Websites, CMS & Ecommerce
Marketing sites, content platforms, and online stores. Mostly WordPress and WooCommerce, with Shopify, Medusa.js, headless, and static builds where those fit better. New builds, rebuilds of sites you already have, migrations between platforms, and the speed, security, and maintenance work that keeps them running afterwards.
Platforms we build on
WordPress + WooCommerce
Content-led sites and most stores. Full control of the code and data, no platform fees, an editor your team already knows.
Shopify
Hosted infrastructure, PCI scope handled for you, and a smaller operational burden. Custom themes and private apps where the default theme falls short.
Medusa.js
A headless TypeScript commerce backend for B2B pricing, multi-region catalogues, marketplaces, and subscription rules a store template can't express.
Headless WordPress
WordPress as the editing interface, a Next.js front end for the speed. Useful when the same content also feeds an app or a partner feed.
Static and hybrid
CMS-backed static builds for sites that publish rather than transact. Cheap to host and close to nothing to attack.
Choosing between them
Decided in discovery, against your catalogue size, how you sell, your integrations, and who maintains the site day to day.
What we do
Custom sites from scratch
Design and build around your brand and content structure rather than a marketplace theme.
Theme & block development
Bespoke WordPress themes and custom Gutenberg blocks, so pages get composed in the editor without a developer.
WooCommerce stores
Catalogue, variations, cart, and checkout, including the fields and rules your fulfilment process needs.
Shopify & Medusa builds
Custom Shopify themes and private apps; Medusa.js commerce backends with a Next.js storefront.
Payments & subscriptions
Stripe, PayPal, and local gateways, plus recurring billing, trials, proration, and dunning on failed cards.
Tax, shipping & fulfilment
Tax rules by region, live carrier rates, label generation, and integrations to your warehouse, 3PL, or ERP.
Content modelling & training
Post types, fields, and templates shaped around what you publish, handed over with a walkthrough and written notes.
Plugin, app & API development
Custom plugins and apps for functionality nobody sells, plus CRM, ERP, and inventory integrations over their APIs.
Migration & replatforming
Between any of these platforms, in either direction: pages, media, products, customers, orders, URLs, and redirects.
Speed optimisation
Core Web Vitals as the target. Caching, image and font handling, CDN, database cleanup, and cutting plugin and script weight.
Security hardening
Least-privilege accounts, 2FA, WAF rules, file permissions, login protection, and the configuration defaults a fresh install gets wrong.
Malware removal & recovery
Infection cleared, backdoors found, blacklist entries lifted, entry point closed, then the site hardened against a repeat.
Backups & disaster recovery
Automated off-site backups on a schedule that matches how often the site changes, with test restores.
Maintenance & care plans
Core, theme, and plugin updates tested on staging first, uptime and broken-link monitoring, and a monthly report.
Technical SEO & analytics
Site structure, schema markup, sitemaps, redirects, and ecommerce tracking in GA4 or a privacy-friendly alternative.
What speed work involves
Sites arrive slow for a small number of repeatable reasons, so the work starts with a page-level audit and ends with before-and-after numbers from a real test on a real connection.
Front-end weight
Removing plugins and scripts that load site-wide to serve one page, and cutting unused CSS and JavaScript.
Images and fonts
Correct dimensions, WebP or AVIF, lazy loading below the fold, and self-hosted fonts that don't block the first paint.
Caching and CDN
Page, object, and browser caching configured for the platform, static assets served from a CDN.
Database and queries
Clearing revisions, transients, and orphaned rows, and fixing the slow queries a large catalogue exposes.
Dynamic pages
Cart, checkout, and account can't be cached, so those get profiled and optimised separately.
Hosting
Moving off shared hosting where that's the actual bottleneck, with PHP version and server settings tuned.
What security work involves
These platforms are scanned continuously by bots looking for known plugin vulnerabilities and reused passwords. Low traffic is not protection. On a store, a compromise also becomes a data-breach obligation.
Access control
Named accounts with the lowest role that works, 2FA on admin logins, and old accounts removed when people leave.
Login and firewall
Brute-force limits, a web application firewall, and blocking the paths bots try first.
