When developing a high-performance website with WordPress, certain requirements will demand that your agency partner goes beyond the “out-the-box” functionality of the platform.
There are two main ways your agency partner may work with you to build out custom functionality:
- Plugins
- Bespoke development.
While plugins are the go-to option for many small and medium-sized businesses, it shouldn’t always be such a quick decision between those two options. If you’re working on an enterprise-grade website, your agency should always give careful consideration when determining the best approach in every scenario.
In this article, we’ll help you understand how to determine the right option between plugins and bespoke development for your own WordPress website.
Why Are WordPress Plugins so Popular?
Since WordPress is an open-source platform with a very active global community of web developers, there are tens of thousands of plugins readily available. For almost any use case you can think of, there’s almost certainly a plugin for it; probably even several.
Plugins serve so many businesses so well because they’re pre-built functionality that quite literally plugs into your platform.
One of the main reasons plugins are so popular, especially for smaller businesses, is because they’re usually free. This provides a great cost benefit over bespoke development, on top of the obvious benefits in the speed of attaining the new functionality as well.
Why You Should be Careful with Plugins
Despite their popularity, there are downsides to plugins too.
Relying on too many plugins, or using low quality plugins, may slow the speed of your site down significantly. A good WordPress development agency will try to keep the use of plugins at a minimum to ensure the speed and performance of your site isn’t compromised.
Poorly built plugins, or ones that aren’t maintained sufficiently, could also cause glitches and errors to occur with the functionality they’re adding to your site.
Security is another concern with certain plugins. If a plugin isn’t maintained and updated regularly, this will create vulnerabilities in your platform that could be exploited by malware or cyber security attacks. These vulnerabilities could also creep in if your plugins are auto-updated and left untested by your agency partner.
Some less experienced agencies often fall into the trap of using too many plugins, while others are simply unaware of the risks associated with plugins from untrusted sources. This has given a bad impression of plugins in some circles. The missing ingredient there, however, isn’t the value of plugins, it’s the agency’s best practices.
When to Use WordPress Plugins
If there’s a feature you need to add to your site that’s already been built perfectly in a trustworthy plugin, it’s worth considering that approach instead of building something from scratch.
However, here at SoBold, we ensure a strict set of best practices are followed, and due diligence conducted, every time we’re considering using a plugin.
We’ll always make thorough checks to ensure any plugin we use is best-in-class, aligned with our high-performance standards, and so should any other agency you work with.
This will include asking questions like:
- Does it have a large number of positive reviews?
- Is it built by an author with a good reputation?
- How active and trusted is the author in the WordPress community?
- When was the last date the plugin was updated?
- Has it been updated regularly enough in the past?
- Does the code quality meet our standards?
- Does the code align with modern WordPress development best practices?
- Is the plugin compatible with the WordPress block editor?
Before implementing a plugin on your platform, your agency should also use it in a local testing environment to ensure it functions as expected.
The majority of plugins are reliable, offering a quicker and easier approach than building something bespoke. However, there are many cases where bespoke development is the more suitable option.
When it’s Better to Use Bespoke Development
When it comes to sophisticated, dynamic websites, plugins may not be capable of delivering the required level of performance, security compliance, or functionality.
In these cases, your agency will turn to bespoke development to deliver what you need. This is often the necessary approach, because high-performance websites do require some complexity behind the scenes. And WordPress is arguably the best platform available today for bespoke web development.
Building out your platform by creating new features completely from scratch, tailored to your exact need, brings with it a wealth of advantages over using plugins.
This is particularly beneficial in terms of flexibility and customisation, giving you something entirely unique to your website. You’ll have complete control and ownership of your bespoke features, which provides greater security and seamless integrations with the rest of your technology systems.
Performance will almost always be superior with bespoke development, delivering a far greater user experience (UX) and improving your customer engagement as a result.
Bespoke development could even be more cost-effective in the long-run too, when compared to plugins that turn out to be problematic or aren’t updated past a certain point.
Rely on Your Agency’s Expertise
Determining whether to use a plugin or build something bespoke will be a decision your agency should guide you to make correctly.
Each website and each business are different, so the right option will be unique to your own requirements and circumstances. Therefore, it’s also worth mentioning that this must be specific to each individual requirement as well, rather than taking a blanket approach.
The decision shouldl be based on the most straightforward way to give you the capability you’re looking for. It will also involve ensuring that your site’s security, performance, and UX are maintained. Another important factor to consider are your circumstances, such as your budget, timeframes, the amount of traffic your website is likely to encounter, and so on.
For example, if your agency knows that one of your top priorities for your website is excellent performance, they’ll make different decisions in that case than they would if you were more concerned with the fastest possible time-to-market.
Some businesses even use plugins in the first phase of their website, then look to rebuild their plugin-based functionality with bespoke development when their business grows, or when they have more time and resources available.
It’s important to trust your agency partner with this decision and rely on their advice. This is why it’s so valuable to work with an experienced agency who understands your needs, so they can help you make the right choices and take the best possible option.
Finding the Right Balance for Your Website
Plugins can be very useful, and it must be said that many WordPress plugins are outstanding in their capability and quality. However, if your specific requirements demand more than a plugin can deliver, bespoke development will be the correct approach.
