Shopify migration · UK · 4 weeks

Shopify migration in four weeks for retailers on legacy PHP ecommerce platforms

Your platform needs
a security patch.
What if it can’t have one?

Two critical PHP flaws were made public on 21 October. Older PHP versions get no fix. If you are on one, the question is how fast you can move.

On 21 October, two critical flaws in PHP, the language behind most older ecommerce platforms, were made public. Fixes exist only for the newest versions. If your store runs on an older proprietary platform, the question isn’t whether to move. It’s how fast you can move without losing what you’ve built.

Get my free Platform Risk Check See the 4-week plan

350+Shopify stores engineered

2,800+Products migrated for Lipton’s

4 weeksLegacy platform to live Shopify store

20+ yearsIn ecommerce, senior-led

[ Platforms I move stores from ]

From your platform to Shopify.

Migration specialists for established retailers on these platforms, and most others.

Visualsoft
WooCommerce
BigCommerce
PrestaShop
Magento / Adobe Commerce
OpenCart
EKM
ShopWired
Sellerdeck (Actinic)
CubeCart
Shopware
osCommerce
Zen Cart
Lightspeed eCom
Wix
Squarespace
Custom PHP builds

[ 01 — What happened ]

What happened on 21 October.

This isn’t a scare story. It’s a dated record of what was published this week, with the sources listed at the foot of the page.

20 October 2026
Details of two critical vulnerabilities in PHP leak ahead of their planned disclosure.
21 October 2026
PHP releases fixes for CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity, and both let an attacker run code on a web server without logging in.
Which versions
Fixes exist only for PHP 8.2, 8.3, 8.4 and 8.5. Older versions, including PHP 5 and 7, receive no fix. The affected code reaches back to PHP 5.4.
The official advice
The FBI advised organisations that cannot update straight away to take affected systems offline. CISA urged immediate patching.
Since then
Security firms reported attack attempts within hours of the leak.

If your platform runs an older version of PHP, there is no patch coming. There is only a plan.

[ 02 — Why your platform is different ]

On most platforms, you can’t patch it yourself. You wait.

Many established UK retailers run on proprietary platforms built ten or more years ago and owned by the agency that hosts them. That model had real advantages. But it means one company controls your code, your hosting, your upgrade timetable and your contract.

When a flaw like this lands, you can’t hire a developer to fix it this afternoon. You wait for your provider. On Shopify, the platform, the hosting and the security are run for every store, all the time. You don’t patch servers on Shopify. Shopify does.

	Legacy proprietary PHP platform	Shopify
Who patches the platform	Your provider, on their timetable	Shopify, continuously, for every store
Can you check your PHP version	Usually not without asking	Not needed: you don’t run servers
Card payment security	Depends on your provider’s setup	PCI DSS Level 1 certified
Contracts	Often multi-year minimum terms	Plans you can change or cancel
Apps and integrations	A limited set chosen by your provider	Thousands of apps
Who owns your theme and data	Check your contract	You do

Legacy platforms differ. Ask your provider the three questions below for the facts about your own store.

[ 03 — Three questions ]

Three questions to ask your provider this week.

You don’t need to be technical. You need three answers, in writing.

Which version of PHP is my store running on today?

The answer decides whether a fix even exists for your platform.

Has it been patched against both flaws, and on what date?

CVE-2026-109618 and CVE-2026-109619. A date is an answer. “We’re looking into it” isn’t.

If it can’t be patched, what’s the plan, and when can I leave?

You need the timetable for a fix and the end date of your contract.

Can’t get clear answers? Send me your store address. I’ll check what’s publicly visible and tell you, plainly, where you stand.

Get my free Platform Risk Check

[ 04 — The difference ]

A Monday morning, two ways.

The same news lands on two retailers’ desks. What happens next depends on who runs the platform.

An illustration, not a client story

On Shopify

8:02You read about a critical web vulnerability over coffee.
8:05You check Shopify’s status page. Nothing for you to do.
9:00Your team packs the weekend’s orders. The week carries on.

On a legacy platform

8:02You read the same news.
8:30You email your platform provider to ask what version you’re on.
11:45An automated reply arrives: “We’re investigating.”
14:00Your insurer asks whether your site is affected. You don’t know.
17:30You’re still waiting, and still taking orders.

Same news. One business gets on with the week.

[ 05 — The plan ]

The 4-week migration.

Replatforming used to take six months. Mine takes four weeks, because a senior team does it, not a queue.

Week 1

Audit and map

I map every product, variant, category, customer, order and address on your current store, agree the design direction and lock the launch date.

Week 2

Design and build

Your Shopify theme is built to your brand, not a template with your logo on it. Apps are chosen to replace every feature you rely on today.

