Security updates: constant, in the background

WordPress core, themes and plugins release security patches regularly – sometimes weekly. These should be applied promptly, ideally by someone actively monitoring for conflicts, rather than left to pile up. A site running years-old, unpatched software is one of the most common ways small businesses get hacked.

Content: little and often

Opening hours, prices, staff photos, testimonials and service details should be reviewed every few months at minimum. Stale content is one of the quiet signals – to both visitors and Google – that a business might not be as active as it claims.

Blog and SEO content: monthly, ideally

Fresh, genuinely useful content published regularly gives search engines new reasons to crawl and rank your site, and gives potential customers a reason to visit before they’re even ready to buy. Two to four articles a month is a realistic, sustainable pace for most small businesses.

Design and structure: every 2-4 years

Full redesigns don’t need to happen often, but web design conventions, mobile usage patterns and your own business offering all shift over time. A site that felt current in 2022 can start to feel dated by 2026, even if nothing is technically broken.

What “leaving it too long” actually costs

Unpatched software becomes a security risk. Stale content erodes trust and rankings. An ageing design quietly signals “this business may not be thriving” to new visitors, even when the business itself is doing fine. None of these show up as a single dramatic failure – they accumulate slowly, which is exactly why they’re easy to ignore.

A simple rule of thumb

Security: continuous. Content: monthly-ish. Design: every few years. If any of those three feel like they haven’t happened “in ages,” that’s worth addressing before it becomes urgent rather than after.

Chris X Creative’s ongoing support plans are built around exactly this rhythm – regular updates, content help and monitoring, so your site keeps working for you quietly in the background rather than becoming a periodic crisis.

1. It doesn’t work properly on mobile

The majority of web traffic for most small businesses now comes from phones. If text is too small, buttons are hard to tap, or the layout breaks on a mobile screen, you’re losing visitors before they even reach your message.

2. It’s slow

If your homepage takes several seconds to load, a meaningful number of visitors will simply leave before it finishes – and Google’s rankings factor this in too.

3. You’re embarrassed to send people to it

This one’s simple but telling. If your instinct is to explain away your own website before sending someone a link (“it’s a bit old, don’t judge it”), that’s a strong enough signal on its own.

4. It doesn’t reflect what your business actually does now

Businesses evolve – new services, a different target customer, a repositioned brand – but websites often don’t keep up. A site describing a version of your business from three years ago actively works against you.

5. You can’t update it yourself

If every small change requires calling a developer and waiting days, your website can’t keep pace with your business. A modern rebuild should leave you able to make routine edits confidently.

6. It’s not bringing in enquiries

A website’s job is to generate leads, not just exist. If it gets some traffic but converts almost none of it into calls, forms or bookings, the design, messaging or structure likely need rethinking.

7. It looks noticeably dated next to competitors

Design trends shift – fonts, layouts, photography styles, the amount of white space that feels “current.” A site that looked sharp five years ago can look tired today purely by comparison, even if nothing about it is objectively broken.

What to do about it

A redesign doesn’t have to mean starting from zero – often the existing content, structure and SEO history can be carried forward into a fresh, faster, better-converting site. If two or more of the signs above sound familiar, it’s worth at least having the conversation.

Chris X Creative offers honest redesign assessments – we’ll tell you if a refresh will do, or if a full rebuild is genuinely the better investment, rather than defaulting to the bigger, more expensive answer.

What accessibility actually covers

It’s broader than most people expect: text with enough contrast to read in bright sunlight, images with alt text for screen readers (and for when images fail to load), a site that works with keyboard navigation alone, videos with captions, forms with clear labels, and text that resizes properly rather than breaking.

It’s good design, not a compromise on it

Clear contrast, sensible font sizes and logical navigation aren’t accessibility concessions that make a site look worse – they’re simply good design principles. Many of the improvements that help visually impaired visitors also help someone glancing at their phone in bright sun, or reading on an old screen, or simply in a hurry.

There’s a legal dimension too

UK public sector websites have specific statutory accessibility requirements. Private businesses aren’t held to the identical standard, but the Equality Act 2010 does require reasonable adjustments for disabled customers, and website accessibility increasingly falls under that umbrella in practice.

It affects your reach, directly

An inaccessible site simply turns away visitors who can’t use it comfortably – and word travels. A site that works well for everyone extends your realistic customer base rather than narrowing it.

