In scope
Marketing and brochure sites.
Page structure, copy and imagery rebuilt on a modern stack (often Payload).
Forms and basic contact flows where straightforward.
Migrations
Free staff rebuilds for brochure and marketing sites onto a modern stack. You pay for yearly Velcio hosting.
Why leave
WordPress runs about 41% of all websites, so it is a default target. Keeping it reliable means paying for managed ops, continuous plugin patching and cleanup on a mutable PHP and database stack. Immutable app deploys flip the cost model. Reliability comes from shipping a known image, not from a second subscription stack to babysit plugins.
Plugins carry most of the risk. In 2025, Patchstack recorded 11,334 new WordPress ecosystem vulnerabilities, up 42% year on year. 91% were in plugins. Themes made up the other 9%. Core had only six low-priority issues.
Reliability is a recurring bill. Entry managed WordPress hosts often list around $30 to $35 a month for backups, staging and ops. Many sites still pay for maintenance retainers or security tooling on top. That spend buys ops for a stateful PHP stack, not simply more compute.
Defences still miss most attacks. In Patchstack’s 2025 hosting tests, common defences blocked only 12% of WordPress-specific known-exploited attacks, and 26% in a broader second test. Nearly half of vulnerabilities had no developer patch when they were disclosed. Heavily targeted flaws were weaponised in a weighted median of five hours.
Cleanup is not a redeploy. Among sites Sucuri remediated in 2023, about half had a backdoor. Of those with database malware, over half had a malicious WordPress admin user. Writable files and a live database keep recovery expensive.
Sources: W3Techs, Patchstack State of WordPress Security in 2026, Sucuri 2023 Hacked Website Report. Managed hosting list prices from public vendor pricing (for example Kinsta).
Where you land
That cost model is why free migrations for brochure and marketing sites usually land on Payload CMS, hosted as a normal Velcio app. Not every rebuild must use Payload. When a site needs an editable CMS, it is the stack we prefer because it matches how Velcio already runs deliveries.
An app, not a snowflake. Payload is typed Node you can run as a normal HTTP service. With a health check and standard port binding it fits Velcio hosting the same way other delivered apps do.
Content without the plugin bazaar. You model content in code instead of stacking plugins on a writable filesystem. Changes ship through git and deploy. Content still lives in a database. The app itself deploys as an immutable image.
Reliability from the delivery model. Immutable app images and redeploys cut the WordPress ops tax of patch races, WAFs that miss plugin exploits and post-breach cleanups on a writable PHP tree.
Marketing and brochure sites.
Page structure, copy and imagery rebuilt on a modern stack (often Payload).
Forms and basic contact flows where straightforward.
WooCommerce and other storefronts.
Memberships, LMS and complex plugins.
Custom PHP apps or heavy WordPress backends.
Process
You email us. We confirm fit. We rebuild for free and host on Velcio.
Send your site. Email migrations@velcio.dev with the live URL and approximate page count. Note any forms or integrations you need to keep.
We confirm fit. If it fits, we confirm scope, timeline and which yearly hosting plan the site needs.
Rebuild and go live. The rebuild is free. We move brochure sites onto a modern stack (often Payload), put the site on Velcio hosting and help point your domain.
Include the URL and page count. We reply if it looks like a fit. For platform hosting without a rebuild, see pricing.