Przemysław Zalewski

Another WordPress patch day?

Move your company site off WordPress in a few hours

Most company sites are a few pages, a contact form and a map. They do not need PHP, a database and twenty plugins that each need a patch. As static files they have nothing to break into, the hosting is usually free, and Claude edits them better than you can click through wp-admin.

See price and start date → Book a free 30-min call

Brochure site, no add-ons: $180–$440 excl. VAT · 4–8 h Details in the configurator →

Przemysław Zalewski

What you get

The same site, as static files

Pages, images and texts moved one to one, a 301 redirect for every old address, a sitemap and llms.txt. Served from Cloudflare, so there is no server to patch. No login, database or plugins either: nothing to attack and no patching at 2 a.m.

First aid today, if you need it

If the old site is exposed right now, I patch it, add a Cloudflare WAF rule, close wp-admin to the world and turn off what the advisory says to turn off. By hand, then we migrate.

A form that keeps every lead

The contact form goes to a small Cloudflare Worker with spam protection (Turnstile). Every lead is saved and sent to your email, Slack or CRM, so nothing gets lost in a plugin.

Analytics, replays and monitoring

PostHog on your own account: what people read, where they leave, session replays with inputs masked. Plus an alert when the site or the form stops working.

How it works

  1. A 30-minute call

    We go through the site, the forms and what must keep working. You get the scope and the hours in writing.

  2. First aid, if it is urgent

    If the old WordPress is exposed today, it gets patched and locked first. Then nobody has to rush.

  3. The migration

    The site moves to a repository and a Cloudflare account owned by your company. You check a preview link, then we switch DNS with every mail record copied.

  4. 30 minutes on editing

    I show you how to change a text, a price or a photo by asking Claude, with a preview before it goes live. Optional monthly care after that.

Where it fits

  • A brochure site or company site on WordPress that nobody has updated in a while.
  • A site where every edit means opening wp-admin and hoping a plugin does not break the footer.
  • A company that wants to know where its leads come from and how many get a reply.
  • A team that already uses Claude and wants its website to be one more file it can edit.

Add-ons, priced in hours

Each add-on is 2 to 4 hours in the configurator. Pick what you need now; the rest can come later, on the same code.

A map without tracking

An OpenStreetMap map with no API key and no tracking cookies, or a static image that opens Google Maps.

Automations after a lead

A reply to the customer, a task in your CRM, a message in Slack, a row in a spreadsheet. The start of the bigger automations.

Languages and a blog

More languages generated from one source and blog posts kept as Markdown files, with the old addresses redirected.

A git-based CMS

For a team that wants a panel instead of Claude: a light editor (Pages CMS or Decap) on top of the same repository.

Proof

I moved a help center off WordPress into a repository as Markdown: every old address redirected, all languages generated, one machine less to look after. Critical advisories, from React2Shell to WordPress, get patched and mitigated in the WAF the same day. More on Cloudflare and PostHog.

Help center moved from WordPress into the repo as docs-as-code

The problem
An unmaintained WordPress help site: red in audits, no sitemap, expiring certificates, plugins nobody understood.
What I did
Markdown in the repo, versioned with the product, all languages generated automatically, interlinking, 301 redirects for every old address, help added to the Definition of Done.
Result
One machine less to break during holidays, docs that match the product, better SEO and GEO, context agents can read.

docs-as-code 301s i18n

See also: Cloudflare · Next.js

Same-day response to React2Shell and other advisories

The problem
Critical advisories in React, Node.js, WordPress and OpenSSH land without warning and proof-of-concept scanners follow within days.
What I did
A fixed pattern: official source, patch the same day, WAF mitigation, a regex sweep of our own code for the same vulnerability class, hardening flags for Node.js, reading material for the team.
Result
React2Shell patched the day the advisory went out, days before public scanners went live.

same-day patch WAF code sweep

See also: TypeScript & Node.js · Next.js

Taking over growth: SEO, GEO and dashboards leadership reads

The problem
Organic acquisition was close to zero and nobody could say which feature moved which number.
What I did
A tracking plan per feature, PostHog KPI dashboards, SEO and GEO work on landing pages and help, with help, changelog and landing pages treated as one body of context for people and bots.
Result
Organic acquisition grew from near zero and leadership gets its numbers from dashboards, not from asking. Numbers stay relative on purpose.

PostHog SEO + GEO

See also: PostHog & product analytics

Move your company site off WordPress in a few hours

Your company site as static files on Cloudflare: no PHP, no plugins, no admin panel to break into. Every old address redirected, a contact form that saves every lead, PostHog analytics, and edits you make by asking Claude. Usually a few hours.