Week 3

Move and connect

Products, customers and order history move across. Every old address is permanently redirected. Payments, shipping, email and stock systems are connected and tested.

Week 4

Test and launch

Full checkout testing on real devices, a final data sync on launch day so no orders are lost, then go-live with 30 days of support included.

[ 06 — What moves ]

What moves with you.

Everything your customers and Google know you by comes across. You keep trading on the old store until the moment the new one goes live.

Products, variants, prices and stock
Categories and collections
Product images and descriptions
Customer accounts
Order history
Reviews
Information pages and blog posts
Discount codes you still use
Every old address, permanently redirected
Page titles and meta descriptions
Google Analytics, Meta and Google Ads tracking
Your domain name

[ 07 — Your rankings ]

Your rankings come with you.

Your Google rankings took years to build. A careless migration loses them in a weekend. Older platforms often use page addresses that Shopify doesn’t, such as product and category addresses ending in codes. Every one of them has to point to its exact new home.

Every address mapped

A full crawl of the old store before I start, so every product, category and page has a destination.

Every redirect tested

Permanent redirects are set and checked before launch, with titles, descriptions and structured data carried across.

Thirty days watched

Sitemap resubmitted on launch day and Search Console checked against a baseline taken before I began.

Who builds your new store

Bespoke Shopify website design and development by someone who has engineered 350+ stores.

Custom Shopify website design and redesigns, bespoke theme builds, platform migrations, apps, integrations and high-level technical work, senior-led end to end, with the experience of engineering and optimising over 350 Shopify themes and stores behind it.

Get my free Platform Risk Check

Wave SUP Boards

Reference build · Custom Shopify development Custom designed from the ground up, not page mockups · desktop & mobile in parallel

Delivered 350+ Shopify stores designed, built and optimised

Code ownership 100% Native theme code, no page-builder apps, no lock-in

Team Senior-led One senior team from first brief to launch, no handovers

Engineering Speed & SEO Design, build, speed, SEO and AI-search engineering in every store

[ 08 — Proof ]

I’ve done this before, for retailers who couldn’t afford to get it wrong.

Two established retailers, rebuilt and grown by the same senior team. Lipton’s was moved from its old platform with 2,800+ products migrated. Hi-Fi Centre was rebuilt on its existing Shopify store.

[ Case 001 · Named client ]

LIPTONS·AUDIO VIDEO

Ontario · Premium audio & connected home

Shopify rebuild · Ontario, CA 3 years · active

+191%

+114% again the following year · 11.9x blended return

A bespoke Shopify build for a premium hi-fi and home cinema retailer carrying thirty specialist brands, then three years of senior-led paid media. Marketing cost fell from 17.6% to 8.5% of revenue while revenue compounded.

[ Case 002 · Named client ]

Hi-Fi Centre Vancouver

Vancouver · High-end audio & video since 1984

Rebuild & technical SEO · Vancouver, CA 6 years · active

+202%

6.8x revenue since 2021 · 19x blended return

Seven agencies had failed before the store was rebuilt properly. Foundations fixed first, then seven months of organic growth on no ad spend, with paid media switched on only once it could pay for itself.

[ 09 — My work ]

Stores I’ve designed, built and moved.

The kind of store I build: native Shopify theme code, designed for desktop and mobile in parallel, and engineered to load fast before a single app is added.

Lipton’s Audio & Video

Lipton’s Audio & Video · Homepage & product

Thirty premium brands,
one store.

A bespoke Shopify store for a premium hi-fi and home cinema retailer in Ontario, designed, built and migrated from the ground up. A filtering layer lets customers narrow a thirty-brand catalogue by what they actually care about, with 2,800+ products migrated and re-optimised.

Bespoke Shopify build
Thirty-brand filtering
2,800+ products migrated

Hi-Fi Centre

Hi-Fi Centre · Homepage & product

A custom theme,
built to rank.

A custom Shopify theme for a Vancouver high-end audio and video retailer, built on their existing store with technical SEO first. Catalogue, theme and site architecture were rebuilt as one piece of work in eight weeks, and pages now load in under a second.

Custom Shopify theme
Technical SEO-first
<1s page load

Kestrel Audio

Kestrel Audio · Under development

A showroom,
brought online.

Brand-led and showroom-first. The homepage leads with a flagship system and a demo booking, then hands over to category and brand navigation, so a buyer can go straight to what they came for.

Showroom-first hero
Shop by category & brand
Book-a-demo path

Link coming soon

Specialist hi-fi retailer

Specialist hi-fi retailer · Under development

Authorised brands,
picked by people.

Built around how specialist hi-fi actually sells: authorised brands straight under the hero, shop by category, installation services, staff picks with a named recommendation on every card, and a clear path to book a listening demo.