Regardless, it’s crucial to find the right balance to ensure your site’s performance, speed, and security are maintained.
Ultimately, your agency partner should always consider the specific requirements and circumstances of your project before deciding whether to use plugins or build bespoke functionality for your site. This makes it even more important to work with an experienced agency you can trust to guide you.
Discover more about the scalability and flexibility of the WordPress platform, and its ability to deliver complex requirements for enterprise websites, in our related article here: Just How Scalable is WordPress?
Would you like these insights straight to your mailbox?
- You risk going through a long, expensive discovery and definition exercise that you could’ve done yourself internally for no cost.
- You risk being given a quote that’s too expensive, or a project timeline that’s longer than necessary.
- You risk receiving a service from the agency that doesn’t align with your request or meet your expectations. In turn, you’ll then have to spend even more time and money on a new project to get your original idea developed.
- How will you be backing up the site’s data?
- What level of data encryption do you need?
- How will users’ personal details be stored and protected?
- Will you have two-factor authentication?
- What password recovery process will there be for users?
- A fully-managed service with 24/7 support
- Automated monitoring and alerts
- Back-up and disaster recovery
- 99.99% up-time
- 100% pass-rate for data centre audits.
Industry News
14 January, 2025
Five Things We Learned at Brighton SEO
Back in early October, SoBold made our debut visit to Brighton SEO. Since then, we’ve been busy putting the invaluable lessons from the event’s talented speakers into action, all while navigating Google’s November and December Core Updates. Now the dust has (hopefully) settled on the update-front, and the with next iteration of Brighton SEO still a few months away, we’ve taken the opportunity to reflect on our key takeaways and their impact on our approach.
A functional relationship with your development team is critical for SEO success
During Brighton SEO, a recurring theme across different talks was the challenges SEOs face when working with development teams, particularly those that operate in silos. Whether in-house or outsourced to separate agencies, a lack of communication, deprioritised SEO tickets, and limited understanding of SEO best practices often lead to delays, errors, and missed opportunities. Many speakers and attendees expressed frustration at the need for excessive hand-holding to ensure even basic tasks were actioned correctly.
At SoBold, we avoid these risks with a collaborative effort between our development and SEO teams. As a WordPress-first agency, our integrated approach ensures SEO tickets are prioritised appropriately, and implemented to the highest standard. By removing barriers between teams, we’re more efficient and deliver results that drive SEO success.
Don’t discount the basics
It sounds very simple, but one of the biggest takeaways from Brighton SEO was how critical the fundamentals remain to SEO success. Numerous case studies and real-world examples shared by speakers reinforced that many websites fail to rank well simply because they lack a strong foundation. While advanced techniques and tools may sound exciting, the potential is often wasted on websites that haven’t addressed core issues.
Speakers emphasised that getting the basics right still yields some of the highest returns. Core Web Vitals, metadata optimisation, fixing 4xx and 3xx errors, a clear site hierarchy and URL structure, proper indexation, robots.txt configurations and ensuring basic analytics are in place all play a pivotal role. These essentials are often the difference between stagnation and significant ranking improvements. Ensure your fundamentals are sound before turning to more advanced methods and strategies.
AI can be a game-changer for audits, but nothing beats human written content
AI has been the buzzword of the industry in the past two years. Incorporating AI into everyday tasks to maximise efficiency was a key theme at Brighton SEO, specifically the use of AI to streamline time consuming tasks like audits and data analysis.
Audits are central to developing an SEO strategy and crafting roadmaps, and leveraging different AI and machine learning strategies to research, collate, and organise relevant data was a hot topic at the conference, with lots of very knowledgeable people offering extremely useful and actionable insights into how existing workflows can be enhanced through AI.
By leveraging AI tools and machine learning, SEOs can quickly identify technical errors, gather keyword insights and generate comprehensive reports, freeing up more time for the higher-impact strategic work. Speakers showcased actionable ways to integrate AI into workflows, potentially revolutionising the process of audits, roadmaps, and reporting.
However, there are clear limits to the use of AI. While it excels behind the scenes, it falls short when it comes to creating authentic, engaging content. Google’s guidelines, a number of algorithm updates, and leading voices within the SEO community on social media continue to emphasise that nothing beats human-written content based on real expertise and experience. The message was clear: AI can enhance efficiency, but content that resonates with users, builds trust and meets the intent of the searcher must remain in the hands of skilled human writers.
Google’s AI snippets are traffic thieves
Generative AI has been a hot topic across numerous industries since the launch of ChatGPT 3.5 in November 2022, especially in SEO. Google has released numerous updates (to mixed responses) to combat the large influx of AI generated content and the ability for anyone to churn out masses of content on subjects outside their areas of expertise.
There’s no doubt the rise of AI sent internal shockwaves at Google, who had to quickly innovate to withhold a potential threat to their dominance. As a consequence, they released the Google Generative AI Snippets, which generates AI answers at the top of the search results for a range of queries, based on information it’s gleaned from the top ranking pages for said query.
