SSiddiq.in
The Monday-morning CMS

The best measure of a WordPress build isn't Lighthouse. It's whether your marketer opens it on Monday.

We've inherited enough "custom WordPress" sites to know what makes teams abandon them: builder soup, a hundred meta-boxes, and a preview that never matches production. This is how we do it differently.

Scope a WordPress build Rescue an old WP site
Where it wins · where it doesn't

We'll tell you when not to use WordPress.

Wins clearly at
  • • Editorial sites with 3+ writers publishing weekly
  • • 30–3000 pages needing categories, tags, taxonomies
  • • Membership, forum, LMS communities
  • • Multilingual sites with WPML / Polylang workflows
  • • Local businesses needing schema-first SEO out of the box
  • • Any project where the maintainer is a marketer, not a dev
Wrong tool for
  • • Real-time apps (chat, collab, live dashboards)
  • • Complex product UIs behind a login
  • • Anything requiring millisecond-tight API latency
  • • Sites where content is derived from a Postgres source of truth
  • • Teams already comfortable with Next.js + a CMS like Sanity
  • • Under 5 static pages — a hand-coded site is faster and cheaper
The plugin diet

90% of "slow WordPress" is 40 plugins in a trench coat.

The average site we audit runs 38 plugins. Most were installed once, forgotten, and now each one enqueues its own jQuery and 4 stylesheets on every page.

Contact form
Contact Form 7 + WPCF7 Skins + reCAPTCHA plugin + honeypot plugin
One custom block, native fetch, Turnstile server-side
−480 KB, −3 requests
Page speed
WP Rocket + Autoptimize + Async JS + Perfmatters + Cloudflare plugin
Cloudflare + APO + our lean theme. That's it.
−1.2 MB, −11 requests
SEO
Yoast + All-in-One + Schema Pro + WP Sitemap Page + Redirection
Rank Math (one plugin), configured properly
−4 plugins, faster admin
Backups
UpdraftPlus + BackupBuddy + WP Migrate DB Pro
Managed host snapshots + Jetpack VaultPress
Zero plugins, offsite by default
Security
Wordfence + iThemes + Sucuri + Limit Login Attempts
Managed WAF at the host + 2FA + fewer plugins to attack
Attack surface halved
Through the marketer's eyes

The editor is the product.

We build for the person who opens WP-Admin at 9:15 on Monday with three edits to ship. Every custom block is a conversation about what they need — and what they'll forget in six months.

Block Inserter · custom category
Hero
Title, subtitle, CTA. Preview matches production.
brand-locked
Feature Grid
3 or 4 columns. Icon library included.
brand-locked
Case Study Card
Auto-pulls from CPT. Fallback if unpublished.
brand-locked
Testimonial
Quote, name, role, headshot. Alt text required.
brand-locked
CTA Band
Two variants — light and dark. Locked spacing.
brand-locked
Compliance Notice
Legal-approved copy. Editable text, locked layout.
brand-locked
Hosting — where sites actually get fast

We're opinionated. Here's who we recommend, and when.

HostSweet spotApprox costSkip when
KinstaEditorial, 30k–500k visits/mo$35–$115/moTraffic under 10k or on a tight budget
WP EngineEnterprise & multisite$25–$400/moYou want cPanel and SSH-first workflows
Cloudways (Vultr HF)Best price-to-perf under 100k visits$14–$70/moYou need one-click staging environments
Rocket.net + Cloudflare EnterpriseSpeed obsessives$30–$100/moYou need niche PHP extensions
Self-hosted DigitalOcean dropletYou have a sysadmin$12–$40/moYou don't want to think about it ever again

WordPress FAQ

No — 43% of the web is not dying. What's dying is the Elementor + 40-plugin + shared hosting stack. Modern WordPress (Gutenberg, custom blocks, managed hosting, Cloudflare) is one of the best editorial CMSes on the planet.

Security hardening checklist

Twelve items that eliminate 95% of WordPress compromises.

Disable file editor
`define('DISALLOW_FILE_EDIT', true);` in wp-config.php. A compromised admin no longer means arbitrary PHP execution.
Move wp-admin behind auth or IP
HTTP basic auth or firewall rule. Blocks 90% of brute-force at the door — before WordPress boots.
Enforce 2FA on all editor+ roles
WP 2FA / miniOrange. No exceptions for 'the founder logs in from phone'.
Limit login attempts
5 tries → 15-minute lockout. Log the IP. Repeat offenders auto-banned at Cloudflare.
Disable XML-RPC
Attack surface for pingback DDoS + brute force. Kill unless Jetpack or mobile app explicitly needs it.
REST API — require auth for /users
Public /wp-json/wp/v2/users leaks every author's username. Filter to authenticated only.
Read-only wp-content in production
File permissions 644, directories 755, `chown` to a separate user from the web server. Uploads folder is the one writable exception.
Plugin discipline
Only from wordpress.org or paid vendors with active support. Removed = deleted, not deactivated. Autoupdate minor versions.
Salts rotated at deploy
Regenerate WP_AUTH salts. Invalidates every existing session — kicks out any attacker holding a cookie.
File-integrity monitoring
Wordfence / hash-diff via cron. Alerts on any change under /wp-includes or /wp-admin.
Backups: off-site, versioned, tested
Daily to a different provider (S3 + Backblaze). Restore rehearsed quarterly. A backup you haven't restored isn't a backup.
Header hygiene
HSTS, X-Content-Type-Options, Referrer-Policy, permissive-CSP-then-tighten. Grade A+ on securityheaders.com is the bar.

A WordPress build your team opens on Monday.

Start a project
Right tech, honest advice

Not sure if this is the right stack for you?

Tell us your goals — we'll recommend the right technology honestly, even if it isn't this one.

  • Personal reply from Siddiq within 24 hours
  • Honest advice — no pushy sales, no fake urgency
  • Clear next steps, timeline, and estimate

We only use your details to reply to this enquiry. Privacy.