Where to start, practically

• Check text and background colour contrast, particularly on buttons and links
• Make sure every meaningful image has descriptive alt text
• Test that your site can be navigated using only a keyboard (no mouse)
• Use clear, descriptive link text rather than “click here”
• Keep forms simple, with clear labels and helpful error messages

An accessibility statement helps too

A simple, honest accessibility statement – what you’ve done, what you’re still working on – shows good faith and gives visitors a way to flag issues directly to you.

CXC Toolkit includes an accessibility toolbar and statement generator as standard on every managed site, covering the essentials without needing a specialist audit for most small businesses. If you’d like your current site checked, get in touch.

The most common threats

Brute-force login attempts, where bots try thousands of password combinations against your admin login. Outdated plugins with known, publicly documented vulnerabilities. Malicious file uploads through poorly secured forms. Spam and malware injected into an unmonitored site, sometimes invisibly, to serve someone else’s adverts or scams through your domain’s good reputation.

Why “it hasn’t happened yet” isn’t reassuring

Many hacked sites don’t show obvious symptoms straight away. Malicious code can sit quietly, redirecting a small percentage of visitors or slowly damaging your search rankings, for weeks before anyone notices. “Nothing’s happened” often really means “nothing’s been noticed yet.”

Practical protections that actually work

• A firewall that blocks known malicious traffic patterns before they reach your site
• Keeping WordPress core, themes and plugins updated promptly
• Strong, unique admin passwords, ideally with two-factor authentication
• Limiting login attempts to stop brute-force attacks
• Regular malware scanning, not just a one-off check at launch
• Tested, working backups, so a worst-case scenario is a restore, not a rebuild

The PIN gate approach

An extra layer worth having on any site with multiple people accessing it: requiring a shared PIN before certain sensitive admin areas can be accessed at all, on top of the normal login. It’s a simple extra barrier that meaningfully raises the effort required to cause damage.

Security is a habit, not a one-off purchase

A security plugin installed once, then ignored, drifts out of date just like everything else on a website. Ongoing monitoring – someone actually watching for issues – is what turns security tools from theoretical protection into real protection.

Every site under Chris X Creative’s Security service includes firewall protection, malware scanning, login hardening and ongoing monitoring as standard. If you’d like your current site’s security checked over, we’re happy to take a look.

1. Compress your images

Oversized photos are, by far, the most common cause of a slow site. A photo straight off a modern phone camera can be many megabytes – compressing it can cut that by 70-90% with no visible loss in quality.

2. Choose hosting built for WordPress

Generic, ultra-cheap hosting is often the actual bottleneck, no matter how well the site itself is built. Hosting configured specifically for WordPress makes a noticeable difference.

3. Use a caching solution

Caching stores a ready-made copy of your pages so the server doesn’t have to rebuild them from scratch for every single visitor. It’s one of the highest-impact, lowest-effort speed fixes available.

4. Keep plugins to what you actually use

Every plugin adds some amount of extra loading. Old, unused or overlapping plugins (three different contact form plugins, for instance) add up. A periodic clear-out helps.

5. Lazy-load images and embeds

Lazy-loading means images and videos further down the page don’t load until a visitor actually scrolls to them, rather than all loading at once – reducing the initial load significantly.

6. Clean up your homepage

Sliders, auto-playing videos and dozens of widgets all feel impressive in a demo and slow in real life. A focused homepage with a clear message almost always outperforms a busy one, in both speed and conversions.

7. Minify CSS and JavaScript

This strips unnecessary characters from your site’s code files, shrinking them without changing how anything looks or works.

8. Use a Content Delivery Network (CDN)

A CDN serves your site’s files from servers geographically closer to each visitor, which particularly helps if your customers aren’t all in the same part of the country.

9. Remove unnecessary head clutter

Emoji scripts, unused embed styles and redundant meta tags all add small amounts of overhead that quietly stack up across a whole site.

10. Test regularly, not just once

Speed isn’t a “fix it and forget it” job – new plugins, updates and added content can all reintroduce slowness over time. Checking your PageSpeed score every few months keeps small issues from becoming big ones.

Every CXC Toolkit-managed site includes performance features covering most of this list as standard, with monthly reports showing exactly how your speed score is trending. If your site feels sluggish, it’s worth finding out why before it costs you visitors.

What can actually go wrong

It’s rarely dramatic. A plugin update conflicts with something else and breaks the site. A hosting server has a hardware failure. An account gets compromised and files are altered or deleted. A well-meaning team member accidentally deletes the wrong page. None of these are rare edge cases – they’re the ordinary background risk of running any website.