Authorised dealer brand bar
Staff picks with real voices
Listening-demo booking

Link coming soon

Wave SUP Boards

Wave SUP Boards · Homepage & collection

Paddleboards, kayaks
and a seasonal catalogue.

A seasonal, heavily-visual catalogue with a short buying window — so the homepage has to carry category navigation, range and trust in one screen. On mobile the kayak range page puts pricing, review scores and specification badges into the card itself, so the comparison happens in the grid.

Shopify · custom theme
Spec-rich collection cards
Full schema coverage

ROAVE

ROAVE · Homepage & collection

Editorial apparel,
built to browse.

A fabric-first essentials brand where the photography does the selling. Full-bleed editorial blocks on desktop, and a collection grid on mobile with swipeable product imagery, inline size and colour options and add-to-basket in the tile — browsing and buying in the same gesture.

Editorial homepage
Mobile collection grid
Inline variant selection

Flooring Revolution

Flooring Revolution · Homepage & product

A large catalogue,
filtered six ways.

Considered-purchase retail: a deep range filtered by colour, type, style, thickness, price and wood grade. The product page carries an area calculator, live price per m², free-sample ordering and finance terms — the questions a flooring buyer asks before they will commit.

Faceted filtering at scale
Shop by colour, room & type
Area calculator & free samples

01 / 07

[ In their words ]

What clients say
about working together.

Past and present engagements.

We'd been stuck at around £1.5M in revenue for two years. K came in and asked the right questions — he reworked our funnel, improved our messaging hierarchy, and helped us rethink our ad creative strategy. Within 90 days we saw a major uplift in ROAS and retention, and today we're tracking toward £3M+ and are more confident than ever in our direction.

R. Skeoch Hyperion Tiles

Over the years I worked with no less than seven agencies who all claimed they could boost our traffic and revenue. Every one of them failed. K was the first to show me the actual flaws holding the site back — and instead of promising traffic, he promised to fix them. Eight weeks later the site was rebuilt on Shopify, and our online sales in the past two months are almost equal to the entire year before.

I. Krivetsky Hi-Fi Centre

We had written off Facebook Ads years ago — we'd tried running them ourselves and hired two different agencies, and both times it felt like throwing money into a black hole. K didn't start with campaigns, he started with numbers: our AOV, our margins, our ideal CAC. Our ROAS more than doubled, but beyond the numbers we finally understood how paid social could fuel growth rather than burn budget.

D. Holdsworth Flightstore

We'd been paying a well-known ecommerce agency a five-figure monthly retainer, but the strategy was generic and our account manager kept changing. Within the first week with K the difference was clear — he understood our numbers, our margins and our audience better than anyone we'd worked with. We saw a 3.7x increase in ROAS, a 21% bump in repeat purchases and, most importantly, clarity.

Fashion brand Name withheld under NDA

We have just launched the next phase of our e-commerce business and KA has held our hand when needed and given us the confidence to look at projects we previously wouldn't consider for our brand.

J. Atkinson Director

In just 8 weeks we have seen a 22.6% increase in organic traffic and nearly a 30% increase in Google organic revenue — so far we're very happy with the results.

A. Hall Pink Boutique

At a time of many simultaneous developments on our site, KA Consultancy understood our requirements from the very first day, and some of the main challenges we had have been improved considerably. I'm happy with the active, hands-on approach.

J. Castell Skandium

We have worked with KA Consultancy since October, and since then our organic visibility and — more importantly — organic revenue have grown significantly. He also provides guidance and training to enhance our in-house SEO work, for a two-pronged and more productive approach to this vast topic.

S. Cochrane Psyche

Working with KA has already elevated our success across all channels within such a short period of time. We are confident the growth will only continue to excel, and are very happy to be trusting our business to such a professional and hands-on company.

Fashion boutique Name withheld under NDA

[ Selected previous engagements ]

Stores and brands designed, built,
rebuilt, migrated and optimised.

A few examples from over two decades and 350+ Shopify stores.

[ 10 — Timing ]

Still in contract? Plan now, switch on your end date.

Most legacy platform contracts run for a fixed term. I’ll read your end date with you, build and test your new Shopify store in the background, and switch over on the day you’re free. No rush, and no surprise renewal.

Black Friday is 27 November. Choose your route.

Route 1

Launch before peak

Start this week and go live before Black Friday. For retailers who want off their platform before their busiest weeks.

Route 2

Secure now, launch in January

I complete the risk check, data map and design now, then launch in the quiet weeks after Christmas, without touching your store during peak.

Timeline4 weeksFrom signed brief to a live Shopify store

PriceFixedAgreed after your free risk check, before any work starts

[ 11 — Who it’s for ]

Not for every store.