While the concept may seem beneficial to users, the reality is stark for website owners and their SEOs: visibility is drastically reduced. Data presented at Brighton SEO revealed that URLs in Position 1 under these snippets suffered traffic drops of 70%.
Many SEOs and site owners argue this practice borders on theft, as Google repurposes content with minimal credit or incentive for users to click through, and wouldn’t be able to surface any of this content without the websites creating it in the first place. This controversy isn’t going away anytime soon, and SEOs will need to strategise carefully to adapt to this new reality.
Test, test, and test again
Many of the talks were very insightful, offering new methods and solutions for a range of tasks. But each website is different, and what may have a profound impact on one website may not do the same on another.
There are very little one size fits all in SEO, and our testing of the new methods and techniques detailed at Brighton SEO has shown just that. We can take the direct learnings from these talks and apply them literally with minimal change, but with benchmarking the initial metrics, examining the difference once recommendations are applied, and tweaking these with our own insights, we can maximise the impact.
Whilst the wealth of talent and expertise of the speakers at Brighton SEO was at a very high standard, SEOs shouldn’t rest on the laurels and only go as far as these talks suggest, but leverage their own expertise and knowledge, pairing it with the expertise from these conferences to get the best results. Building upon some of the strategies outlined at Brighton SEO and putting our own SoBold-spin on these is already bearing fruit, and testing is at the heart of this.
Final Thoughts
From the importance of solid fundamentals to embracing AI’s potential while recognising its limitations, these takeaways are invaluable for SEOs and developers alike. By testing, adapting, and collaborating, we can turn these learnings into impactful strategies allowing us to navigate the uncertainty of Google Updates, as we look ahead to the next conference in April.
Would you like these insights straight to your mailbox?
Digital Business
30 November, 2022
How to Create a Brief That Will Ensure Your Web Development Project is Successful
Summary
If you’re looking to build a website for your business, a proven approach is to work with an agency and have them deliver the project for you. This could be a bespoke website design and development agency or solely a website or platform development agency.
Before you approach an agency, however, you’ll first need to reach a clear, detailed understanding of your requirements.
This article will provide an in-depth guide to help you through the briefing process and ensure your chosen agency delivers your project successfully, including a free template you can use to create your own brief. This template can also be used for other types of development projects as well, including anything from an online portal to an internal training platform.
Where to Start
Whether you need to design and develop a new website, or rebuild or migrate an existing site, a natural first step is to take your idea to an agency with a view to launching a web development project.
However, it’s a common mistake to go to an agency too early with just a raw, under-developed concept. Rather than meeting with an agency prematurely, we strongly suggest going through the process of defining your specific requirements and creating a project brief first.
The first thing to do is hold a discussion with the relevant people internally. Talk through the idea, and try to define what it is you need and what you want to achieve with it. Get a clear picture of what that idea or a concept will turn into, but also think carefully about what it should do from the perspective of your end-users.
Once you have a more tangible understanding of what you’re looking to build, you should begin creating a brief.
This is a document outlining the key details and requirements for the project. It’s something you’ll need to take with you to your introductory meetings with the agencies you’re considering, as it will be a very useful tool in helping you explain your idea clearly.
A brief doesn’t have to be complicated. It’s just a simple written document that lists everything you want at this early stage. However, while a brief can be simple, it’s important that it’s as specific as possible too. The more detail you provide for your agency, the more chance you’ll have the project delivered on time, within your budget, and meeting your expectations.
Why Having a Brief is Crucial
There are some potential pitfalls to be aware of that could create challenges for you if you don’t create a thorough brief.
Unfortunately, some agencies will be willing to work with you without a detailed brief, glossing over important details and keeping the expectations and requirements vague. This is a red flag to look out for, as it will likely result in one of several outcomes:
A brief is what gives you and the agency a mutual understanding of the work that needs to be done to successfully deliver the project. Without that specificity, you might end up disappointed. That’s why it’s always wise to put some time and effort in up front before taking your idea to an agency.
Once you submit your brief, you may be invited to participate in a follow-up session to further explore the requirements you’ve listed. This is perfectly normal, and actually a good sign. Experienced agencies will want to talk through each of the elements of your brief with you to help determine the best possible way to deliver those in the project.
How to Create Your Brief
When you begin to discuss and plan the requirements of your project between your team, we recommend thinking carefully about the following points.
Please note: There are a lot of things that could go into a project brief, depending on how complex your requirements are, so we won’t include everything here in this article.
The Project’s Purpose and Goals
Start by thinking about what the purpose of the project is. There’s no use speaking to an agency until you have a clear, specific understanding of exactly what you’re trying to achieve with this project. This should relate to your strategic business objectives, but it should also be designed to meet the needs of your end-users.
Ask yourself how this will allow you to improve your end-users’ experience or solve a problem for them. Answering this might involve working on user personas or developing user stories, or potentially even working directly with some members of your target audience to gather their input.
Project Timelines and Deadlines
Timing is another important point to think about, particularly how much time you have to deliver the project. Deadlines can sometimes relate to certain dates that are out of your control, so it’s better to start as early as possible in those cases. If there’s any flexibility with the timeline for delivery, make a note of that as well.
