From WordPress to Hugo: My Setup Explained

Ten years of WordPress taught me enough to know when to leave. You start tweaking PHP configs, switching to LiteSpeed, juggling plugin updates — and for what? A blog. WordPress makes sense for e-commerce maybe, but for a simple content site it’s just overhead. Every plugin is another attack surface, and the DB adds a bottleneck you don’t need.

Known vulnerabilities tracked at wpscan.com.

Hugo

merox.dev has been running on Hugo for over six months. Static files, no backend, free hosting on GitHub Pages, everything version-controlled. Hugo is written in Go so builds are fast, and the output is clean enough that SEO scores came in above 80% without any extra work.

I went with the Blowfish theme. To track upstream updates without breaking my customizations, I forked it and added it as a submodule:

git submodule add https://github.com/YOURUSERNAME/blowfish themes/blowfish

The only real downside to Hugo is that you need to be comfortable in a terminal and working with Markdown. There’s no dashboard.

GitHub Pages + Cloudflare

1. Push Hugo project to a private repo
2. Enable GitHub Pages on a public repo (branch: gh-pages, folder: /)
3. In Cloudflare, add a CNAME for www.yourdomain.com → yourusername.github.io and A records for GitHub Pages IPs if needed
4. Add a CNAME file to your repo:

1
merox.dev

Automated Deploys with GitHub Actions

My workflow: edit in VS Code → push to private repo → GitHub Actions builds and deploys to the public repo.

Private → Public Deploy via RSA

Since I keep the source in a private repo, I wire the two together with an SSH deploy key:

1. Generate the key pair:

ssh-keygen -t rsa -b 4096 -C "github-deploy" -f deploy_key -N ""

2. Public repo: Settings → Deploy Keys → add deploy_key.pub with write access

3. Private repo: Settings → Secrets → add PRIVATE_KEY with the private key contents

4. .github/workflows/deploy.yml:

1
name: github pages
2

3
on:
4
  push:
5
    branches:
6
      - master
7

8
permissions:
9
  contents: write
10
  id-token: write
11

12
jobs:
13
  deploy:
14
    runs-on: ubuntu-22.04
15
    steps:
16
      - uses: actions/checkout@v4
17
        with:
18
          submodules: true
19
          fetch-depth: 0
20

21
      - name: Setup Hugo
22
        uses: peaceiris/actions-hugo@v3
23
        with:
24
          hugo-version: 'latest'
25
          extended: true
26

27
      - name: Build
28
        run: hugo --minify
29

30
      - name: Deploy
31
        uses: peaceiris/actions-gh-pages@v3
32
        with:
33
          deploy_key: ${{ secrets.PRIVATE_KEY }}
34
          external_repository: meroxdotdev/merox.dev
35
          publish_branch: gh-pages
36
          publish_dir: ./public

SEO Results

No extra configuration — Hugo’s clean output just scores well out of the box.

From freetools.seobility.net

From seositecheckup.com