# Tired of WordPress plugin updates and security patches?

> Why a WordPress site always has updates waiting, what a static site still needs from you, and an honest look at when switching to vagejs makes sense.

WordPress always has updates waiting because it runs code on your server for every visit, and every plugin and theme adds more of it to keep patched. A static site has no server code of yours to patch, though it still needs some upkeep.

24 October 2026 · 7 min read · by [Venkatesh A G E](#author)

It's Monday morning. You log in to your website to change the opening hours, and the dashboard greets you with a little red number: seven updates waiting. Two plugins, a theme, something about PHP. You hover over "Update all" and hesitate, because the last time you clicked it the contact form stopped sending emails and it took a week to work out why.

All you wanted was a five-page website for your business. Somehow you've become its part-time system administrator.

If that sounds familiar, this post is for you. We'll be fair to WordPress, which is a remarkable piece of software, explain why the updates never stop, and show what changes (and what doesn't) with a static site built by vagejs.

## First: the updates are doing their job

It's tempting to see update notices as nagging. They're not. Each one is somebody fixing a bug or closing a security hole, and WordPress's own documentation is clear that you should keep plugins and themes up to date to keep your site secure.

WordPress has also worked hard to make this less painful. Since version 5.5, administrators can turn on automatic updates plugin by plugin and theme by theme, and WordPress then checks twice a day and emails you about what it updated or failed to update. The same help page sensibly suggests making sure you can roll back to a backup before switching auto-updates on. You can read it in [WordPress's guide to plugin and theme auto-updates](https://wordpress.org/documentation/article/plugins-themes-auto-updates/).

So the problem isn't that WordPress handles updates badly. It's that a WordPress site has a lot of moving parts, and every one of them needs looking after.

## Why do the updates never stop?

A WordPress site isn't a set of pages sitting on a server. It's a program that builds each page when someone asks for it. Every visit runs code:

-   **The web server and PHP**, the language WordPress is written in. WordPress currently recommends PHP 8.3 or newer ([requirements](https://wordpress.org/about/requirements/)).
-   **The database**, MySQL or MariaDB, where your pages and settings live.
-   **WordPress core**, the main software.
-   **Your theme**, which controls the design.
-   **Every plugin**, each written by a different person or company, each on its own release schedule.

Because all of that runs when visitors arrive, a weakness in any piece can be reachable from the internet. That's why updates matter so much, and why a site with fifteen plugins has fifteen extra things to watch. It isn't a WordPress failing. It's the trade-off any software that runs on a server makes in exchange for being able to do things on the fly: logins, shopping carts, comments, a browser-based editor.

The catch is that many small business sites use almost none of that. They're a home page, a services page, an about page and a contact page that change a few times a year. They carry the full maintenance load of a web application to serve what are, in practice, the same pages to everyone.

## What a static site changes

A static site generator flips the order around. Instead of building pages when visitors ask, it builds every page once, ahead of time, on your computer or in a build service. What you upload to your host is a folder of finished HTML files, plus your images and stylesheet.

vagejs works this way. You write pages as Markdown files (plain text with simple marks like `#` for headings), run `npm run build`, and get a `dist/` folder. On the server there's no PHP, no database, no admin login and no plugin code. Your host just hands out files.

![Two columns comparing what needs regular updates: a WordPress site runs PHP, a database, WordPress core, a theme and each plugin on the server, while a vagejs site serves only finished files, with Node.js and the vagejs package used at build time on your computer or in CI](https://vagejs.com/images/blog/wordpress-plugin-updates-tired-layers.svg)

That has a direct effect on updates. Here is the complete list of packages a brand-new vagejs site depends on, straight from its `package.json`:

JSON

```
"devDependencies": {
  "vagejs": "^0.3.0"
}
```

One development dependency. It has its own dependencies underneath, as every Node.js tool does, but none of that code is on your server. It runs while the site is being built, then it's done. Visitors only ever receive the output.

