Sanity vs. WordPress: secure websites without PHP

Sanity vs. WordPress is a comparison many business owners and professionals are making this year for one specific reason: security. Your website is your office, practice, or business, open 24 hours a day, and in WordPress, every plugin means more PHP code running on the server that hosts it. This guide compares the two options without exaggeration, so you can decide based on the facts.

This is the third installment in our series on PHP. In the first installment, we explained recent PHP vulnerabilities, such as PHP2Shell, and in the second how to move a Magento or WooCommerce store to Medusa. Here, we focus on corporate or professional websites.

In this article:

• Why a site without PHP reduces the attack surface
• How security differs between Sanity and WordPress
• What risks still exist with Sanity
• When it makes sense to stay on WordPress
• What to do if you also sell online: Sanity with Medusa
• How to migrate from WordPress to Sanity without losing search visibility

# Is a website without PHP more secure?

It reduces the attack surface, which isn’t the same as being invulnerable. On a site built with Sanity and a modern frontend (for example, Next.js), your server doesn’t run PHP, doesn’t have an exposed /wp-admin panel, and doesn’t use third-party plugins. PHP and WordPress plugin vulnerabilities simply don’t apply to that site.

The scale of the problem in WordPress is real. The report State of WordPress Security in 2026 by Patchstack counted 11,334 new vulnerabilities in the ecosystem during 2025, 42% more than in 2024. 91% were in plugins, 9% in themes, and only 6 in core, all low priority. In other words, WordPress core is solid; the risk lies in what gets added to it.

Two more figures from the same report matter to businesses: 46% of vulnerabilities had no fix from the developer when they became public, and for the most heavily targeted ones, the median time to mass exploitation was 5 hours. That’s why updating plugins is no longer enough as your only defense. And because WordPress runs on PHP, it also depends on the language’s support schedule: according to php.net, PHP 8.2 will stop receiving security patches on December 31, 2026.

# Sanity vs. WordPress: What changes for security?

What changes is where each component lives and who maintains it. WordPress brings the content, admin panel, plugins, and public site together on a single PHP server. Sanity separates the content onto its managed platform; the editor (Sanity Studio) works through its API, and the public site is an independent application that only reads content.

The data in the Sanity column comes from its security and compliance page: SOC 2 Type 2 certification, GDPR compliance, Google Cloud infrastructure, encryption in transit (TLS) and at rest (AES), and continuous backups with restore to any point in the last 30 days. Sanity also says it never receives the user’s password, because access is through Google or GitHub.

# What risks remain with Sanity?

Configuration, credentials, and dependency risks remain. A leaked API token, an overly permissive CORS origin, or a compromised npm package can cause damage even without PHP. The difference is that these risks are limited and manageable by your team, rather than involving a plugin marketplace with thousands of authors.

The Sanity CORS documentation is clear: by default, the project only accepts requests from the Studio’s local server and the domain where you published it. It warns against using platform wildcards with credentials (such as *.vercel.app), because any site on that platform could act as your users. It also says not to leave tokens in code that runs in the browser.

On the JavaScript side, the npm ecosystem has had serious incidents, such as the Shai-Hulud campaign that CISA documented in September 2025. Removing PHP doesn’t remove the need to audit dependencies.

• Enable two-step verification on the Google or GitHub accounts your team uses to access Sanity.
• Give each person the minimum role they need and review permissions every quarter.
• Store API tokens only on the server or in environment variables, never in the browser.
• Limit CORS origins to your domains and remove any you no longer use.
• Audit and update your frontend’s npm dependencies regularly.

# When does it make sense to stay on WordPress?

Staying makes sense when WordPress meets your needs, your team knows it well, you use a few well-maintained plugins, and your provider updates PHP and plugins on time. A small blog or a site that relies on many ready-made features may be more practical on its current platform. Migration isn’t a goal in itself.

WordPress isn’t a bad product. According to W3Techs, it’s used by 58.3% of sites whose content management system is known, and 39.6% of all websites. That popularity is exactly what makes it the most attractive target, but it also means more support, more talent available, and more protection tools.