Why “my hosting company backs it up” isn’t always true

Some budget hosting providers do include backups; plenty don’t, or only keep a single snapshot from the last 24 hours, overwritten daily – which is no help if a problem isn’t noticed for a week. It’s worth confirming, specifically, rather than assuming.

What a proper backup setup looks like

• Automated backups running on a regular schedule (daily, ideally)
• Copies stored somewhere separate from the live server, not just alongside it
• Multiple recent backups kept, not just the latest one
• Backups that have actually been tested, not just created

The “tested” part matters most

A backup that’s never been restored is a guess, not a guarantee. Plenty of businesses discover their backup was silently failing only when they actually need it – which is the worst possible moment to find out.

What to do this week

Ask your current host or developer, in plain terms: how often do backups run, where are they stored, and how quickly could my site be restored if something went wrong today? If the answer is vague, that’s worth treating as an urgent flag rather than a minor detail.

Every site on Chris X Creative’s hosting has automated backups as a standard part of the package, along with monitoring that flags problems early rather than after the fact. If you’d like us to check what your current setup actually covers, we’re happy to take a look.

1. What happens after the site goes live?

Some designers hand you a finished site and disappear. Others include hosting, updates and support as part of an ongoing relationship. Neither is automatically wrong, but you need to know which one you’re getting into, because a website left unmaintained becomes a liability within a year or two.

2. Who actually owns the site once it’s built?

Ask plainly whether you’ll own the domain name, the hosting account and the website files, or whether they sit under the designer’s own accounts. You should always have (or be able to get) full ownership.

3. What platform will it be built on?

WordPress, Wix, Squarespace, or something fully custom – each has very different implications for cost, flexibility and who can work on it in future. There’s no single right answer, but you should understand the trade-off you’re choosing.

4. How is SEO handled?

A nice-looking site that nobody can find is a wasted investment. Ask specifically what’s included for search visibility – page structure, meta descriptions, page speed, mobile-friendliness – rather than accepting a vague “yes, it’s SEO friendly.”

5. Can I see examples of real client sites, not just the portfolio piece?

Portfolio showcases are, understandably, the best-case examples. Ask to see (or visit) a couple of ordinary, live client sites to get a feel for the real, everyday standard of work.

6. How will I make small edits myself?

You should be able to update your own opening hours, add a photo, or tweak some text without needing to contact anyone. Ask for a quick demonstration of the admin area before you commit.

7. What does ongoing support actually cost?

Get a clear, specific monthly or annual figure for hosting, security, backups and support – not a vague “we’ll sort something out later.” Surprise costs are the most common source of frustration after launch.

8. What happens if we ever want to part ways?

A trustworthy designer will have a clear, low-drama answer about how you’d take your site elsewhere if you needed to. If the answer is evasive, treat that as useful information in itself.

These aren’t awkward questions – a good web designer will be glad you asked them. If you’d like a genuinely honest conversation about your options (including whether you actually need a full rebuild at all), get in touch with Chris X Creative.

What cookies are, briefly

Cookies are small files a website stores in a visitor’s browser – used for things like remembering login details, tracking visits for analytics, or powering advertising. Some are essential for the site to function; many others exist purely to gather data about the visitor.

What the law actually requires

Under UK data protection rules (built on the Privacy and Electronic Communications Regulations, alongside UK GDPR), non-essential cookies – most analytics and advertising cookies – require the visitor’s clear, informed consent before they’re set, not just a notice telling them cookies exist. Consent has to be a genuine choice, which means “accept” and “reject” need to be equally easy to select.

Where most banners go wrong

• A prominent “Accept All” button next to a hidden or fiddly way to decline
• Cookies being set before the visitor has made any choice at all
• No easy way to change your mind later
• No actual record kept of what was consented to and when

What a properly compliant setup looks like

Non-essential cookies (analytics, marketing, embedded video trackers) blocked by default until consent is given. A banner that offers “Accept,” “Reject” and ideally “Manage preferences” with equal visual weight. A record of consent kept, so you can demonstrate compliance if ever asked. A simple way for visitors to revisit and change their choice later.

This isn’t just a legal box to tick

Getting this right also builds trust – visitors increasingly notice when a site handles their data thoughtfully, and a clumsy, manipulative cookie banner is a small but real dent in first impressions.

What to check on your own site today

Open your site in a private browser window. Does anything load before you’ve made a cookie choice? Is declining actually as easy as accepting? If either answer is uncomfortable, it’s worth sorting sooner rather than later.

