Why I have rebuilt this site from scratch
The cobbler’s children go barefoot. I put this site together in 2017 and had not touched it since. It worked, it looked reasonably good, and every time I remembered it existed I thought «one day». That day has come, and I ended up tearing the whole thing down and rebuilding it from scratch.
This article tells the story without the jargon: where I started from, what I found when I opened the bonnet, and where it has all ended up.
Where we started from
The site was built with WordPress, the software behind a good chunk of the internet. Nothing wrong with that. The problem was the version: 4.8, from 2017, running on a version of PHP that stopped receiving security updates in December 2018.
In plain terms: for almost eight years there had been a door open to the public with a lock that nobody manufactured or repaired any more. It was not that something was bound to happen; it was that if it did, there was no one to call.
And there were warning signs. When I started looking through the server logs I discovered that in a single day the site had received 2,578 automated attempts to guess the password, all against the same entry point. That was almost half of all the traffic the site received that day. Nobody was targeting me in particular: these are bots that roam the entire internet rattling doorknobs.
The detail that gave me most pause was another one, and a sillier one. While reviewing the server I realised that the site had been down for five days and I had not noticed. Neither had anyone else. That says a fair bit about the care I was giving it.
What I have done
I have replaced the entire kitchen, not the tiles.
The important difference is not that one column is more modern than the other. It is the number of things that have to go right for you to see this page.
Before, between your browser and my text there was an enormous program, written by a great many people, with dozens of plugins, a separate database and an unmaintained language. Now there is a small program that does exactly what I need and nothing more, and the data fits into a single 140-kilobyte file — less than a photo from your phone.
That is the underlying idea: a personal website does not need a power station. It needs a bulb that will not blow.
How it was done, step by step
It is not done in one sitting, and above all you do not switch off the old thing until the new one has been tested.
Securing the old site. Before touching anything, a full backup of everything: files, database, images. And, while I was at it, closing the most urgent holes in the old site, since it was going to stay up for a few more weeks.
That is where the uncomfortable things turned up: test files forgotten back in 2015, an access key for a Google service and a password written in plain text, all of it reachable from the internet by anyone who knew where to look. Removed, and noted down so those credentials could be changed.
Rescuing the content. The articles, the projects, the opinions, the photos: all of that lived inside WordPress and had to come out without losing a single accent. It was done with a program that extracts it automatically. I did not copy anything by hand, which is where mistakes creep in and patience runs out.
The foundations. Deciding how each thing is stored: a professional role, a project, a technology. It sounds dull and it is the part you notice most afterwards. An example: on the old site the names of the same two consultancies appeared five times in a row, because the system did not distinguish between who you work for and which client you are delivering the service to. Now they are two separate things, and the career history reads at a glance.
The site people see. A new design, built to be read: no pop-ups, no cookie banners — because there are no cookies to warn about — no fonts or trackers downloaded from other companies. Everything this page loads comes from this server. And my email address no longer appears written anywhere: there is a form, which is precisely what address harvesters cannot fill in.
The panel for editing it. A private area for changing the content without touching anything technical. It only responds from my home network, and even then it asks for a password.
What difference it makes
This can be measured, so I measured it: both sites, on the same server, side by side.
Fourteen times faster. And of the 14 files the home page now requests, 11 are the project images: as for «machinery», all that is left is one stylesheet and a 50 KB helper.
The photos have been put on a diet too. Each image is stored in three sizes and the browser picks whichever suits the screen, so on a phone you are not downloading an image intended for a large monitor. They weigh 76 % less than the originals.
Underneath there is something you cannot see but which is what lets me sleep: 245 automated checks that run every time something changes. They are small tests that verify that email goes out, that the old addresses still lead where they should, that the colours have enough contrast to be readable. If something breaks, it is caught before it reaches here. They have already caught several bugs I would never have spotted.
How it gets updated now
The important part of this diagram is the arrow at the bottom. All the content can be exported to an ordinary text file, which opens in any editor, reads without any special software and can be stored wherever you like. And from that file the entire site can be rebuilt on another machine.
That is the lesson of the previous site: anything that only one particular program can read is trapped inside that program. And programs expire.
What is left
The last two phases are still to come, which are the move itself: running both sites at once for a while, checking that the new one holds up, and only then changing the sign on the door. After that, switching WordPress off.
The old addresses will carry on working. Each one redirects to its equivalent on the new site, so if you have a link saved or you arrive from a search engine, you will not hit an error.
If you have read this far and you are thinking about your own neglected website: the most expensive part was not writing any code. It was opening the server logs and looking. Everything is written down in there — who comes in, what they try, what has been broken and since when — and we almost never look.