openclaw/wp-to-static

WordPress to Static Site (Cloudflare Pages)

Convert a WordPress website to a pixel-perfect static site and deploy it to Cloudflare Pages. Zero attack surface, zero hosting cost, instant load times.

Prerequisites

Before running this skill, the user MUST have:

1. GitHub CLI authenticated: Run gh auth status to verify. If not logged in, run gh auth login first.
2. Cloudflare Wrangler authenticated: Run wrangler whoami to verify. If not logged in, run wrangler login first.
3. SSH key added to ssh-agent: The recommended way to handle SSH keys. Run:

   eval "$(ssh-agent -s)"
   ssh-add ~/.ssh/your_wp_key
   

4. Server host key verified: The user should have connected to the server at least once and accepted the host key, so it exists in ~/.ssh/known_hosts.

Environment Variables

Required (stop and ask if any are missing):

• WP_SSH_HOST — SSH hostname (e.g., ssh.example.com)
• WP_SSH_USER — SSH username
• WP_SSH_PORT — SSH port (e.g., 18765)
• WP_SSH_KEY — Path to SSH private key file (e.g., ~/.ssh/wp_key). Key must have chmod 600 permissions.
• WP_SITE_URL — WordPress site URL (e.g., https://example.com)
• WP_SITE_NAME — Short project name (e.g., mysite)

Optional:

• CF_ACCOUNT_ID — Cloudflare account ID for Pages deployment
• GH_REPO_VISIBILITY — private (default) or public

Security Model

• SSH authentication uses ssh-agent — keys are loaded into the agent before running, so no passphrase is passed via environment variables or command arguments
• SSH host key verification is ENABLED (no StrictHostKeyChecking=no) — the server must already be in ~/.ssh/known_hosts
• Credentials are NEVER logged, echoed, or displayed
• Credentials are NEVER committed to git
• GitHub repos are created as private by default

Step 0: Validate

1. Check all required env vars are set. If any are missing, stop and tell the user.
2. Verify required binaries exist: ssh, ssh-agent, rsync, curl, git, gh, wrangler.
3. Verify gh auth status succeeds. If not, tell user to run gh auth login.
4. Verify wrangler whoami succeeds (if CF_ACCOUNT_ID is set). If not, tell user to run wrangler login.
5. Verify SSH key file exists and has correct permissions (chmod 600).
6. Stop if anything is missing.

Step 1: Test SSH Connection

Test the connection using the key from ssh-agent:

ssh -i $WP_SSH_KEY -p $WP_SSH_PORT $WP_SSH_USER@$WP_SSH_HOST "echo connected"

If the key requires a passphrase and ssh-agent is not loaded, tell the user:

Please add your SSH key to ssh-agent first:
  eval "$(ssh-agent -s)"
  ssh-add /path/to/your/key
Then re-run /wp-to-static

If the host key is not recognized, tell the user to connect manually once first to verify and accept the host key:

Please connect to the server once manually to verify the host key:
  ssh -i $WP_SSH_KEY -p $WP_SSH_PORT $WP_SSH_USER@$WP_SSH_HOST
Accept the host key, then re-run /wp-to-static

Do NOT use StrictHostKeyChecking=no. Do NOT bypass host key verification.

Step 2: Locate WordPress Installation

SSH in and find the WordPress public_html directory. Common locations:

• ~/www/DOMAIN/public_html/
• ~/public_html/
• ~/htdocs/
• /var/www/html/

Confirm by finding wp-config.php. Store path as WP_ROOT.

Step 3: Mirror with wget (ON THE SERVER)

Run wget --mirror on the server (not locally):

cd /tmp && rm -rf static_mirror && mkdir -p static_mirror && cd static_mirror && \
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent \
  --restrict-file-names=windows -e robots=off --timeout=30 --tries=3 --wait=0.5 \
  --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
  $WP_SITE_URL/ 2>&1 | tail -30

If wget is not available on the server, fall back to curl locally for rendered HTML.

Step 4: Rsync to Local

Create ./build/site (NEVER use the project root as temp dir).

Exclude server-side code and sensitive files. Only static assets (images, CSS, JS, fonts) are needed. PHP files, config files, and other server-side code must NEVER be downloaded.