I take on a small number of migrations at a time, so each one gets the senior attention it needs.

i.Established retailers with a real business on the line
ii.Stores on a legacy or proprietary ecommerce platform
iii.Owners who want it done properly, not cheaply
iv.Based in the UK

[ 12 — Frequently asked ]

Questions retailers ask.

Rankings, customers, contracts, peak season and what happens if you’ve been told to go offline.

Get my free Platform Risk Check

Taking a store offline stops the risk and the sales at the same time. It doesn’t fix the platform. Send me your store address today. I’ll plan a full Shopify migration in four weeks, and if you need to trade sooner, I can put your catalogue on a basic Shopify store as a stopgap while the full build is done.

I can’t tell you that from the outside, and nobody honest can. What I can tell you is what’s publicly visible about your store, and the right questions to put to your provider. That’s what the free Platform Risk Check covers.

Not if the migration is done properly. I redirect every old address to its new one, keep your titles and descriptions, and monitor Search Console for 30 days after launch.

Their accounts and order history move across. Passwords can’t be moved, for security reasons, so customers simply sign in again on Shopify with their email address. I set up the message that tells them how.

For most established retailers, yes. Very large catalogues or complex integrations can take longer, and I’ll tell you after the risk check, before you commit to anything.

I’ll plan around your end date, build and test the new store in the background, and switch you over on the day you’re free.

You can launch before peak, or secure everything now and launch in January without touching your store during your busiest weeks.

Shopify plans are paid to Shopify directly. I’ll recommend the right plan for your size after the risk check.

It can, or it can look better. You get a custom theme built for your brand, not a template with your logo on it.

No. I move retailers onto Shopify from Visualsoft, WooCommerce, BigCommerce, PrestaShop, Magento, OpenCart, EKM, ShopWired, Sellerdeck and most other ecommerce platforms, including custom-built stores.

You do. You receive the theme, documentation and full ownership of everything built. Thirty days of support are included. No lock-in.

I’m a UK practice. This migration offer is for established retailers across the UK.

[ Free Platform Risk Check ]

Find out where you stand. Free, and without obligation.

Request your free audit. A senior specialist will check what’s publicly visible about your platform and come back with a plain-English summary, your options, and a fixed price for the move if you want one.

Request your free store audit No obligation. No junior sales calls. If you’re not a fit, I’ll say so.

Sources

PHP security release, 21 October 2026: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS v4.0), fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
watchTowr, PHP2Shell FAQ, October 2026: no patches released for PHP 5 or 7.
SentinelOne, “Stopping PHP2Shell”, 21 October 2026: affected code dates back to PHP 5.4.
ABC News, 22 October 2026: CISA and FBI guidance.
Sansec, “PHP2Shell”, 21 October 2026: timeline of the leak and early attack attempts.
Case study figures as published on this site. Shopify PCI DSS Level 1 certification as stated by Shopify.

Shopify migration in four weeks for retailers on legacy PHP ecommerce platforms

Your platform needs a security patch. What if it can’t have one?

From your platform to Shopify.

What happened on 21 October.

On most platforms, you can’t patch it yourself. You wait.

Three questions to ask your provider this week.

Which version of PHP is my store running on today?

Has it been patched against both flaws, and on what date?

If it can’t be patched, what’s the plan, and when can I leave?

A Monday morning, two ways.

On Shopify

On a legacy platform

The 4-week migration.

Audit and map

Design and build

Move and connect

Test and launch

What moves with you.

Your rankings come with you.

Every address mapped

Every redirect tested

Thirty days watched

Bespoke Shopify website design and development by someone who has engineered 350+ stores.

I’ve done this before, for retailers who couldn’t afford to get it wrong.

Stores I’ve designed, built and moved.

Thirty premium brands,one store.

A custom theme,built to rank.

A showroom,brought online.

Authorised brands,picked by people.

Paddleboards, kayaksand a seasonal catalogue.

Editorial apparel,built to browse.

A large catalogue,filtered six ways.

What clients sayabout working together.

Stores and brands designed, built,rebuilt, migrated and optimised.

Still in contract? Plan now, switch on your end date.

Launch before peak

Secure now, launch in January

Not for every store.

Questions retailers ask.

Find out where you stand. Free, and without obligation.

Sources

Your platform needs
a security patch.
What if it can’t have one?

Thirty premium brands,
one store.

A custom theme,
built to rank.

A showroom,
brought online.

Authorised brands,
picked by people.

Paddleboards, kayaks
and a seasonal catalogue.

Editorial apparel,
built to browse.

A large catalogue,
filtered six ways.

What clients say
about working together.

Stores and brands designed, built,
rebuilt, migrated and optimised.