A safe CMS migration preserves each page's destination, content, access rules, and essential functions while the underlying content management system changes. In September 2026, the key decisions are whether URLs will change, what must be tested, and how the launch will be measured. Treat migration as a controlled release, not a file transfer. Build a URL map, test the complete user journey, remove temporary indexing blocks, and watch security, accessibility, and real-user performance after launch.
Official resources:
- Read the official guidance from Europa — Use this primary source to verify the official guidance.
- Apply through Owasp’s official page — Use this page to review requirements and apply directly.
Table of Contents
- How should changed URLs be handled?
- What changes during a hosting-only move?
- What server versions should a WordPress project use?
- Which accessibility standard should the new site target?
- What security check is easiest to overlook?
- How should performance be verified after launch?
How should changed URLs be handled?
Create a one-to-one map from every valuable old URL to its closest new equivalent. Include pages, posts, category archives, campaign landing pages, files, and images that receive meaningful traffic or links. Google recommends testing redirects, updating canonical references and robots rules, and monitoring both the old and new sites. It also warns that sending unrelated URLs to the homepage may be treated as a soft 404, meaning the redirect does not provide a useful replacement.
Google's site-move guidance also notes that rankings can fluctuate while changed URLs are recrawled and reindexed. Do not combine every possible redesign into one launch. For a large site, move a lower-risk section first and verify the process before migrating the rest. Avoid changing the domain, CMS, navigation, and visual layout simultaneously when those changes can be separated.
What changes during a hosting-only move?
A hosting-only move keeps the public URLs unchanged, so it usually needs no old-to-new redirect map. It still requires a staging review of pages, images, forms, downloads, database connections, certificates, and server behavior. Temporary crawl restrictions can protect staging environments, but they must not survive the launch.
google advises removing temporary noindex directives and crawl blocks once the production site is ready, and notes that Googlebot's crawl rate may dip temporarily after a hosting change. Google's hosting-move documentation provides the relevant launch checks. Test from outside the development environment after changing DNS or infrastructure. A form that works on staging can still fail in production because of mail settings, permissions, missing files, or an incorrect service connection.
What server versions should a WordPress project use?
WordPress currently recommends PHP 8.3 or later, MariaDB 10.11 or later or MySQL 8.0 or later, plus HTTPS. Its published minimums still permit PHP 7.4 and MySQL 5.5.5, but those older releases are end-of-life and may expose a site to security vulnerabilities. WordPress.org's current requirements should guide the target environment.
Confirm compatibility before upgrading production. Test the active theme, plugins, scheduled tasks, command-line jobs, forms, payment flows, and third-party connections against the intended PHP and database versions. A migration is a poor time to preserve obsolete infrastructure merely because it still starts. If an essential extension cannot run on the recommended stack, decide whether to update, replace, isolate, or retire it before launch.
Which accessibility standard should the new site target?
Use WCAG 2.2 for new or updated accessibility requirements. WCAG, or the Web Content Accessibility Guidelines, applies to desktop and mobile web content. W3C says conformance with version 2.2 also covers versions 2.0 and 2.1, although no standard meets every user need. The W3C WCAG 2.2 Recommendation explains its criteria and limits.
Test more than templates. Include menus, dialogs, forms, error messages, account areas, checkout steps, embedded media, keyboard operation, focus visibility, zoom, and screen-reader labels. EU rules also affect certain online shops, ticketing platforms, and banking services placed on the market after June 28, 2025. A micro service business may be excepted if it has fewer than 10 employees and turnover below €2 million. Claims of disproportionate burden require evidence and review every five years.
What security check is easiest to overlook?
Access control deserves a dedicated review after migration. It determines whether a visitor may view, create, edit, download, approve, or delete a resource. OWASP ranks Broken Access Control first in its 2025 Top 10.
Its contributed data found access-control weaknesses in every tested application, and OWASP says enforcement must happen on the server because attackers can modify browser-side checks. Test each role against direct URLs and requests, not only visible menus. A hidden edit button does not prevent someone from requesting the edit endpoint. Check anonymous visitors, customers, authors, editors, administrators, suspended accounts, and former staff.
How should performance be verified after launch?
Measure real visitors instead of relying only on a fast staging test. Google's good Core Web Vitals targets at the 75th percentile are an LCP of 2.5 seconds or less, an INP of 200 milliseconds or less, and a CLS of 0.1 or less. LCP reflects how quickly the main content appears.
INP measures interaction responsiveness, while CLS captures unexpected visual movement. Lab tools help isolate problems, but they cannot replace field measurements from real users, devices, networks, and page types. Compare results by template and device class. Review the homepage, article pages, search, forms, account screens, and conversion paths separately; a fast homepage cannot prove that a slow checkout or editor-heavy article template is healthy.
You Might Also Like
- CMS Migration and Web Development 2026 Guide: compatibility, security, and performance; Key Facts and Questions to Ask
- Website Maintenance FAQ for August 2026: Source-Checked Answers to Common Questions
- What Is New With CMS Migration and Web Development in August 2026? Latest release notes and search documentation and Key Takeaways
