All the ingredients of a professional, rock solid WordPress website.
Published October 2026.
This is the stack I reach for on every build. Each item is one line of what, one line of why.
Hosting
Kinsta or WP Engine. Managed WordPress hosting with server-level caching, PHP version control, staging, and support that understands WordPress. Shared cPanel hosting costs less and costs more.
DNS
Cloudflare. Fast DNS, a CDN, and a WAF in front of the site for free, plus the security and AI features below. Point the nameservers at Cloudflare and leave the registrar alone.
Route all WordPress mail through SMTP or a transactional API (Postmark, SendGrid, Amazon SES). PHP mail from the web server lands in spam or nowhere, and the first time anyone notices is when a password reset never arrives.
SEO
Rank Math for on-page control (titles, meta, sitemaps, redirects) plus Google Search Console for what Google actually sees. Verify Search Console on day one so there is history when you need it.
CMS Fields
Advanced Custom Fields. Custom fields, field groups, options pages, and blocks without writing the admin UI yourself. Register fields in PHP or JSON so they live in version control.
Code Access
Git deploy first, SSH second, SFTP as the fallback. Theme and custom plugin code belongs in a repository and gets deployed, not edited on the server. Never use the WordPress theme or plugin file editor.
Backups
Host-level snapshots. Kinsta and WP Engine take daily backups and support manual restore points before a change. A backup plugin writing to the same server is not a backup.
AI Optimization
Make the site readable by language models, not just browsers:
- Schema.org structured data on every content type (Organization, Article, Product, FAQ) via Rank Math or custom JSON-LD
- A JSON endpoint for your content. The WordPress REST API exposes posts and pages at
/wp-json/wp/v2/by default; keep it public for public content - Cloudflare’s Markdown for Agents, which converts HTML to Markdown at the edge when a client sends
Accept: text/markdown. It is opt-in, on paid Cloudflare plans, and turning it on setsContent-Signalheaders to allow AI training, search, and input by default, so review that before enabling
Analytics
Google Tag Manager as the single container, Google Analytics 4 inside it, and conversion events defined for every form submit, booking, and purchase. Nothing is “tracked” until there is a conversion event you can report on. Jetpack Stats is fine as a simple second opinion.
Compliance
WCAG 2.1 AA for accessibility and a consent banner that blocks non-essential tags until the visitor accepts. Website accessibility suits and California wiretap claims over pre-consent tracking are the two most common demand letters a site owner receives.
Theme
Custom and minimal. A theme built for the site, with only the templates and styles it needs. Page builders and multipurpose themes trade speed and maintainability for options nobody uses.
AI
Enable the WordPress MCP server and connect it to ChatGPT or Claude. WordPress 6.9 added the Abilities API and the core AI team’s MCP Adapter plugin exposes those abilities as MCP tools at /wp-json/mcp/. Authenticate with an application password, not your login password, and only expose abilities marked public.
Settings
- Disable comments unless the site is a community
- Settings > Reading: confirm “Discourage search engines” is off when the site goes live
- Permalinks set to Post name; no dates or categories in the URL
Contact Forms
Custom coded or Gravity Forms. Custom when the form is simple and performance matters; Gravity Forms when you need conditional logic, multi-page forms, or integrations. Either way, route submissions to a CRM, not just an inbox.
Attribution
Always use UTMs. Every email, ad, social post, and partner link gets utm_source, utm_medium, and utm_campaign. Without them GA4 reports “direct” and the marketing budget is unaccountable.
Security
Multi-factor authentication on every admin login and Cloudflare managed WAF rulesets in front of the site. Limit admin accounts, rotate application passwords, and keep core, plugins, and PHP current.
Gutenberg
Use theme.json to define the brand: color palette, font families, font sizes, spacing scale, and which editor options are allowed. Editors get the right choices and nothing else.
Menus
Manage under Appearance > Menus and assign each to a theme menu location registered with register_nav_menus(). Hard-coded navigation in templates means a developer for every link change.
Fonts
Google Fonts, self-hosted. Download the WOFF2 files and load them from the theme with font-display: swap. Avoids the external request and the privacy question.
Images
Size and optimize at request time with wsrv.nl. Pass the original URL through https://wsrv.nl/?url=...&w=800&output=webp and let it resize, convert, and cache. Upload originals at full size and never ship them to the browser.