Project Stakeholders
Make a list of all the stakeholders involved. This is a good thing for the agency to be aware of early on, because the project becomes more complex with a higher number of stakeholders.
Depending on the size of your business, and the nature of your site, your project team will usually be some combination of: A marketing director or marketing manager, someone from your operations department, and someone from IT.
However, if you also have people like someone from your IT team responsible for security, a content writer to provide all the written text, or any external consultants, that should be made clear in advance. If your site will need to integrate with other platforms, such as your CRM system, you may have an integration manager specifically in charge of overseeing that as well.
It’s useful to designate roles to certain stakeholders, such as project sponsors, product owners, administrators, and so on. This will help you understand who’s responsible for different aspects of the project internally.
If you plan to work with external agencies for things like SEO or branding, it’s important to note that in your brief. This is necessary for the development agency to be aware of as early as possible, because collaborating with other third-parties at different stages of the project requires a lot of coordination.
Certain processes may also have to run differently if other third-party agencies want to be more hands-on or handle some parts of the site themselves. The earlier this is made clear, the more smoothly the project will run.
Technology Preferences
If you have any preference of technology platform or any requirements related to your existing tech stack, that will be something you’ll need to decide early on. For example, would you prefer to use WordPress due to its scalability, or do you have any existing investment in any other platforms?
Think about any preference you have for the various technology choices available, why they’re important to you, and whether your agency will have to tailor their approach to accommodate that.
If you need help understanding and evaluating your options for technology platforms, check out our helpful guide here.
Budget
Try to determine a minimum and maximum budget for your project, even if it’s just a loose range for now. It will help you evaluate agencies, and will also help you prioritise the various aspects of the project as “must have” or “nice to have” in many cases.
Design Look and Feel
This is where your company’s brand comes into play. You’ll want your site to reflect your brand and that will come through in the design. Bring any brand guidelines to the table, and think about what sort of tone or experience you want to convey to your end-users.
If you don’t have any recent brand guidelines and want help updating them, or need to go through a rebranding process, mention that in your brief as well. Design and development agencies will often be able to help you in these areas too, or at least refer you to a trusted partner who can.
User Interface (UI)
How your end-users will interact with your site, and what kind of experience they’ll have, is largely determined by the user interface. When it comes to design and UI, simplicity is usually the best approach. However, depending on the function you’re providing, you might have some specific or bespoke UI requirements.
Consider your target audience carefully here as well. For example, if most of your users will be accessing your site from a mobile device, it’s probably wise to opt for a mobile-first design.
Some other important things to think about here include how you’d like your sitemap to be structured, especially if you have an existing site that you’re already happy with.
If your project will involve rebuilding or migrating an existing site or platform, it will be helpful to gather any existing data sources, such as Google Analytics, that will provide insight into your current site.
Non-Functional Requirements
Non-functional requirements are all the aspects of your site that happen behind the scenes. These are things that allow your site to do its job properly for your end-users, but won’t be evident to those people while they’re using it.
There’s a lot of things to consider with non-functional requirements, so we won’t cover everything here.
Hosting
If you have any specific hosting requirements, such as a preference for a certain cloud-based platform, or a particularly secure data centre, those will be important to identify as early as possible.
Say, for instance, that sustainability is a core value for your business, this could also have an influence on how and where your hosting is managed.
If you have an internal IT team that will be contributing towards the hosting decision, make sure you involve them in the discussion.
Security and Compliance
Security is a growing concern for all businesses today. It’s crucial to think about security as a core component of any web development project, to minimise any potential risks for your business.
If you have someone in your team responsible for security, they should begin to think about issues such as:
Robust security also involves keeping compliant with any specific security or industry regulations that may affect your business. Of course, compliance with things like GDPR should be planned for at this stage too.
Some other common non-functional requirements include things like session management capabilities to track and things like log-in time, session length, pages visited, and so on. Search engine optimisation (SEO) tools, analytics, or other capabilities might need to be built into your site as well.
Accessibility, Usability, and Responsive Design
When it comes to aspects that will make your users’ experience as seamless as possible, such as accessibility, a good agency will ensure all these things are taken care of for you. This is also the case for ensuring all major web browsers, operating systems, and devices are fully supported and compatible. Development should always be compliant with industry standards, taking into account optimum accessibility and usability.
However, if you have any additional or bespoke requirements for any of these things, those will be useful to note early on.
Functional Requirements
The term ‘functional requirements’ refers to everything that your site will be able to do for its users, in terms of its features, functionality, and capabilities.
As mentioned earlier, one of the first things you discussed was what the site will help your end-users achieve. From the perspective of building something your target audience can use, you should start to get a feel for what functionality is required to ensure they can achieve that.
Features
Your features are the things your site will allow your users to do. These can be very simple, or very sophisticated, depending on what you’re aiming to provide for them.
When putting your brief together, think of any and all features and functionality that might benefit your users. Your agency will then work with you to explore these and find the best way to turn that into intuitive, user-friendly features for you.
What to Do Next
Once your team has been through the process of talking through all the points listed above, you should have a very thorough, useful brief to work with. The next step is to take that brief to any introductory meetings you have with agencies and ask them what they think of the project initially.