Patching
Core, theme, and plugin updates applied on a schedule, tested on staging, with abandoned plugins replaced.
Monitoring
File integrity and malware scanning, uptime checks, and alerts that go to a person rather than an unread inbox.
Payment data
Card details handled by the gateway and never stored on your server, keeping PCI scope as small as it can be.
Recovery
Off-site backups, a documented restore procedure, and a test restore so you know how long it actually takes.
Who this is for
Businesses whose site needs to load fast and stay up. Marketing teams who want to publish without raising a ticket. Merchants who have outgrown a hosted platform or its fees. Anyone who has been hacked once, or inherited a site from an agency that has gone quiet.
Frequently asked
We just need a marketing site, not a store. Is that too small?
No. Small sites are a normal part of the work. Shorter timeline, same standards: it loads fast, your team can edit it, and you're not calling us to change a phone number.
Which platform should we be on?
Each one trades something. Hosted platforms run the infrastructure for you, as long as you can work inside their rules. Self-hosted gives you control over pricing logic, your own customer data, and what the whole thing costs to run, with the upkeep as the price of that. Headless setups suit stores where the commerce logic itself is the complicated part. Which of those matters most depends on your catalogue, how you sell, and who looks after the site day to day, so it's one of the first things we go through with you.
Our platform fees are adding up. Is moving worth it?
Depends on the arithmetic, and it's worth doing properly. Add up the platform fee, the apps you pay for monthly, and any percentage taken on top of what your payment processor already charges. Set that yearly total against what a rebuild, hosting, and ongoing maintenance would cost. Sometimes it pays back quickly. Sometimes the money does more work elsewhere and staying put is the right call.
Will our team be able to edit the site ourselves?
Yes. Custom blocks built for your layouts, so someone in marketing can put a page together and publish it without a developer and without breaking the design by accident. We set the roles up too, so whoever writes blog posts can't reach the checkout settings.
Do we need headless, or is that overkill?
It comes down to what the site has to do. Headless earns its extra complexity when the front end needs to be faster than a conventional CMS can manage, or when the same content feeds a website and an app and something else besides. Plenty of sites don't need either, and a conventional build costs less to run and is easier for your own team to look after. We'll go through both before anything gets decided.
Can you work on our existing site, or only new builds?
Both. A lot of this is somebody else's work — an audit, a cleanup, cutting the plugin count back, or picking up maintenance after the original builder went quiet.
Do you work with page builders like Elementor or Divi?
Yes. If your site is already built on one, we'll work inside it rather than tell you to start over. On a new build we'll lay out the trade-off — a builder is familiar and quick for a non-technical team to pick up, custom blocks are lighter and cheaper to maintain — and you choose which side of it you want to be on.
Can you migrate us without losing content, orders, or rankings?
Yes, and in either direction. Pages, media, products, customers, order history. The part that actually protects your rankings is the redirect map from old URLs to new ones, so that gets built carefully. We run the whole thing on staging and check the numbers match before switching anything.
Can the platform handle our catalogue and traffic?
In most cases, yes. Large catalogues run fine when the hosting, the caching, and the database queries behind them are set up for the size. Slowness that gets blamed on the platform is usually the hosting plan, or the number of plugins stacked on top of it.
How fast can you make our site?
Depends what's slowing it down, so we audit first and give you a target with the fixes behind it. Neglected sites usually have easy wins sitting in plain view: an unsized hero image, four plugins doing one job, a database full of old revisions. We won't quote you a score before seeing the site.
Who hosts it, and what does it cost to run?
You own the hosting account, in your name. We recommend something that suits the traffic and the platform, set it up, and hand you the login. What it costs varies a lot between a brochure site and a busy store, so you'll get a real figure during discovery rather than a range now.
Our site was hacked. Can you help?
Yes. Clean the infection, find how they got in, close it, restore from a clean backup if it comes to that. Then harden the site and add monitoring.
What's actually in a maintenance plan?
Updates tested on staging before they reach production, security and uptime monitoring, off-site backups that get test-restored, and a short monthly report. On stores we watch the checkout specifically, because an update that breaks it costs money by the hour. Small content and fix requests are usually included, and we agree where that line sits at the start.