wp-to-static
Converts WordPress sites to static sites for Cloudflare Pages, optimizing performance and reducing hosting costs.
Install this skill
Security score
The wp-to-static skill was audited on Feb 16, 2026 and we found 18 security issues across 2 threat categories, including 3 critical. Review the findings below before installing.
Categories Tested
Security Issues
Path traversal pattern
| 151 | - `wp-content/uploads/` → `../../` |
Path traversal pattern
| 152 | - `wp-content/themes/` → `../../themes/` |
Path traversal pattern
| 153 | - `wp-includes/` → `../../../wp-includes/` |
Access to hidden dotfiles in home directory
| 23 | ssh-add ~/.ssh/your_wp_key |
Access to hidden dotfiles in home directory
| 25 | 4. **Server host key verified:** The user should have connected to the server at least once and accepted the host key, so it exists in `~/.ssh/known_hosts`. |
Access to hidden dotfiles in home directory
| 33 | - `WP_SSH_KEY` — Path to SSH private key file (e.g., `~/.ssh/wp_key`). Key must have `chmod 600` permissions. |
Access to hidden dotfiles in home directory
| 44 | - SSH host key verification is ENABLED (no `StrictHostKeyChecking=no`) — the server must already be in `~/.ssh/known_hosts` |
Access to SSH directory
| 23 | ssh-add ~/.ssh/your_wp_key |
Access to SSH directory
| 25 | 4. **Server host key verified:** The user should have connected to the server at least once and accepted the host key, so it exists in `~/.ssh/known_hosts`. |
Access to SSH directory
| 33 | - `WP_SSH_KEY` — Path to SSH private key file (e.g., `~/.ssh/wp_key`). Key must have `chmod 600` permissions. |
Access to SSH directory
| 44 | - SSH host key verification is ENABLED (no `StrictHostKeyChecking=no`) — the server must already be in `~/.ssh/known_hosts` |
Access to .env file
| 114 | RSYNC_EXCLUDE="--exclude='*.php' --exclude='wp-config*' --exclude='.htaccess' --exclude='*.sql' --exclude='*.log' --exclude='debug.log' --exclude='error_log' --exclude='.env' --exclude='*.bak' --exclu |
Access to .env file
| 125 | find ./build/site -name '*.php' -o -name 'wp-config*' -o -name '.htaccess' -o -name '.env' | head -20 |
Access to .env file
| 191 | find ./public -name '*.php' -o -name 'wp-config*' -o -name '.htaccess' -o -name '.env' |
Access to .env file
| 206 | - NEVER commit credentials to git (.gitignore must exclude .env, *.key, *.pem) |
Access to .env file
| 211 | - NEVER rsync PHP files, wp-config, .htaccess, .env, or SQL dumps from the server |
External URL reference
| 34 | - `WP_SITE_URL` — WordPress site URL (e.g., `https://example.com`) |
External URL reference
| 160 | - `<link rel="https://api.w.org/"...>`, `<link rel="shortlink"...>` |