It’s normal for an agency to ask lots of questions at that stage and really dive into the ‘WHY’ behind all the things you’ve put into your brief. A good agency will even challenge you on certain decisions, to help you determine the best possible way to build what you need.
Once you’ve discussed your brief with an agency, determine which one feels like the best fit. Choosing the right agency is crucial, as it will have a huge influence on whether or not your project is successful.
As mentioned earlier, some agencies will agree to launch into a project without a brief, and that can be extremely problematic. While the main purpose of a brief is to help you and your agency understand exactly what you need, it should also be used as a way to spot partners who may not be sufficiently thorough or conscientious.
Whichever agency you choose, a detailed brief will help you ensure you’re given a fair quote, realistic timelines for completion, and a finished product that meets your requirements and expectations.
More Helpful Resources
If you’re considering a bespoke development project, our related article provides useful guidance to help you choose the right technology platform for your specific needs:
Understanding and Evaluating Enterprise Options for Bespoke Web Development
Would you like these insights straight to your mailbox?
Digital Business
9 February, 2023
10 Tips to Improve WordPress Security and Minimise Risks
Cyber security and data protection should be top priorities for your business right now. Of course, this is particularly important for large businesses, and those in strictly regulated industries like financial services, where the outcome of a cyber attack or data breach can be catastrophic.
As these security concerns continue to intensify, you must be increasingly careful and vigilant about the technology solutions you use. You should also take more proactive steps to ensure everything in your tech stack is built and managed in a way that minimises your risks.
When it comes to WordPress, there’s a common misconception that the platform isn’t secure enough for large businesses. This misunderstanding tends to come from the fact that it’s free-to-use, so it was originally more popular among smaller independent businesses and B2C blogs.
Today, however, WordPress is the world’s most popular content management system (CMS), and for good reason. Considering a significant percentage of that user base includes global enterprises, you’d think such popularity would be enough proof that it’s a secure platform.
On the contrary, large businesses still ask us on a regular basis, “Is WordPress secure enough for us?”
Is WordPress Secure?
The answer to that question is, yes, WordPress is a secure, stable platform, even in its “out-of-the-box” state. WordPress’s core code is thoroughly tested and quality-checked by a team of security experts continuously. Not only that, but the same team regularly releases security updates and reinforces any potential weaknesses before they can be capitalised on by cyber criminals.
In fact, the speed at which security updates are implemented in WordPress is arguably the fastest in the world today when compared with other CMSs.
Additionally, WordPress is open-source software, meaning all its code is available to the public. Users are constantly suggesting changes and updates, often to fix bugs in the code and minimise opportunities for cyber criminals. This keeps the platform safe and secure for everyone else.
But while WordPress does have the ongoing support of some of the most talented and devoted developers in the world, it’s not immune to security vulnerabilities. No software is, unfortunately.
That’s why it’s important to be aware of, and work with, some fundamental best practices for security. Listed below are some steps you can take to further strengthen the security of the WordPress CMS.
Best Practices to Strengthen WordPress Security
1 – Secure Hosting
The hosting service you choose for your platform will determine how secure and well protected your data will be.
It goes without saying that WordPress should be hosted in a secure environment, overseen by an experienced provider who prioritises security within their services.
Some things you should consider essential for a hosting provider include:
Before choosing your hosting provider, do plenty of research to ensure they’re able to provide these measures. Most businesses will work with a development agency partner for WordPress, and that agency should be able to help you with this process.
2 – Back-Up and Disaster Recovery
Following on from the previous point, any good hosting provider should also offer back-up and disaster recovery services. These are like safety nets that will allow you to protect, save, and recover all your data in the event of any losses.
3 – Be Careful with Plugins
Plugins are a great way to enhance the WordPress platform with new capabilities and features. But you should only ever use plugins from reputable, credible sources, otherwise you could experience security problems.
It’s also important to keep all your plugins regularly tested, maintained, and updated. Again, this is an area where a WordPress agency partner will help you.
4 – Always Keep Your Platform Updated
When you’ve built a website with WordPress, you’ll often receive software updates from the platform. Any time this happens, it’s because a bug has been fixed or some improvements have been made to the software.
Keeping up with these updates is so important from a security perspective, because they’re designed to keep your site secure. By letting your site run on an outdated version of the platform, you leave yourself at risk of a known issue being exploited by a cyber criminal or some malware.
This is another thing that a good agency partner should take care of for you, so you don’t need to worry about keeping your platform up-to-date.
5 – Never Auto-Update Your Plugins
You have the option to enable auto-updates within your WordPress platform. While this may seem like an easy way to keep your CMS up-to-date, doing so can create technical issues and security risks that simply aren’t worth the convenience.
Each plugin you use will have its own button for you to turn auto-updates on or off. Any good agency will advise you to turn those auto-updates off and instead opt for a more secure approach to your updates, to maintain the resilience of your platform.
6 – Use Security-Specific Plugins
Another way to reinforce the security of WordPress is by implementing security-specific plugins like WordFence, Sucuri, or Defender Pro.
These handy tools will do a lot of the hard work for you, monitoring your platform and spotting potential vulnerabilities so you can fix them before they’re allowed to have any negative impact.
