The same site, without what runs in the background

WordPress insecure: what a migration to AWS costs

CHF 4’500 as a fixed price up to 15 pages, two to three weeks, then CHF 60 per month for operation. What you get is the same site with the same content and the same appearance, only without a server, a database or an admin login in the background. No redesign, because the appearance is not the problem.

Content changes are not included, and that is deliberate. This page claims that nothing is left running in the background that needs maintaining. We can hardly sell you a maintenance fee on top of that. You pay for operation, and if you need changes, you pay for changes.

What it costs over three years

A one-off figure says little, because you are already paying today. So here is the honest comparison, with your numbers to fill in:

Over three years	Today, WordPress	After the migration
One-off	–	CHF 4’500
Hosting	your figure × 36	included in operation
Maintenance contract or update fee	your figure × 36	falls away
Plugin licences (security, backup, forms)	your annual figure × 3	falls away
Operation	–	CHF 60 × 36 = CHF 2,160
Total		from CHF 6,660

Counted in francs, the migration is more expensive in most cases. We would rather say that up front than afterwards. For a typical setup with hosting, a maintenance contract and a few plugin licences, the difference over three years is in the order of two to three thousand francs.

What that difference buys is the actual question:

• The attack surface falls away instead of being maintained. No login, no database, no plugin that can go stale.
• No update that can be missed, and no night on which someone has to apply one.
• Your content then sits in the delivered HTML and is readable by AI systems.

Against that stands a single incident. If personal data runs through the site, an incident brings investigation, restoration, possibly a notification under the revised Swiss data protection act, and the damage to trust. That exceeds the difference several times over.

If nothing of the sort runs through your site, this calculation comes out negative for you, and we will say so in the first call.

When this pays off, and when it doesn’t

The trigger is usually a warning from the provider or a report about a plugin vulnerability. That warning reaches everyone running WordPress, but it does not mean the same thing to everyone.

If the site essentially shows who you are and nothing else runs through it, the cheapest fix is the right one. We will tell you that too, rather than selling you a migration that does not pay off for you.

It pays off when an incident costs you something:

• Customer data runs through the site, meaning a contact form, an upload or a login. For a fiduciary, a law firm or a medical practice, a compromised form holding client data is a different order of magnitude from the cost of the migration.
• Bookings, orders or appointments come in through it, so an outage costs revenue directly.
• The site is part of a larger system with a portal or a login.

That is why the first question in the call is always the same: what runs through your site?

Why maintenance does not make the problem go away

Every component wants to be kept up to date, every outdated plugin is an entry point, every admin login gets brute-forced eventually. Maintenance keeps those doors shut, but it does not remove them. Automated scanners try known vulnerabilities within hours of their disclosure.

That is why the migration works on the architecture rather than the configuration. A statically served site has no server to patch, no database that can leak, no login to brute-force and no plugin to go stale. The attack surface falls away instead of being defended.

How the switch-over runs

Two to three weeks, in three steps:

1. Inventory. We pull content, structure and appearance out of the existing site and establish which functions are actually needed: forms, search, multiple languages, redirects.
2. Build. The site is set up again as a static project, with the same content and the same appearance. All existing URLs are preserved or 301’d, so the search visibility does not break.
3. Switch-over. DNS, TLS, redirects and forms are verified, and the old system stays reachable but switched off for a while in case something has to be pulled across.

As a side effect, your content then sits fully in the delivered HTML, readable by AI crawlers from the first request.

What we do not do here

We change the build and remove attack surface with it. That is a structural decision, not security consulting.

Risk assessments, protection-requirement analyses, compliance reviews and standards-based measure catalogues are a different discipline and are not part of this offer. If that is what you need, we say so and point you on, rather than delivering it as a side dish.

Why work with us

• You work directly with the senior architect. No account manager handing the work to a junior.
• 30 years of software engineering, plus our own products in operation: SCMC.ch in production since November 2025, Quartiero since July 2026, both in AWS Zurich.
• In the first call we tell you honestly whether the rebuild pays off for you. For a business-card site the answer is no.
• We are based in Bern, your data sits in AWS Zurich, FADP- and GDPR-compliant. Fluent German and English, with an understanding of the Swiss business context.