RSYNC_EXCLUDE="--exclude='*.php' --exclude='wp-config*' --exclude='.htaccess' --exclude='*.sql' --exclude='*.log' --exclude='debug.log' --exclude='error_log' --exclude='.env' --exclude='*.bak' --exclude='*.backup'"

rsync -avz $RSYNC_EXCLUDE server:/tmp/static_mirror/DOMAIN/ ./build/site/
rsync -avz $RSYNC_EXCLUDE server:$WP_ROOT/wp-content/uploads/ ./build/site/wp-content/uploads/
rsync -avz $RSYNC_EXCLUDE server:$WP_ROOT/wp-content/themes/ ./build/site/wp-content/themes/
rsync -avz $RSYNC_EXCLUDE server:$WP_ROOT/wp-content/plugins/ ./build/site/wp-content/plugins/
rsync -avz $RSYNC_EXCLUDE server:$WP_ROOT/wp-includes/ ./build/site/wp-includes/

After rsync, verify no PHP or config files were downloaded:

find ./build/site -name '*.php' -o -name 'wp-config*' -o -name '.htaccess' -o -name '.env' | head -20

If any are found, delete them before proceeding.

Step 5: Extract Only Referenced Assets

This is the key step. Parse all HTML and CSS files to find every referenced local file:

From HTML: src=, href=, data-src=, data-srcset=, srcset=, inline background-image: url()

From CSS: All url() references — resolve relative paths from CSS file location to site root.

Write the list to ./build/referenced-files.txt, then copy only those files to ./public/ preserving directory structure. This typically shrinks 1.5GB+ down to ~25MB.

Step 6: Fix Absolute URLs

In index.html and ALL CSS files:

1. Replace $WP_SITE_URL/ → empty string (relative paths)
2. Replace any staging/dev domain URLs → local paths
3. Self-host Google Fonts:
   • Download each .ttf to ./public/fonts/
   • Update @font-face src: to fonts/filename.ttf
4. Remove <link rel="preconnect"> for Google Fonts domains

CSS path resolution is critical. If CSS is at wp-content/uploads/cache/file.css:

• wp-content/uploads/ → ../../
• wp-content/themes/ → ../../themes/
• wp-includes/ → ../../../wp-includes/

Step 7: Strip WordPress Cruft

Remove:

• <meta name="generator" ...> (WordPress, WPBakery, Slider Revolution)
• <link rel="EditURI"...>, <link rel="alternate"...> (RSS, oEmbed)
• <link rel="https://api.w.org/"...>, <link rel="shortlink"...>
• <link rel="profile" href="gmpg.org/xfn/11">
• <link rel="dns-prefetch"...> for fonts.googleapis.com
• W3 Total Cache HTML comments
• wp-json root references in inline JSON

Keep: Email addresses, <link rel="canonical"> (update to /)

Step 8: Cloudflare Pages Config

Create ./public/_headers with aggressive caching for /fonts/*, /wp-content/*, /wp-includes/*.

Create ./public/_redirects redirecting /wp-admin/*, /wp-login.php, /xmlrpc.php, /feed/* → / (302).

Step 9: Verify Locally

1. Start python3 -m http.server from ./public/
2. Test key assets return HTTP 200 (CSS, JS, logo, fonts, images)
3. Tell user to open the URL and visually verify
4. Wait for user confirmation before deploying

Step 10: Scrub Temporary Files and Deploy

Before any git operations, remove the ./build/ directory to ensure no server-side code, PHP files, or sensitive data can accidentally be committed:

rm -rf ./build

Verify only ./public/ remains and contains no PHP or config files:

find ./public -name '*.php' -o -name 'wp-config*' -o -name '.htaccess' -o -name '.env'

This must return empty. If not, delete those files before proceeding.

Then deploy:

1. git init, commit ONLY ./public/ and .gitignore
2. git config http.postBuffer 524288000 (for binary assets)
3. gh repo create $WP_SITE_NAME --private --source=. --push
4. CLOUDFLARE_ACCOUNT_ID=$CF_ACCOUNT_ID wrangler pages project create $WP_SITE_NAME --production-branch main
5. CLOUDFLARE_ACCOUNT_ID=$CF_ACCOUNT_ID wrangler pages deploy ./public --project-name $WP_SITE_NAME
6. Verify deployment, report live URL, remind about custom domain setup

Safety Rules

• NEVER display or log credentials (SSH keys, passphrases, tokens)
• NEVER commit credentials to git (.gitignore must exclude .env, *.key, *.pem)
• NEVER use StrictHostKeyChecking=no or bypass SSH host verification
• NEVER pass passphrases as command-line arguments or environment variables at runtime
• NEVER delete the current working directory (breaks the shell CWD)
• NEVER force-push or use destructive git commands
• NEVER rsync PHP files, wp-config, .htaccess, .env, or SQL dumps from the server
• Use ./build/ for temp files, ./public/ for output — only ./public/ is committed
• ALWAYS delete ./build/ BEFORE any git operations to prevent accidental commits of server-side files
• Verify ./public/ contains no PHP or config files before committing
• Stop and report on any failure — do NOT retry blindly