7 – Enable SSL
A secure sockets layer (SSL) is a protocol which encrypts the transfer of data between your website and your users’ browsers. Enabling SSL makes it more difficult for cyber criminals to steal or compromise data online. Don’t worry, though, as this will be taken care of by your hosting provider as a standard practice.
8 – Avoid Tools that Open Direct Access to Your Site Database from the Dashboard
Some tools and plugins will enable direct access to your site’s database from within your CMS dashboard. While this can make certain aspects of website management easier for you, it also creates security vulnerabilities. This is something you should always avoid, because these additions are often severe security risks.
9 – Encourage Your Users to be Mindful of Security
The biggest security risks, and many opportunities for cyber criminals, come from unsafe user behaviour, poor platform maintenance, and badly built sites.
Your behaviour, and the behaviour of your end-users – and your agency – should always be mindful of security. If it’s not, sooner or later you’ll encounter problems. Some security best practices you can introduce include making strong passwords compulsory for all users and implementing measures like two-factor authentication.
10 – Find a Trustworthy Agency Partner to Support You
We understand that following all these steps sounds like a lot of work. Of course, when you’ve got your own job to focus on, the last thing you need is to be spending time struggling through complex website security processes.
That’s why it’s so valuable to find a reliable, trustworthy agency partner when using WordPress to build and manage websites. A good agency will ensure everything is secure and up-to-date for you, so you can spend more time providing outstanding services and experiences to your customers.
It’s always worth taking time to find an experienced agency with a strong track record of building robust, secure sites, to give you the peace of mind you deserve. That means they should handle your secure architecture, testing, monitoring, updates, and ongoing support for you as part of their services.
Being Truly Secure is an Ongoing Process
When you’re selecting a content management system (CMS) to build critical digital assets like your website, security must be a top priority. It’s for that very reason more and more large businesses are looking to WordPress as their platform of choice.
However, it’s equally important to choose an agency you can trust, and one that has these security best practices incorporated into their approach. This doesn’t just stop at the delivery of your website, either. True security is a constant ongoing process, and your agency partner should help you through that.
Following the tips listed here will give you everything you need to build a resilient, secure website on WordPress, suitable for the enterprise.
Interested in learning more about WordPress? Discover how a global enterprise achieved game-changing results by using WordPress to build a secure, innovative, bespoke solution. Check out the story of RedeWire from Rede Partners LLP here.
Would you like these insights straight to your mailbox?
Development
10 July, 2023
Headless CMS Explained: Understanding Whether Headless is the Right Approach for Your Website
Making the best possible choice of content management system (CMS) is crucial for the success of your website. But, these days, not only do you have to navigate the many different options – from WordPress to Sitecore to Webflow – you also have the added challenge of deciding whether to go “headless” or not.
Whether to take the less conventional headless approach with your CMS is a decision that could cause some confusion. It could even cause some challenges with your website if you end up making the wrong choice.
In this article, we’ll help you understand exactly what a headless CMS is, when you may need to take that approach, and highlight some key considerations to make before finalising your choice.
What is a Headless CMS?
With a traditional CMS, the back-end and the front-end of the system are directly linked. This is how you use your CMS for both the content management (back-end) and to control how the content is presented to your website visitors (front-end).
In this context, the back-end of the CMS is sometimes referred to as the “body” and the “head” is the front-end. In a headless CMS, that front-end is decoupled from the back-end of the system, hence the term headless. With this approach, you use the back-end as normal for content management and the presentation of content in the front-end is handled completely separately.
This is valuable because it allows you to design your website front-end however you like, without any restrictions. However, it also requires more technical work from your development agency as a trade-off.
With a headless CMS, your content is presented to your audience on your live website by using APIs that take it from the back-end of the CMS. This use of APIs also allows you to publish the same content in a variety of different formats via different channels as well, but more on that later.
Scenarios in Which You Might Need a Headless CMS
It’s important to understand that you should only take a headless approach if it’s the most suitable way to meet a specific set of requirements or objectives.
Some scenarios in which you might need to take a closer look at adopting a headless CMS include:
If a large volume of content is a key component of your marketing strategy.
If you’re going to be producing and publishing a lot of content on your website, you may benefit from a headless CMS. Many people find it easier and more intuitive managing websites in the back-end of a headless CMS.
The decoupling of the front-end also means that your development agency will be the ones responsible for ensuring your audience is presented with dynamic, engaging content.
If you expect to have high volumes of traffic and need to maintain performance.
If the size of your website’s audience will put a heavy demand on your CMS’s performance, a headless system could be a worthwhile investment. Using APIs, and leveraging other intelligent techniques, the headless approach often delivers faster loading times, reduces the workload on your servers, and offers greater scalability.
If you have a multi-channel marketing strategy, or need to publish content across multiple digital touch-points.
The headless approach allows you to take one piece of content, upload it into the back-end, and seamlessly publish it across several channels, including website, mobile app, social media, email, and even internet-of-things (IoT) devices.
This can help you maximise consistency, while providing your users in each channel an experience optimised for their preferred context.
If you’re prioritising personalisation.
As personalisation is becoming much more important in modern marketing, headless CMSs are becoming more popular in enabling those tactics.
