This site started life as a page-builder template and has since been rebuilt from scratch as a hand-written WordPress block theme. Here is what it runs on now, and why each decision was made.
The stack
- WordPress as a block theme — no page builder, no visual drag-and-drop layer.
- Nullbyte, a custom theme written by hand:
theme.jsonfor design tokens, block templates for structure, one stylesheet for presentation. - JetBrains Mono and Space Grotesk, self-hosted as woff2 — no third-party font CDN, so no requests leak visitor IPs.
- SureForms for the contact form, so no address is published in the markup.
- A small must-use plugin carrying the security hardening, so it cannot be switched off from the dashboard.
Why I dropped the page builder
The original build used a starter template and a visual builder. It got the site online quickly, which was the right call at the time. But it came with costs I stopped being willing to pay: a lot of generated markup for the amount of content actually on screen, styling scattered across per-element settings instead of a coherent system, and layout that only made sense inside the builder’s own editor.
Writing the theme by hand means the design has one source of truth. Colours and typography live in theme.json as a palette; every section references those tokens by slug rather than repeating hex values. Changing the accent colour is one edit, not forty.
Structure
Everything on the front end is composed of standard WordPress blocks — groups, columns, headings, queries. That matters for a reason that has nothing to do with purity: it means the content stays editable in the normal editor. The terminal component on the homepage is a good example. The transcript itself is an ordinary code block; a small progressive-enhancement script reads it, retypes it, and colourises the output. With JavaScript disabled, or in the editor, you simply see the full transcript as plain text. Nothing is trapped inside a custom widget.
Motion
Animations are additive, never load-bearing. CSS defines every element in its finished, visible state; the script then arms the hidden start state and the scroll transitions. A failed script means a static site, not an invisible one. Everything is wrapped in a prefers-reduced-motion query that disables it outright — the terminal renders its transcript instantly instead of typing.
Security
I audited the site as if it were a client engagement and fixed what I found: REST user enumeration, a harvestable plaintext address, and an unencrypted listener on port 80. Hardening also covers XML-RPC, author-archive probing, version fingerprinting, dashboard file editing, and PHP execution inside uploads. That work has its own write-up.
It felt wrong to publish security write-ups from a site I had never actually tested. Now I have.