WordPress, sealed shut
Your blog, with no website to look after.
Write in the WordPress you already know. What your readers see is a sealed copy that runs no software at all — so the holes everyone else is patching this week simply are not there.
Two halves, and only one of them faces the world.
Your writing room
The WordPress editor, with your drafts, pictures and theme exactly where you left them.
It opens when you log in and switches off when you leave, so there is nothing sitting there for anyone to break into.
Only you can open thisYour published site
A finished copy of your pages on your own domain, with no login page and no database behind it.
It can be read, and nothing on it can be changed — except by you, writing and publishing again.
This is what readers seeThe dangerous holes arrive before the fixes do.
Nine days ago, two critical holes were found in PHP — the software most of the web runs on, and the software WordPress is written in. Either one let a stranger on the internet run their own code on your server. The fixes came out on 21 October. Within days the attacks were widespread enough that the American cyber-security agency put both on its list of holes being used right now.
WordPress had its own in September. People were attacking it within hours of the fix being published — faster than most people check their email.
You cannot patch your way out of that. The hole exists before the fix does, and the people trying it do not wait for you.
What Sealed does about it
The copy your readers see is not running WordPress. It is not running PHP. It is not running any software at all — it is finished pages and pictures. When the next hole is found in the software everyone else is rushing to patch, there is nothing on your site for it to open, and nothing for you to rush to do.
To be straight with you: your writing room does run WordPress, so it does run PHP. It is not open to the internet — only you can reach it, through your Google sign-in — and it is switched off whenever you are not writing. Keeping that patched is my job, not yours.
The October holes:NCSC advisory,CVE-2026-109618 and CVE-2026-109619. The September one:CVE-2026-87902.
One yearly bill, smaller than a month of ordinary hosting.
Per blog
€89
a year, everything included
Cancel whenever. You take your writing with you, and your domain was always yours.
To get started
Nothing
no setup fee
Setting a blog up is a script, and WordPress imports your old posts itself. There is no hand-rebuilding here, so there is nothing to charge you for.
- The WordPress editor you already know, on your own blog
- Your own domain, with the certificate handled for you
- Your existing posts and pictures, brought in from a WordPress export
- One Google sign-in — no WordPress password to keep safe
- Nightly backups, and an export whenever you ask for one
- A person to email when something looks wrong
Asking is the slow part.
- you askTell me your blog address and what is on it. If Sealed is wrong for you, I say so before you spend anything.
- your blog is madeYour blog and its address are set up for you, usually the same day. You sign in with Google — there is no new password.
- you bring your writingExport your old blog from WordPress, upload the file, and your posts and pictures come across as they are.
- you press publishYour readers get the sealed copy on your own domain. Your old blog stays up until you point the domain across.
Sealed is for writing, and not much else.
Because the published site is a finished copy, anything that needs to run while a visitor is on the page does not work: a shop or checkout, paid memberships or logins, and built-in WordPress comments. A contact form and a search box can be added; a storefront cannot.
If one of those is central to your blog, Ghost or WordPress.com will serve you better. I would rather tell you that now than take your money and disappoint you.
The awkward ones first.
Why move if my hosting is already paid for?
Because of what stops happening. No updates to run, no plugin breaking your site at a bad moment, no login page for strangers to guess at. If none of that bothers you, your current host is fine and you should keep it.
So a WordPress security hole cannot affect me at all?
Your public site, no — there is no WordPress and no PHP on it to attack. Your writing room is a different matter: it runs real WordPress, and a hole in WordPress or PHP would apply to it. It is not reachable without your Google sign-in and it is off when you are not writing, which removes the drive-by attacks that do the damage, and patching it is my job. Anyone who tells you a hosted WordPress is immune to WordPress holes is selling you something.
Is this really WordPress?
Yes — the real editor, your own theme, your media library. What is different is only what happens after you publish: readers get a finished copy of the site instead of talking to WordPress directly.
Can I keep my plugins?
Plugins you use while writing are fine. Plugins that need to do work every time a visitor loads a page — live search, popups with logic behind them, anything with a shop or a login — will not run on the copy your readers see. Tell me which ones you use and I will say before you start.
What happens to my old blog?
Nothing, until you say so. It keeps serving readers the whole time, and you only point your domain across once you have seen the new one and liked it.
How do I leave?
You ask, and you get a standard WordPress export of every post and page plus a folder of your images — the same files any other WordPress host will take. Your domain is yours throughout; nothing has to be unpicked.
What if Sealed shuts down?
It is run by one person, so it is a fair question. You would get your export and at least ninety days' notice, and your published site would be handed over as plain files you can put anywhere.
I kept paying for a server that sat awake all month so I could write a few times a month — and then spent my evenings installing updates on it anyway.
So I built Sealed. The editor only runs while I am actually writing, and what my readers see is a plain copy of the site that cannot be logged into, updated or broken. It has run my own blog ever since.
I set the first blogs up myself, one at a time — not because it is laborious, but because I would rather look at your blog and tell you honestly whether Sealed suits it.
— Alfred Westerveld