Contents7
- 01The routine that keeps a WordPress site in shape
- 02Example 1: a trade show landing page, in two days
- 03Example 2: a site that slowed down after two years of campaigns
- 04Example 3: updating fifty service pages
- 05What we need to take over a WordPress site
- 06Frequently asked questions
- 07When should you leave WordPress?
Many company websites run on WordPress with Elementor, and it is a defensible choice: the marketing team edits its pages without a developer. The downside is well known. Campaign after campaign, pages get built by hand, plugins pile up, the site slows down, and one day an update breaks a page on a Friday evening.
This guide describes the routine that prevents it, with three examples drawn from common situations. We build our own sites with Astro, and we explain why in Astro or WordPress; but a well-kept WordPress beats a badly run migration. The reasons to move to a static site one day are covered in Static site with Astro: why migrate.
In short
Updates are tested on a copy of the site before production, never directly on the live site.
A new page starts from an Elementor template and the global colours and fonts, not from a blank page.
Every plugin has to justify its presence; a useless plugin is one more security hole and one more weight.
Speed is measured on mobile, page by page, after every significant change.
The routine that keeps a WordPress site in shape
- Every week.
Update the core, the theme and the plugins on a staging copy, check the key pages, then go live.
- Every week.
Check that a recent backup exists and that it restores, which you test at least once a quarter.
- Every month.
Go through the list of plugins: those no longer used are deactivated, then deleted.
- Every month.
Measure the speed of the most visited pages, on mobile.
- After every campaign.
Delete or redirect temporary pages, so that no orphan pages are left behind.
Watch out
A WordPress site that is not updated is a target
According to Patchstack, 91% of the vulnerabilities published in 2025 in the WordPress ecosystem were in plugins, the rest in themes; the core had only six. Every plugin that is behind on its updates is an open door. We explain the mechanism and the defences in Hacked WordPress site: why, and how to stop it happening.
Example 1: a trade show landing page, in two days
The request: a trade show in three weeks, a dedicated page with a booking form that feeds the CRM.
The quick route is to duplicate an old page and touch it up. It produces pages that drift away from the rest of the site and carry useless blocks. The clean route:
- start from a landing page template saved in Elementor, with the site’s global colours and fonts;
- a single form, connected to the CRM, with a hidden field that records the campaign;
- a conversion tag in Google Tag Manager, checked in preview mode before going live;
- an end date written down: after the show, the page redirects to the service page.
Example 2: a site that slowed down after two years of campaigns
The symptom: the home page takes several seconds to appear on a phone. You usually find the same list: sections nested several levels deep, images uploaded at full resolution, a carousel that loads all its images at once, and plugins that add their scripts to every page even when they only serve one.
The fix follows this order: images first (format and size), then the plugins that load everywhere, then the structure of the most visited pages, rebuilt with Elementor containers rather than stacked sections and columns. Measure before and after, on the same pages. What these metrics measure is explained in Website speed: Core Web Vitals for business leaders.
Example 3: updating fifty service pages
The case: a product range is renamed, and the change has to be carried across dozens of pages. By hand, in the visual editor, that is a week of clicks and as many chances to miss one. WordPress exposes its content through an API, which an external tool connects to with an application password dedicated to each use, available in WordPress since version 5.6. A script, or a supervised AI agent, can list the pages concerned, propose the changes and apply them once approved. This is where development and automation skills save days.
Key takeaway
Time is rarely lost in the editor. It is lost in what was not done beforehand: no template, no staging, no list of pages.
What we need to take over a WordPress site
The access we ask for depends on the service. An audit is done read-only: Search Console, Analytics and Tag Manager are enough. Work on the content also requires a named account and API access through an application password. Taking over the whole site also requires SSH or SFTP access, the database, a staging copy and the theme code in a Git repository. That is what allows an AI agent to work on it with written instructions. Without this access, we offer the audit, then the migration.
Frequently asked questions
Do you need staging for a small site?
Yes, as soon as the site is used to sell or to receive enquiries. Many hosts offer one in a click. The cost of a broken page live on a Friday evening quickly exceeds the cost of the copy. It is also where you test a new page or a plugin before showing it to visitors.
How many plugins can a WordPress site have?
There is no right number. The useful rule: every plugin has a reason to exist that someone can explain, and it receives its updates. A plugin that is deactivated but still installed remains an attack surface. The monthly review therefore starts with the ones no longer in use.
Does Elementor necessarily slow a site down?
No, but it makes it easy: nested sections, unnecessary widgets, images that are too heavy. Building with containers, templates and global styles keeps pages light. You check it by measuring the most visited pages on mobile, before and after each overhaul, rather than trusting how it feels on a fast computer.
When should you leave WordPress?
The question comes up when the routine costs more than the site brings in: hours every month on updates and fixes, security incidents, a speed you can no longer hold. A static site removes most of that maintenance, and it can be edited in natural language, as we describe in Agentic CMS: editing your website by asking AI.
Depending on your situation:
- you want a new website, fast and simple to keep up: business website;
- you want to leave WordPress without losing your traffic: static site migration;
- you first want to know what is holding your current site back: SEO audit.
Sources
- Patchstack, State of WordPress Security in 2026 (new tab)patchstack.com
- WordPress, Application Passwords: Integration Guide (new tab)make.wordpress.org
Jim · founder of Brain Plus AI
Websites, migration and Astro
Want the same thing running at your place?
This site and Palmora Property, a real-estate portal we operate, are built with Astro. A 233-address Drupal 7 to Astro migration, with unchanged addresses, is under way for a digital agency.
Also in websites, migration and astro
Choose and price9 min
Astro or WordPress: which one for your website?
WordPress is edited from a dashboard, Astro builds its pages in advance. What each does better, what real-world data measures, and five questions to decide.
Understand7 min
Hacked WordPress site: why it happens, how to stop it
A WordPress site is rarely hacked through its core: the holes are in plugins and themes, exploited within hours. What the numbers say, what to do in the first hours, and the two ways to never go through it again.
Understand7 min
Website speed: Core Web Vitals for business leaders
Three Google measurements tell you whether your site feels fast to the people who actually visit it. What they measure, what Google does with them, what slowness costs in enquiries, and the decisions that belong to leadership.