## You still maintain something (here's what)

We don't want to swap one myth for another. "Static" doesn't mean "nothing to maintain". It means less, and on your schedule. Here's what's left:

-   **vagejs and its packages.** You'll update them now and then. New vagejs sites come with Dependabot set up to open pull requests each week for dependency and GitHub Actions updates, and with a CI workflow that runs `npm audit --audit-level=high` on every push, so known high-severity problems in packages fail the build.
-   **Node.js on your computer.** vagejs needs Node.js 22.12 or newer.
-   **Your accounts.** Your host, your domain registrar and your Git hosting all need strong passwords and two-factor authentication. A static site can't be hacked through a plugin, but it can still be changed by someone who gets into those accounts.
-   **Reading release notes.** vagejs is pre-release (0.x). We follow semantic versioning, which at 0.x means a minor version such as 0.3 to 0.4 may include breaking changes. The README says to read the release notes before moving up a minor version.

Updating, when you choose to, is a few commands:

terminal

```
npm update vagejs        # latest patch in your range, e.g. any 0.3.x
npx vage check && npx vage build
```

If something breaks, it breaks on your machine or in CI, before anything is published. Your live site keeps serving the last good build in the meantime.

## What you give up by leaving WordPress

This is where WordPress is genuinely stronger, and it's worth being honest about it before you switch:

-   **Editing in a browser.** With vagejs you edit text files, usually in a code editor or with an AI coding assistant. If several non-technical colleagues update the site every day, the WordPress editor is easier for them.
-   **Plugins for everything.** Shops, memberships, booking calendars and forms install in minutes on WordPress. A static site needs a separate service for those.
-   **Forms in your content.** vagejs removes forms, scripts and iframes from Markdown content for safety. A contact form belongs in a layout (your site's trusted template code). On Cloudflare Workers, vagejs has a built-in [contact form](https://vagejs.com/docs/deployment/#contact-form); on other hosts it's usually backed by an outside form service.
-   **Familiarity.** Lots of freelancers, agencies and hosts know WordPress inside out.

We go through these side by side in [vagejs vs WordPress](https://vagejs.com/compare/vagejs-vs-wordpress/).

## Who should consider switching?

A static site with vagejs is a good fit if most of these are true:

-   Your site is mainly information: services, about, contact, a blog or docs.
-   One person, or a small team comfortable with text files or an AI assistant, makes the changes.
-   You're tired of patching a server-side app that mostly shows the same pages to everyone.

Stay with WordPress if you rely on its editor for a busy team, run a shop or membership area, or depend on a particular plugin. Keeping it updated is the right answer there, and WordPress's auto-updates make that easier than it used to be.

## What vagejs won't replace from WordPress

-   **There's no WordPress importer.** Moving means copying your pages and posts into Markdown files. For a small site it's an afternoon; for years of posts it's a project.
-   **It doesn't host your site.** You choose a static host and deploy to it. vagejs can deploy to GitHub Pages, Cloudflare and Netlify, and any other static host can serve the `dist/` folder it builds; see [deployment](https://vagejs.com/docs/deployment/).
-   **It doesn't replace your plugins' features.** If a plugin does real work for you, you'll need another way to get that work done.
-   **Old addresses need redirects.** WordPress URLs often differ from the new ones, and links to the old addresses will break unless you add redirects. We cover how in [broken links and 404s after a redesign](https://vagejs.com/blog/broken-links-after-redesign/).

## WordPress upkeep versus static upkeep

-   WordPress updates are real security work, and WordPress has made them easier with opt-in automatic updates for plugins and themes since 5.5.
-   They never stop because a WordPress site runs PHP, a database, core, a theme and every plugin on the server for each visit.
-   A vagejs site serves finished files. Its code runs only when you build, so there's nothing on the server to patch.
-   You still update vagejs now and then, keep your accounts secure, and read release notes while it's 0.x.
-   If you need a browser editor, a shop or specific plugins, WordPress is still the better choice.

## Rebuild one page as a trial

You need Node.js 22.12 or newer:

terminal

```
npm create vagejs@latest my-site
cd my-site
npm install
npm run dev
```

Edit `src/pages/index.md` and watch the browser update. Rebuild your services page as a Markdown file and see how it feels. Nothing on your current site changes until you decide to move. [Getting started](https://vagejs.com/docs/getting-started/) walks through the rest.

![](https://vagejs.com/images/venkatesh-age-144.webp)

Written by

Venkatesh A G E

Web developer in Bengaluru, India, and the maker of vagejs. Helps startups turn their websites into a real source of customers, with a focus on clarity, technical SEO and AI search.

[LinkedIn](https://www.linkedin.com/in/ageven/)[About](https://vagejs.com/about/)