Off the server. Onto a platform you never patch.
WooCommerce, Magento and WordPress, moved to Shopify or Webflow, every link kept.
ServicesMove off WooCommerce, Magento or WordPress
Journey Lab moves stores and sites off self-hosted PHP platforms such as WooCommerce, Magento and WordPress onto Shopify or Webflow, which are fully hosted, so there is no PHP server for the business to patch.
Security notice
What happened in October.
- Two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) let attackers run code on a server without logging in.
- They sit in PHP, not in the store software, so WordPress, WooCommerce, Magento, Drupal and other PHP sites can be exposed until the server is updated.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release.
- Attacks were reported from 21 October. First step for anyone on PHP: confirm with your host that a fixed version is running today.
SourcesTalos: two critical RCEs in PHP corePatchstack: PHP vulnerable to critical RCECodeable: what WordPress site owners need to do
Why owners are moving now.
- Every security release means checking a server, a host, plugins and a theme.
- Older PHP versions stop getting fixes, and upgrading breaks plugins.
- Sales and search rankings depend on a site nobody wants to touch.
- The team just wants to run the business, not the server.
How we move you.
- 01
Check today
We confirm your current site is on a fixed PHP version while the move is planned.
- 02
Choose the platform
Shopify for stores, Webflow for sites the team edits itself.
More on this - 03
Move everything
Products, customers, orders, content and every old link, moved and redirected.
More on this - 04
Nothing left to patch
A hosted platform keeps the servers updated. You keep selling.
How a move works.
- 1
Inventory
Every page, product, customer and link on the old site, listed.
- 2
Map
Old to new, with a redirect for every address.
- 3
Build and test
The new store or site, tested with your real content.
- 4
Launch in boarding groups
Your team first, then a few customers, then everyone.
- 5
Watch
Redirects, rankings and sales checked after launch.
The proof.
+385%Website visits, August 2026 vs August 2025We brought a landmark arts center to life online.Powerhouse Arts
+2,150%Annual sales, 2022 to 2026, over our four years togetherWe turned a local needlepoint shop into a national brand.Stitch by Stitch
4 to 1Web properties brought into one: three domains and a private student areaFour websites, brought onto one the school owns.Odyssey Works
Questions.
Is Shopify affected by PHP2Shell?
Shopify is fully hosted and runs its own platform, so merchants have no PHP server to patch. The same goes for Webflow sites.
Do we have to move right away?
No. Patch first, today. A move is worth planning so the next security release is someone else’s job, not yours.
Will we lose our search rankings?
Not if the move is planned properly. Every old address gets a permanent redirect to its new page before launch.
Can you move WordPress sites that aren’t stores?
Yes. Powerhouse Arts moved from WordPress to a Webflow site its team runs itself.