If you need to create personalised experiences for your website visitors based on their demographic data, past behaviour, preferences, and so on, a headless CMS may be the right option. This is a useful approach for delivering tailored content to individual visitors, improving your engagement and increasing conversions.
If you have a multi-lingual or multi-regional website.
Delivering the same content to visitors in different languages, across different locations, can also be made easier by using a headless CMS. Your localisation process can be streamlined by managing the content for all users just once in the back-end, then delivering it seamlessly in its different forms based on location or other conditions.
Key Considerations and Potential Pitfalls
While a headless CMS can be a great choice to deliver on the requirements discussed here, it’s still not a straightforward decision in these scenarios.
Firstly, it’s important to note that a traditional CMS like WordPress can still help you achieve all the things listed above, especially with the support of an experienced, talented agency. Secondly, there are some downsides to the headless approach that need to be considered while you’re evaluating your options.
Security
Security is an issue that needs careful consideration when looking into the headless approach. The headless architecture, and use of APIs, create more security vulnerabilities than you’d have with a traditional CMS.
It’s also common for a headless CMS to require more hands-on management in key areas such as hosting and compliance, as well as more thorough and frequent testing.
Development Complexity
When you ask your development agency to build, manage, and maintain your website using a headless CMS, you’re asking them for more complex work than they’d be facing with a traditional system. This complexity is something you need to be aware of, both in your selection of an agency capable of delivering your requirements, and in the additional workload you’re asking them to complete for you.
Time-to-Market
Following on from the previous point, more complex development work often results in a longer time-to-market for your website.
Developing a website using a headless CMS may require more time and resources from your agency to deliver the work for you. If you need to get your site up and running quickly, or if you may require future development work to be delivered quickly, a regular CMS may be a safer bet.
Technical Skills
Publishing content with a headless CMS may be easy, but if something goes wrong, or you need something changed, you’re unlikely to be able to do it yourself. A headless CMS requires more technical skills and development experience to maintain than a traditional CMS, even for small tasks. If you don’t have these skills in your team, you’ll be more reliant on your agency partner than you would be with a normal CMS.
Total Cost of Ownership
All the points listed here will add up to a higher total cost of ownership (TCO). When accounting for the higher volume and greater complexity of work you’ll require from your agency, you’re likely to spend a lot more of your budget on a headless CMS.
Unless you have specific complex requirements that demand the use of a headless CMS, it’s usually the more cost-efficient option to go with the more traditional approach.
Content Strategy
With all that said, it’s also important to consider whether a headless CMS is even necessary based on your content strategy.
Unless you have an intricate, wide-ranging content strategy that spans various channels and platforms, it might not be worth adopting a headless CMS at all.
Most of the requirements you have can likely be delivered by working with a reliable agency partner using a sophisticated, flexible CMS like WordPress.
It’s also important to note that WordPress can be used in a headless context as well. This offers you a balance between a familiar, easy-to-use system and a more dynamic UX for your visitors in the front-end.
The Benefits of a Headless CMS
If you do decide to take a headless approach, your CMS can deliver a wealth of benefits and strategic advantages. These include:
Scalability
The headless architecture will enable you to build out your digital presence rapidly, on a large scale, across multiple channels. This scalability will be crucial for your website as your business grows and your requirements evolve.
Customisation
Both the back-end of your headless CMS and the front-end presentation of your content are entirely customisable, tailored to your specific requirements.
Flexibility
Headless CMSs provide a great deal of flexibility in terms of your selection of technology, content creation, and implementation of a multi-channel market strategy.
Ease-of-Use
If you work with a skilled agency partner who can set up and manage your system for you, publishing and editing content with a headless CMS becomes quick, easy, and efficient.
User Experience
Delivering your content seamlessly – and consistently – across a wide range of channels and digital touch-points creates a far greater UX for your target audience.
Performance
The headless architecture removes the need to render pages on your server. This creates the faster loading times and improved performance discussed previously, which also contributes to a better experience for your visitors.
Competitive Differentiation
As mentioned earlier, the headless approach allows you to create a truly unique UX. In an increasingly crowded, noisy online landscape, this can help you differentiate your website and stand above your competitors.
Future-Proofing
A headless CMS allows you to easily change or upgrade the technology you use for your front-end without having any impact on your back-end. This will help you become more agile and adapt quickly as new technology trends emerge in future.
Making the Right Decision for Your Unique Requirements
Ultimately, you should base your decision here on the specific requirements you have for your website and the circumstances you find yourself in.
While a headless CMS does offer a range of innovative capabilities, the additional costs and resources you’ll need to invest may not be worthwhile. For example, the traditional use of WordPress can provide you with most of the benefits discussed earlier.
Carefully consider your objectives, your strategy, and the resources you have available. Use those to weigh up all the pros and cons listed in this article in relation to your own website project.
The key thing is to clearly understand exactly what you need from your CMS, and use that to select the option that aligns best with your requirements.
Would you like these insights straight to your mailbox?
Industry News
21 June, 2022
Pixel Pioneers Bristol 2022
If you’ve never been to a conference of any type before, you possibly think you already know the important areas of your profession and can find out any developments from your colleagues or the internet. At least that’s what I thought prior to attending Pixel Pioneers 2022.
