce stores, membership sites and teams that depend on its plugins, as long as someone keeps PHP on a supported version and the plugins updated; for a mostly static business site, the upkeep now outweighs what WordPress gives you.
Watch the calendar too. About 36% of WordPress sites were still on PHP 8.1 or older on 23 October, by WordPress.org's own stats, and those versions got no fix for PHP2Shell from the PHP project. PHP 8.2 reaches end of life on 31 December 2026. A site stuck on an old PHP version because a plugin breaks on newer ones has a decision coming either way.
Every WordPress alternative on this list takes PHP off your hands. The hosted builders do it by running everything for you and keeping your site on their platform. Astro, Hugo, Eleventy and a static Next.js build do it by making the pages ahead of time, and you keep the code. Ghost and EmDash swap PHP for JavaScript, which still needs updating. Joomla and Drupal don't do it at all.
If you're on WordPress today, patch PHP first; the PHP2Shell guide linked at the top has the to-do list. Your host may already have done it for free, in which case you don't need me. If you'd rather get off PHP for good, I rebuild WordPress sites as static Astro sites: Starter from SGD 2,535, the One Week Website at SGD 3,545, or Growth from SGD 7,585 with a CMS your team edits. If you're staying on WordPress for now, the fix is a fixed price in writing before I start, covering the PHP update and anything it breaks, from SGD 850, and SGD 550 a month keeps it current after that.
Want to know where you stand before choosing? Start with my free PHP check. Send me your web address and I'll check which PHP version it runs, what it's built on and how old its theme and plugins are, and tell you which of these ten fits.
Sources and references (36)
- w3techs.com › cm wordpress
- php.net
- php.net › supported versions
- wordpress.org › stats
- csa.gov.sg › al 2026 151
- wiz.io › php2shell php rce
- siteground.com › critical php vulnerabilities october 2026
- iras.gov.sg › purchasing remote services from overseas service providers
- github.com › astro
- astro.build › joining cloudflare
- developers.cloudflare.com › pricing
- netlify.com › pricing
- vercel.com › pricing
- vercel.com › fair use guidelines
- react.dev › critical security vulnerability in react server components
- nextjs.org › CVE 2025 66478
- aws.amazon.com › china nexus cyber threat groups rapidly exploit react2shell vulnerability cve 2025 55182
- github.com › hugo
- webflow.com › pricing
- webflow.com › export content as a csv
- framer.com › pricing
- framer.com › can i export my website to html and self host it
- squarespace.com › pricing
- support.squarespace.com › 206566687 Exporting your site
- wix.com › plans
- support.wix.com › exporting or embedding your wix site elsewhere
- shopify.com › pricing
- help.shopify.com › export products
- ghost.org › pricing
- github.com › Ghost
- docs.ghost.org › ubuntu
- ghost.org › exports
- blog.cloudflare.com › emdash wordpress
- blog.cloudflare.com › emdash cms plugin registry
- searchenginejournal.com
- wordpress.org › simply static