# What if I also sell online? Sanity with Medusa

If your site also sells online, the natural combination is Sanity for content and Medusa for commerce, both without PHP. Medusa is an open-source commerce platform built with Node.js that manages products, carts, orders, and inventory through an API; Sanity provides pages, blog posts, and enriched product pages.

Medusa documents an official integration with Sanity: whenever a product is created or updated in Medusa, a workflow syncs it with Sanity, where marketing can add content and localized copy with a live preview. Products are created only in Medusa, so prices and inventory aren’t duplicated. The details of migrating a store are in the second part of this series.

# How do you migrate from WordPress to Sanity without losing search visibility?

With an inventory and redirects, not a plugin. Content is exported, an editorial model is designed in Sanity, and everything is transformed and tested in a separate environment. Before the switch, URLs, metadata, canonicals, and redirects are validated 301. No one can guarantee zero fluctuations in Google, but a verifiable process greatly reduces the risk.

1. Inventory of pages, posts, authors, categories, images, forms, and plugins (what function each one provides).
2. A Sanity content model tailored to your business, not a template.
3. Reproducible migration of content and assets, with counts and reviewed samples.
4. New frontend with structured data; the JSON-LD schema helps search engines and AI engines understand your site.
5. Validation of URLs, metadata, and redirects 301 before launch.
6. Launch with monitoring in Search Console and a rollback plan.

A well-structured site is also better prepared for search engines and AI models. If you’re a doctor or professional, also review which pages your website needs for Google Maps and ChatGPT.

# Frequently asked questions

# Is Sanity better than WordPress?

It depends on the situation. Sanity gives you more control over your content model, separates the editor from the public-facing site, and removes PHP and plugins from the server. WordPress is easier to get started with and has a huge ecosystem. For sites with many plugins or security risks, Sanity is usually the better option.

# Does Sanity use PHP?

No. Sanity is a managed platform that delivers content via API, and Sanity Studio is a JavaScript application. The public-facing site is usually built with a framework such as Next.js, so there’s no PHP anywhere in the stack.

# Can a site built with Sanity be hacked?

No site is invulnerable. With Sanity, the main risks are leaked API tokens, misconfigured CORS origins, accounts without two-step verification, and compromised npm dependencies. These risks are limited and can be managed with good practices and regular reviews.

# How much does it cost to migrate from WordPress to Sanity?

It depends on the amount of content, the plugins that need replacing, and the frontend design. The total cost includes development, the Sanity plan, hosting, and operations. That’s why it’s a good idea to get an assessment comparing the cost with keeping your current WordPress site.

# Do I need Medusa if I only have an informational website?

No. Medusa is for selling online: products, carts, payments, and orders. If your site is informational, for services, or for a professional, Sanity with a modern frontend is enough.

# Conclusion: fewer exposed components, more control

• The security difference between Sanity and WordPress comes down to architecture: without PHP or plugins on your server, those vulnerabilities don’t apply.
• In 2025, there were 11,334 new vulnerabilities in the WordPress ecosystem, and 91% were in plugins, according to Patchstack.
• Sanity reports SOC 2 Type 2, encryption in transit and at rest, and restoration to any point within 30 days.
• With Sanity, risks involving tokens, CORS, and npm remain; they can be managed with good practices.
• If you sell online, Sanity with Medusa handles content and commerce without PHP.

If you’d like to review your situation, learn about our WordPress-to-Sanity migration service or our Medusa stores.

# About the author

Arturo Sánchez Gándara is CEO of ai¹, a Guadalajara-based consultancy that designs websites with Sanity and online stores with Medusa, and helps companies adopt artificial intelligence and become visible in AI search engines.

# Referenced Sources

• Patchstack: State of WordPress Security in 2026
• W3Techs: WordPress usage statistics
• PHP: supported versions
• Sanity: security and compliance
• Sanity: data access and CORS
• Medusa: integration with Sanity
• CISA: npm supply chain compromise