A professional website should be fast, secure and hard to attack — by default, not as an afterthought. This very site is a working example: strict security headers, green Core Web Vitals and structured data, all from the first commit. Here are the principles I build with, and why they cost less than retrofitting them later.
Security headers and a real CSP
A strict Content-Security-Policy, HSTS, X-Frame-Options and related headers shut down whole classes of attacks — cross-site scripting, clickjacking, mixed content — before any code runs. They cost nothing at build time and are painful to bolt on later, because a strict CSP forces discipline about every script and style you load. That discipline is a feature: if a third-party tag can’t justify its place in your policy, it probably shouldn’t be on your site.
Shrink the attack surface
- Disable unused entry points — for WordPress, things like XML-RPC and user-enumeration endpoints attackers probe first.
- Hide and harden the login — obscure the URL, rate-limit attempts, use strong authentication for admins.
- Least privilege everywhere — file permissions, database users and admin accounts get exactly what they need, nothing more.
- Update discipline — CMS, themes, plugins and server packages on a schedule, with backups you’ve actually restored from.
- Fewer moving parts — every plugin and page builder is attack surface plus performance debt. Lean builds are safer and faster.
Performance is SEO
Fast pages rank better and convert better. Self-hosted fonts (preloaded, with font-display: swap), right-sized modern image formats, sensible caching, a CDN and lightweight code give you strong Core Web Vitals without bloated page builders. Performance and security come from the same habit — shipping less, deliberately — which is why security and SEO are two sides of the same investment.
Build it to be found
Clean titles and meta descriptions, structured data (Organization, Article, Service), an XML sitemap and accessible, semantic markup mean search engines understand the site immediately. None of this is an “SEO package” upsell — it’s part of building properly, and it’s exactly what clients should demand when hiring a freelance web developer.
Prove it, don’t claim it
Every claim above is testable in minutes: run the site through PageSpeed Insights, check the headers with an online scanner, view source for structured data. I encourage clients to test this site the same way — and periodic penetration testing keeps the claims honest as the site evolves. What gets measured stays hardened.
What I ship on every build
- HTTPS enforced with HSTS, plus a strict, tested Content-Security-Policy.
- Hardened CMS configuration — locked-down logins, minimal plugins, scheduled updates and off-site backups.
- Green mobile Core Web Vitals — verified with PageSpeed, not promised.
- SEO foundations — meta, structured data, sitemap, clean URLs — baked in.
- Your ownership — domain, hosting and admin access in your name, with documentation.
Want a website built this way — or an existing one hardened and sped up? See my web development services or get in touch.