How we build a website
Safe, fast and yours to keep: what goes into every site we build, how it compares with a typical website, and where each number comes from.
- 0plugins to patch. The WordPress world had 11,334 new security holes in 2025.
- 7browser safety rules on every page. Most websites skip each one.
- 98–99out of 100 for speed on a phone. The typical website scores under 50.
- 301–313kilobytes (KB) to load our home page, against 2,629.04 KB for the typical one
Yours to keep
Your accounts are in your name, and your content and data are yours once the work is paid for. The code that runs your site is yours to use, change and host for good, and it keeps running if we part ways. The starting code we build every site from stays ours, so you can't sell it or hand it to another company, and a developer you bring in signs a short confidentiality note first. The care plan is how we look after your site once it is live. It runs month to month, and either of us can end it with 30 days' notice.
See what you pay after the buildWho builds it
Tyler Hardiman, our founder, builds every site. He spent four years at NAVEX, an enterprise compliance platform, in test automation (software that checks software before people rely on it). He was promoted to Associate Senior Software Engineer QA.
There he automated the checks that ran right after a release went out, in testing and in production. The check our care plan includes after an update goes live is the same idea.
Apart from that job, he built Chasing Tens, a mobile app he made alone, from the database to the tests. It's a personal project, so no client stands behind it.
More about Tyler and FDMSafe by design
No WordPress and no plugins, the add-on programs WordPress sites install. Patchstack, a WordPress security firm, counted 11,334 new security holes in the WordPress world in 2025, and 91% of them were in plugins. Your site has no plugins that need patching (fixing with an update when a hole is found).
The software under your site still gets updates, and every change we make is checked for known security holes.
Every page also gives the browser (Chrome, Safari and the like) seven safety rules.
| Safety rule | What it does | Websites that have it | Ours |
|---|---|---|---|
| Content type options | Stops the browser guessing what kind of file it was sent | 48.96% | Yes |
| Frame options | Keeps other sites from showing the page inside their own | 36.80% | Yes |
| Secure connection only (HSTS) | Makes the browser always use the secure, encrypted connection (HTTPS) | 35.26% | Yes. Browsers keep the rule for a year. |
| Content security policy | Tells the browser what the page may run | 21.90% | Yes |
| Referrer policy | Limits how much of the page's address the browser passes on when a visitor clicks a link to another site | 17.27% | Yes |
| Permissions policy | Turns off browser features the site does not use, like the microphone and location | 3.72% | Yes |
| Cross-origin opener policy | Stops a tab or pop-up from another site getting hold of the page | 2.01% | Yes |
Our content security policy has a limit. Like 92% of the policies that limit scripts (the small programs a page runs), ours still lets a page run scripts written into the page itself. That is why it isn't the strictest setting.
Security holes in the news
Every day we read the public lists of new security holes. When a serious one turns up in website software, we check the sites we build within a day. We write down the answer and how we know. If one of our sites is affected, we fix it first and post the entry after.
Read the entriesFast on a phone
Lighthouse, Google's free page test, loads a page the way a phone on a slow mobile connection would, and scores it out of 100.
Accessibility means people with a disability, such as poor sight or limited use of their hands, can use the page. The accessibility score counts how many of Google's automated accessibility checks a page passes.
| Measure | Typical website | Ours (this site, unless it says Puff & Stuff) |
|---|---|---|
| Speed score on a phone | Under 50 | 98 to 99; 84 to 90 on Puff & Stuff, our first client's site |
| Accessibility score | 87 | 100 on every page we tested; 98 to 100 on Puff & Stuff's |
| Size of the home page, in kilobytes (KB) | 2,629.04 KB | 301 to 313 KB |
| Files the home page loads | 70 | 23 to 26 |
Pages heavy with photos weigh more. Puff & Stuff's pages weigh about 470 KB to 1.79 MB and load 45 to 79 files.
In our tests, nothing jumps around while Puff & Stuff's pages load. Their layout shift, how far things move as the page fills in, measured 0 to 0.0001; Google counts anything up to 0.1 as good.
The tools we build with don't make a page fast by themselves. Google's Core Web Vitals are three measures of how a page feels to real visitors, and every page passes or fails them on its own merits, whatever it was built with. So we point to pages we measured, not to the tools.
Built to last
- Pages built ahead of time. Cloudflare's network of computers hands them out, so they stay up even when a service behind them is down.
- Few moving parts. Each site depends directly on just six pieces of outside software, so there's little to keep up to date.
- Tested on every change. Every change we make is built in full as a trial run and checked by more than 200 automatic tests. We also scan for leaked keys (the codes that unlock accounts) and secret files.
Easy on your visitors
- Built for keyboards and screen readers. It works with a keyboard alone, every form field is labelled for screen readers (programs that read a page aloud), and animation switches off for visitors whose device is set to reduce motion.
- No advertising or tracking cookies. Visitor counts come from Cloudflare's cookie-free counter.
Your payments and papers
These three are how we handle your money and papers on our side. They are not features of your website.
- Card payments. When you pay us online, your card number goes to Stripe, a payment company, on its own page. It never touches our computers.
- Signed papers. A document you sign with us is sealed when you sign it, and the signed copy can't be changed afterwards.
- Records we keep. Only we can open them, and it takes more than a password. We back them up every night.
What we don't promise
- A site nobody can break into. No website is impossible to break into. We build yours to leave an attacker little to use.
- Rankings, traffic or sales. Google and your customers decide those. We promise the work, not the results.
- A site that never goes down. The nightly checks that come with the care plan spot problems. They can't stop every one from happening.
- The same score every time. Speed scores change each time the test is run, so we give a range, never our best result.
- Every accessibility problem caught. Our automatic check finds many problems, not all of them.
Sources
Every number above comes from one of these.
- HTTP Archive, Technology Report: all websitesSeptember 2026
- HTTP Archive, Page Weight reportSeptember 2026
- Web Almanac 2025, Security chapter (figure 9.27's data)January 15, 2026
- Patchstack, State of WordPress Security in 2026February 25, 2026
- web.dev, Web Vitals: Google's thresholdsread October 3, 2026
- Our own Lighthouse runs on Puff & Stuff's live pages and on this siteOctober 16 and 18, 2026
Want a site built this way?
Every package is. Seven short steps to a priced sheet you can print.