Most small business websites are built on templates or WordPress. They can work, but they come with software to patch, plugins to update and limits on what you can change. We build differently, and this page explains how, so you can compare for yourself.
Security update,
What the PHP2Shell flaws mean for your website
In October 2026, PHP, the software behind WordPress and a large share of the web, released emergency fixes for two critical security flaws known as PHP2Shell. They can let an attacker run their own code on a website's server, attacks have already been reported, and some organisations took their sites offline while they updated.
If your site runs on WordPress or another PHP-based system, ask your web provider to confirm the PHP update has been installed, not just scheduled. Updating WordPress itself doesn't update PHP.
Sites we build don't run PHP, so these flaws don't apply to them.
Secure from the ground up
The safest code is code that isn't there. Instead of adding security on top of a complicated setup, we keep the parts that can be attacked to a minimum.
No PHP or database on the web server
Our sites are built in advance into finished pages. When someone visits, the page is simply delivered. There is no PHP, no database and no admin login sitting on the public web server for attackers to target, so a whole category of attacks doesn't apply.
No plugins to go out of date
Typical WordPress sites depend on themes and plugins from different authors, and each one is something that can go out of date or be found vulnerable. Everything on our sites is built for that site, with nothing third-party bolted on.
Protected contact forms
Enquiries go through a small, separate service that checks where each request came from, limits how often it can be used, caps message size, validates every field and blocks automated spam bots before anything reaches your inbox.
Security settings on every page
Encrypted connections, plus browser security settings that stop your site being embedded in other pages or loading things it shouldn't, are applied to every page as standard.
No tracking, no cookie banners
By default our sites don't use tracking cookies or analytics scripts, so there's less personal data to look after and nothing slowing your pages down.
Updates are our job
Security updates and fixes are part of the monthly plan. You don't have to remember to log in and click update, or find out something was missed after it causes a problem.
Fast by design
Speed isn't something we tune at the end. It comes from how the site is built in the first place.
Pages ready before anyone asks
Because pages are built in advance, there's nothing to assemble when a visitor arrives, so there's no waiting for a server to look things up.
Served from near your visitors
Your site is delivered from a global network of servers, so it loads quickly for visitors wherever they are, and copes with busy periods without slowing down.
Only what each page needs
No page builder overhead or stack of plugin scripts. Each page loads only the code it actually uses, which matters most on phones and slower connections.
Modern tools and full control
We don't rely on a single platform or a drag-and-drop builder. We write the code ourselves with modern, widely used tools, which means more freedom for you and fewer limits later.
Built from scratch, not themed
We use the same kind of modern tools that many of the largest tech companies build with. Every layout, colour and interaction is designed for your business, with no theme deciding what's possible.
Full control over every detail
Because we write the code ourselves, nothing is off limits. If you want something to look or behave a particular way, it can, without fighting a template or waiting for a plugin to support it.
Room to grow into an app
The same foundations we use for websites power full web apps with accounts, payments and dashboards, so your site can grow into more later without starting again.
Not locked into one host
We've built and launched on more than one hosting platform, and your site is made of standard files that can run almost anywhere. Even the biggest providers have outages from time to time, so being able to move if ever needed matters.
How we compare
A general comparison with the two most common alternatives. Every site is different, but this is how they typically work.
Astrape compared with website builders and typical WordPress sites
Feature
Astrape
Website builders
Typical WordPress
Design
Designed and built for your business
Chosen from a shared template
Usually a theme, adjusted
Server software to keep patched
None on the web server; pages are pre-built
Managed by the builder company
PHP, WordPress, themes and plugins
Plugins and add-ons
None needed
App add-ons, often paid
Often many, from different authors
Loading speed
Pre-built pages from a global network
Varies, often slowed by builder code
Depends on hosting and plugins
Moving to another host
Standard files that run almost anywhere
Usually tied to the builder
Possible, but involved
Who keeps it updated
We do, as part of the monthly plan
You do
You, or a developer you pay
Who you deal with
The person who builds your site
A support desk
Depends who built it
You deal directly with the person building your site
No account managers or support tickets. The person you talk to is the person designing, building and looking after your website, so nothing gets lost in translation and changes get made by someone who knows your site inside out.