See price and start date → Book a free 30-min call

FAQ

Questions

How do I change a text without a developer?
You ask Claude: “change the opening hours on the contact page”. The change lands as a pull request. Every change gets its own preview link from Cloudflare (or Vercel on its Pro plan), and you publish it with one click. If your team prefers a panel, a git-based CMS is an add-on.
What about my plugins, Rank Math and IndexNow? Do I have to do that myself?
No. What plugins did on every page view now happens once, when the site is built and deployed: titles and descriptions, Open Graph, schema, sitemap, robots.txt, llms.txt, redirects and compressed images. After each deploy the changed addresses are sent to IndexNow automatically. Ongoing SEO, audits and internal links are work for Claude with open skills such as marketingskills. And with no plugins there is no plugin update that can bring malware in.
Is updating WordPress not enough?
It is the minimum, and I can do it as first aid. But every patch is a race against the next exploit. In October 2026 two critical flaws were found in PHP itself, and exploits were shown on current WordPress, Drupal and phpBB before the fix was out. A static file has no PHP to exploit. Making WordPress faster does not change that.
Will search rankings drop after the move?
Every old address gets a 301 redirect to its new page, titles and descriptions move with it, and you get a sitemap. Static pages also load faster, which search engines measure.
Do you run security audits or scans?
No. I do not sell audits or scanners. I remove the attack surface by moving the site, and in an emergency I patch and lock the old one by hand.
What about WooCommerce or a members area?
Out of scope for this offer. A shop or logins is a separate project, and we can talk about it on the call.
Our WordPress may already be infected. Does the backdoor move with it?
No. I export the content only: texts, images and addresses. No PHP, theme or plugin is carried over, so whatever was planted stays on the old server, which is switched off after the move.
What happens to our email?
Mailboxes stay where they are. I copy every DNS record (MX, SPF, DKIM, DMARC, autodiscover), keep the mail records unproxied and send a test message before and after the switch.
WordPress has a plugin for everything. What do we lose?
A company site usually needs a form, analytics, SEO tags, a map and maybe search. All of that works without plugins. Bookings go through a calendar such as Cal.com. A shop, a members area or a large editorial team are a fair reason to stay on WordPress, and then first aid and monthly care still make sense.
We have a blog with several authors. What about roles, approval and scheduling?
Accounts, login and roles come from GitHub: each person has their own account and access to the repository, and every change has an author and can be reverted. A site’s code is public anyway, so the repository can be public too, and then even the free plan lets you require an approval before anything is published. A private repository needs GitHub Team for that. A post with a future date goes live on the next scheduled build. Decap CMS adds a draft, review and ready workflow in a panel. For a newsroom publishing all day, WordPress may still be the better tool, and I will say so.
Can whoever has access to Claude change the whole site?
Access is granted and taken away on GitHub, person by person. Changes from Claude arrive as a pull request, and nothing goes live until someone approves it. The CMS panel can only edit the content fields I give it, while the layout and code stay protected.
Will it look the same as in Elementor? Can I still move blocks around?
The look is rebuilt one to one, or refreshed if you want. Texts, prices and photos you change yourself. New sections and layout changes are a request to Claude or to me, so drag and drop is gone, and that is what keeps the site fast.
What if you disappear? Are we locked in?
The repository, the Cloudflare account and PostHog belong to your company. The site is plain HTML and Markdown, so any developer, or Claude, can keep working on it without me.
What about cookies and GDPR?
PostHog can run in its EU cloud and count visits without cookies until someone consents. The map uses no tracking cookies. If you use other tools that need consent, the banner stays.
What does it cost?
A brochure site with no add-ons is 4 to 8 hours. Pick the size and the add-ons in the configurator to see the price and the start date before we talk.
What comes after?
Often the next problem: quotes that take a day to write, an internal app without company login, a form that should start an automation. See quote automation and company login.

Let’s find out in 30 minutes

A free 30-minute call. You bring the problem, I bring questions. Want a number first? The configurator shows hours, a price range and the start date.

If I am the wrong person I will say so on the call and point you to someone better.

Book a free 30-min call Email me instead

or write to ciunkos@gmail.com

After you book: a calendar invite, then the call, then the scope in writing within 24 hours. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30-minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow-up only with news. I follow up only when I have something new for you. Never a "did you see my offer".
  • Honest "not a fit". If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 2 November 2026 · B2B contract or employment · Wrocław, Poland (CET), remote