Every site under Chris X Creative’s Compliance service includes a properly configured cookie consent system with a consent log kept automatically, so you’re covered without having to think about it. Get in touch if you’d like your current setup reviewed.

What SSL actually does

An SSL certificate encrypts the connection between a visitor’s browser and your website, so any information passed between the two – a contact form submission, a password, payment details – can’t be intercepted or read by anyone in between. It’s the difference between “http” and “https” in your web address.

The trust signal is immediate

Every major browser now visibly flags non-HTTPS sites as “Not Secure” right in the address bar. Most visitors won’t know the technical detail, but they will notice the warning – and plenty will leave rather than risk it, especially on a contact or checkout page.

It affects your Google rankings

Google has confirmed HTTPS as a ranking signal. It’s not the single biggest factor in your search position, but on a level playing field, a secure site has a real edge over an insecure competitor.

It’s required for anything involving payment or personal data

If you take payments, bookings, or collect any personal information through a form, SSL isn’t optional – it’s a basic expectation, and in many cases a legal one under UK data protection requirements.

The good news: it’s usually simple and often free

Modern hosting typically includes a free SSL certificate as standard, with automatic renewal so it never quietly expires and breaks your site. The days of SSL being an expensive add-on are largely over – the real risk now is a site where it was never set up properly in the first place, or one where an expired certificate has gone unnoticed.

How to check your own site

Look at your website address in the browser bar. If it starts with “https://” and shows a small padlock, you’re covered. If it says “http://” without the “s,” or shows a warning, that needs sorting – ideally today rather than “at some point.”

Every site Chris X Creative hosts includes SSL as standard, monitored so it’s renewed automatically and never silently lapses. If you’re not sure about your current site, it takes two minutes to check – just ask.

Bewdley Carnival turned 100 this year. It’s the event I grew up watching — the same streets, the same river, generations of the same families turning up every June. For the centenary, I wanted to build something that would help it run for the next hundred years a little better than it ran for the last. So on evenings and weekends, alongside my actual work, I built the carnival a proper raffle system — one that could take money safely online or in person, never let someone win a prize after the draw had closed, and quietly refund them if it somehow did, without a volunteer having to notice and untangle it by hand.

It worked. By the end, the raffle alone had raised £4,000, with proceeds going towards four local causes: Bewdley Concert Band, Hugs, Summerdyne Nursing Home, and The William Mills Foundation — each of them set to be genuinely better off because of it.

Here’s the thing, though. Nobody paid me to build that system. And I think that’s exactly why it turned out the way it did.

When ChrisXCreative isn’t what pays my mortgage, I only take on work — client or otherwise — that I actually want to do. There’s no pressure to say yes to something I don’t believe in, and no client waiting on an invoice pushing me to cut a corner just to ship it faster. I built the raffle system properly — refund logic tested twice over, prize tracking that wouldn’t quietly lose a winner in a spreadsheet — not because someone was watching a deadline, but because I cared whether it was right. That’s a luxury full-time freelancing rarely affords you. When your income depends on the next project, “good enough” starts creeping in whether you want it to or not.

Keeping this a sideline also means I get to pick depth over volume. I could have taken on ten small client sites in the time I spent on that raffle system. Instead, I spent months in one place — learning things about payment webhooks, database quirks, and what actually breaks under pressure that no quick client job would ever have taught me. That depth is worth more to me than the extra invoices would have been.

And there’s something else, harder to put a number on. The carnival didn’t need me to be a professional running a business. It needed someone from the town who understood what mattered and was willing to build it properly, for free, because it was worth doing right. That’s not a role a full-time agency owner has time for. It’s a role a sideline does.

None of the four causes set to benefit from that £4,000 know how the raffle worked behind the scenes. They don’t need to. They just know the support is coming, and it’ll help. That gap — between the quiet, unglamorous work of getting something right, and the very real difference it makes once it’s out in the world — is what I keep coming back for. And I don’t think I’d have built it the way I did, or wanted to as much as I did, if it had been my job rather than my choice.

A hundred years ago, someone in this town decided Bewdley needed a carnival. This year, because I keep my business small enough to still choose my work rather than chase it, I got to help make sure it’s still standing in another hundred.

Chris runs ChrisXCreative, a web design and hosting business based in Kidderminster, alongside his day job — and is the volunteer digital lead behind Bewdley Carnival’s plugin suite and payment systems.