Why Lux
Most sites die of their own plumbing.
Not traffic, not design taste. A page builder stops being supported, a plugin gets abandoned, nobody patches the server, and one day the site is either broken or breached. We build to avoid that specific ending.
No page builder. Ever.
Page builders write your content as proprietary shortcodes. Turn the plugin off and the page becomes a wall of square brackets. We have inherited sites where years of work was effectively hostage to a commercial builder that had moved on.
Lux sites use core WordPress blocks and nothing else. That is a real constraint on us and a real guarantee for you: when the design is eventually replaced, the content walks across intact.
Hardened by default
Security that depends on somebody remembering is security you do not have. These are built into the theme, so every Lux site starts with them on:
- XML-RPC disabled. It is a brute-force and pingback amplification surface almost nobody still needs.
- Dashboard file editing off. This is how malware most often persists after a break-in.
- No version disclosure. The WordPress version never reaches the page, so you are not advertising which exploits to try.
- Login errors that say nothing. A wrong password and a wrong username look identical from outside.
- Security headers at the edge, where they cover images and uploads too, not just pages PHP happens to render.
Real infrastructure
Cheap shared hosting is cheap because hundreds of sites share one oversold machine. Your neighbour’s compromised plugin becomes your afternoon.
Lux sites run on AWS with their own resources, a CDN in front, encrypted disks and backups stored away from the server that made them. The restore path is tested, because a backup nobody has ever restored is a guess.