PHP Is "Dead"...again💀

A Hackers Hostel story: Submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

Quick question. How many WordPress sites do you know that are technically alive?

Not alive alive. Nobody's posting. Nobody's updating. But the domain renews every year, the server's still running PHP from a different era, and somewhere in there is a blog post that people still land on from Google. The site isn't dead. It's a ghost. It just hasn't been told yet.

Then on October 21, PHP shipped emergency patches for two critical remote code execution bugs (PHP2Shell), and a few days later CISA confirmed attackers were already using them. Guess which sites didn't get patched. Yeah. The ghosts.

We know a lot of those. Some of them are ours. So this week we built something for them.

What We Built

WP2Astro is a WordPress plugin that turns the site it's installed on into an Astro site, pushes it to GitHub, and keeps it in sync whenever you publish.

The flow is: install the plugin, click Convert to Astro, get a repo. No Node.js, no terminal, no copy-pasting application passwords. If you've ever installed a plugin, you're already qualified.

What comes out the other side:

• Links stay. Every post, page, category, tag, custom post type and archive keeps its URL. The old weird ones too, like ?p=123, ?page_id=7, /feed/, and slugs you changed years ago. They all redirect where they should. A link someone shared in 2014 still works.
• The look stays. Theme CSS, fonts, images and scripts come along, and an AI model rebuilds the header, menu and footer as an Astro layout from your homepage. It still looks like your site, because it is.
• The junk gets buried. Shortcodes from plugins you deleted ages ago ([vc_row], [button], the usual suspects) get cleaned up instead of showing up as raw text forever.
• You keep WordPress. You write where you always wrote. Visitors just get static pages.

Live Demo at hackershostel.com

HackersHostel/WP2Astro on GitHub

How We Built It

The AI in this thing runs on open-weight models, on your own machine if you want.

There's a Local model option that works with anything that speaks the OpenAI API: Ollama, LM Studio, llama.cpp, vLLM. Pull Gemma, point WP2Astro at http://localhost:11434/v1, hit Test, done. Your posts never leave your network. If you don't want to host a model, OpenRouter is supported, and even there the default is the open google/gemma-4-31b-it.

We kept the AI's job small on purpose. It does exactly two things:

1. Writes the Astro layout from your homepage's header, menu and footer (scripts and styles stripped out first).
2. Fixes posts that have dead shortcodes in them.

That's it. And here's the part we actually care about: we don't trust it. Every answer goes through strict checks. If it fails, WP2Astro uses a plain default layout, or leaves the shortcode alone and writes it into CONVERSION_REPORT.md so you can deal with it. A small model can have a bad day and your site is still fine. That's why "use a small open model" is a real option here and not a downgrade.

It also caches answers, so syncing doesn't ping the model unless your theme, your menu or one of those shortcode posts changed.

The rest is just PHP doing PHP things:

• Content becomes Markdown with frontmatter. Text that only looks like Markdown gets escaped, because we learned the hard way that __init__ turns bold if you let it.
• Work is split into small steps run by the dashboard, WP-Cron or WP-CLI, so it doesn't time out on cheap hosting.
• GitHub login uses the device flow. Syncs only commit what changed, and if you edit a file in the repo yourself, we never overwrite it.
• SEO data from Yoast, Rank Math or AIOSEO comes over, plus RSS, a sitemap, robots.txt and Pagefind search.
• Media can live in the repo, in Git LFS, on WordPress, or on S3, R2 or Bunny.

Each repo also comes with an agent kit (AGENTS.md, CLAUDE.md, skills) so a coding agent can pick up whatever the conversion flagged.

Why Open Innovation Matters

WordPress got this big because anyone could take it and do whatever they wanted with it. It'd be pretty backwards to build a tool for WordPress people that only works if they rent a closed model forever.

With open weights the whole stack is something you can actually own. GPL plugin, Astro, Git, a model on your own hardware. Free to run, private by default, and none of it stops working if we stop paying attention to it. For a tool whose whole job is making sure old stuff doesn't disappear, that kind of matters.

Also, real talk: this design only works because open models got good enough at being small. Checks plus fallbacks means a modest Gemma does the job.

Spirit of the Project

So much of what people wrote online sits on WordPress installs that nobody wants to babysit anymore. Those sites don't get shut down because they stopped mattering. They get shut down because updating PHP is boring.

We'd rather they stick around. Same words, same links, same look, way less maintenance. 🕯️

And to be clear, this isn't a "PHP bad" post. WP2Astro is PHP too, and PHP has been "dead" for about 30 years now. It's just that after PHP2Shell, PHP belongs backstage. Your WordPress still runs it, so you still patch it, and you can keep wp-admin off the public internet entirely. What your visitors hit is plain HTML. No PHP runs there for anyone to pop.

👉 github.com/HackersHostel/WP2Astro

🌐 hackershostel.com

📝 Originally posted on DEV