Which option sounds more appealing to you? Pick up extra skills on occasion, or go to a conference and absorb a mega-dose of industry knowledge, make connections and enjoy exploring fresh surroundings? Luckily at SoBold we have the opportunity to do both.

The conference covered both ends of the telescope – from broad topics such as energy consumption, to a fifty minute talk about the brief three milliseconds your screen goes blank in between webpage loads. How the visually impaired experience the internet, to technical developments in styling / fonts.
My personal hero was Chris How – his mantra of valuing your customer’s time and giving them small moments of delight strongly resonated with me. In accordance, I want to guide you through the content of the conference, with links to the core material that will best replicate what the SoBold team saw, whilst valuing your precious time.
GAVIN STRANGE : Less Thinkering, More Tinkering
A must watch to boost your levels of creativity. Gavin shares his personal and professional projects with Aardman Studios. Lots of useful insights into reaching the pinnacle of creativity. Highly engaging delivery, visuals and plenty of ‘further reading’ material. Definitely worth watching in entirety. Gavin Strange website – will give you a sense of his creative flair and influences. https://www.jam-factory.com/
“It’s better to beg for forgiveness, than ask for permission.”
Gavin Strange

BIANCA BERNING : Variable Fonts – WTF?
From a technical and design standpoint, learning about variable fonts is incredibly useful. Towards the end Bianca veers into the potential application of variable fonts – imagine a world where your computer mutates its content to fit the viewer’s specific needs. If you’re looking for new avenues for unique artistic features for your website – this talk is for you. Everyone should have a play with variable fonts – try it here https://v-fonts.com/

CHRIS HOW : You Got to Fight for the Right to Delight
Chris’s choice of examples and commentary is intentionally entertaining and eclectic. His approach to design changes your criteria for success and also would decisively influence your next project. Essential viewing. Whether you’re a seasoned designer or developer short of a design, this talk will give you a guiding direction. Information on the Kano product roadmap here. https://www.productplan.com/glossary/kano-model/

LÉONIE WATSON : Accessibility: The Land That Time to Interactive Forgot
Visually impaired people experience the internet through screen readers – the internet described in words. Léonie’s valuable insight will definitely re-balance your priorities and appreciation for how websites should function. Some of the technical history she overviews was a bit lost on the audience but the switch in mindset is valuable. Important to dip into, especially for gleaming a deeper understanding of how a web document is compiled and loaded. It might sound ‘techy’ but it’s like understanding how our lungs work – illuminating. If you haven’t viewed any of your own websites using a screen reader – you definitely should. For a great sense of how the net is best experienced for visually impaired users – just check out her website – tink.uk
LUKE MURPHY : Lightning Talk: Design Tokens – Searching for a Source of Truth
Design Tokens act as a very useful tool for blending the boundaries of where design and development meet, in fact, they act as a technical element that affect design and development in equal measures. If you have no idea what a design token is – this talk could unlock a tonne of structure for your product. Here’s an overview article on design tokens

HANNAH SMITH : How to Make Digital Services More Sustainable
Hannah Smith’s talk invited us to critique our energy consumption and make changes to our habits as both consumers and producers of digital content. She makes the case that space travel is a waste of resources, and that using less lays the path to fulfilment. See if her arguments resonate with you. Hannah’s book recommendation – Doughnut Economics by Kate Raworth
JHEY TOMPKINS : Supercharge Your Skills with Creative Coding
A mad professor of CSS and JavaScript – Jhey has a mixture of technical tricks and interesting libraries for speech recognition. Deadpan yet full of colourful examples, Jhey clumsily demonstrates his collection of magical creations and challenges you, the developer, to break out of your ‘siloed’ mentality for visual presentation. Check out his catalogue of wondrous CSS/JS creations here

STUART LANGRIDGE : You Really Don’t Need All That JavaScript, I Promise
Painting with the broad brushes down to the nat-hair infinitesimally small details, Stuart reminds us of the importance of returning to the basics in order to best utilise the web. Unfortunately some of the libraries he suggests do not have extensive compatibility and thus aren’t for mainstream production… yet. His insight does provide a deeper understanding of the mechanics of the tools we use, although the message is quite drawn out. Example of the shared transitions js library https://codepen.io/drenther/pen/NjzeOO
RACHEL ANDREW : What’s New in CSS?
Rachel Andrew – new css features either in or emerging from or newly arrived from CSS-land. Truly at the coalface of emerging CSS features. For a frontend developer it was akin to being shown new letters in the alphabet that were being proposed. A summary of similar information can be found here – https://www.smashingmagazine.com/2022/03/new-css-features-2022/

Bristol itself is well worth a visit – a centre for nightlife, hedonism and youthful idealism. Simply walking around the harbour area in the daytime will refresh your appreciation for one-of-a-kind shops and overflowing street art. Make sure you have plenty of free space in your phone for all the photos. The SoBold team had a very enriching experience and bonded even tighter as a team. I hope to see you at the next one!
Links to the conference videos will be available via the Pixel Pioneers website.