WordPress + Elementor vs Craft CMS 5: three identical websites on the same server, measured for TTFB, SQL and Lighthouse

We had rebuilt three company websites on WordPress with the free Elementor, then built them again from scratch in Craft CMS 5: same content, same WebP files, same look 1:1, same server. Craft sends 5 KB of JavaScript instead of 97 to 129 KB and runs fewer than half the SQL queries at a similar TTFB. As typical WordPress sites with 9 to 21 plugins, they had scored 30 to 72 in Lighthouse mobile.

  • 5 KB instead of 97 to 129 KB of JavaScript on Elementor pages
  • 34 to 54 instead of 83 to 117 SQL queries, 4.5 to 5.8 instead of 6.9 to 7.4 MB of memory
  • TTFB 37 to 49 ms in Craft, 42 to 52 ms with Elementor, 19 to 28 ms without plugins
Two panels side by side, WordPress + Elementor on the left, Craft CMS in an orange frame on the right. Each has three bars: JS 97 to 129 KB and 5 KB, SQL 83 to 117 and 34 to 54, PHP files 1,057 to 1,290 and 546 to 558; the Craft bars are shorter, the JS bar almost disappears

Three company websites rebuilt on WordPress 7.1 + Elementor 4.3 (free) + a custom Tailwind theme, compared with Craft CMS 5.11

Challenge

We had previously rebuilt three company websites from scratch on WordPress: the free Elementor as the client's editing tool, a custom theme with Tailwind CSS, no unnecessary plugins, the same look 1:1 as the old sites. At handover we were asked a question we hear more and more often: would it not be better to move straight to Craft CMS, the system we build B2B websites on?

Instead of giving an opinion, we built the same three websites a second time, from scratch, in Craft CMS 5, and measured both systems under the same conditions. The condition: the comparison had to be fair, meaning both versions built from scratch on Tailwind, with no plugins or only the necessary ones, the same content, the same images, the same look.

The main comparison is WordPress with Elementor, as the websites were handed over to the client, against Craft with a single plugin. On these websites Elementor plays the same role as the Matrix field in Craft's core: the client uses it to assemble pages from blocks.

Solution

In Craft we built a content model with a Matrix field and blocks that correspond to the WordPress theme's widgets, the schema and the content import in code, Twig templates and a module that took over forms, 301 redirects, SEO, the sitemap and search. The only plugin is CKEditor, because Craft's core has no text editor.

Both systems ran on the same PHP 8.3 image with Apache, against the same MariaDB 11.4 and with the same php.ini with OPcache, without page caching (as of 2026-11). We measured response time, PHP time, memory, loaded files and SQL queries, page weight and number of requests in the browser, Lighthouse on mobile and desktop, installation size and PHP files reachable from the browser, and separately the cost of Elementor itself.

Results

JavaScript per page
5 KB in Craft, 97 to 129 KB in WordPress with Elementor
SQL queries per page
34 to 54 in Craft, 83 to 117 in WordPress
Server response time (TTFB)
37 to 49 ms in Craft, 42 to 52 ms with Elementor, 19 to 28 ms without plugins
PHP files reachable from the browser
1 in Craft, 3,366 to 4,109 in WordPress
Gallery of 82 images on mobile
91 points and LCP 3.5 s in Craft, 75 points and LCP 8.7 s in WordPress
Lighthouse mobile for a typical WordPress site
30 to 72 points before the rebuild, 81 to 100 after, 94 to 98 in Craft

How we worked

  1. The same conditions

    The same PHP 8.3 image with Apache, the same MariaDB 11.4, the same php.ini with OPcache, 512 MB per container, no page cache in either system.

  2. Craft from scratch

    A content model with a Matrix field instead of Elementor widgets, the schema and the content import in code, Twig templates, one plugin, everything else in a module.

  3. A 1:1 match

    The same WebP files and image transforms, the same URLs. Full-height screenshots on desktop and mobile: 82 pairs, 78 with no difference in height, 4 with a difference of 1 px.

  4. Server measurement

    PHP time, memory, loaded files and SQL statements from every request; response time from 50 requests per URL after warming up OPcache.

  5. Browser measurement

    Weight and requests in Chromium with an empty cache, Lighthouse on mobile and desktop, three runs each, median.

  6. The cost of Elementor

    WordPress with plugins deactivated and the same theme as the lower bound of what WordPress itself costs on the server.

  7. A typical WordPress site

    A comparison with our measurements of the same websites before the rebuild, when they had 9, 15 and 21 plugins.

Test conditions: what "fair" means

All the numbers come from our lab: one machine, six containers with the same PHP image, one database, measurements from the same host. Without network latency the server times are lower than on the internet; Lighthouse on mobile simulates a slow 4G connection and a less powerful phone.

SiteScopeWhat is interesting
Site 19 pages, a gallery of 10 images, lightboxthe WordPress theme itself switches off Elementor's JavaScript on pages without interaction
Site 212 pages, 5 projects with categories, 2 forms, search11 custom Elementor widgets: slider, tabs, flip cards, project filter
Site 311 pages, 308 images in galleries, a form, a map after consentElementor entrance animations, the WP Mail SMTP plugin for sending mail

Shared by both systems (as of 2026-11):

  • the wordpress:php8.3-apache image with pdo_mysql (PHP 8.3.36, Apache 2.4.69, mod_php, prefork),
  • the same MariaDB 11.4 instance with the default configuration,
  • the same php.ini: memory_limit 256M, OPcache 128 MB, max_accelerated_files 20000, revalidate_freq 2,
  • production mode (WP_DEBUG and devMode off), no cache plugin, no persistent object cache, no {% cache %} in the templates,
  • 512 MB of memory per container.
FROM wordpress:php8.3-apache
RUN docker-php-ext-install -j2 pdo_mysql \
 && groupmod -o -g 1000 www-data && usermod -o -u 1000 www-data
WordPressCraft CMS
SystemWordPress 7.1.4Craft CMS 5.11.5.1
PluginsElementor 4.3.5 (free), on site 3 also WP Mail SMTP 4.10.3CKEditor 5.9.0, the only one
Site codecustom theme: PHP, Elementor widgets, Tailwind CSS 4Twig templates, PHP module, Tailwind CSS 4

A script moved the content (export to JSON through WP-CLI, import with a Craft console command). The images are the same WebP files from wp-content/uploads, with transforms in the same dimensions and the same quality as the theme's image sizes, and srcset, sizes, loading and fetchpriority as in WordPress's HTML. The URLs are the same, including the trailing slash; old URLs redirect with a 301 in both systems. Across 82 pairs of screenshots (1440 × 900 and 390 × 844) the page height differs by 0 px in 78 and by 1 px in 4: for two images Craft calculates a transform of 803 instead of 804 px. The menu, slider, tabs, filter, lightbox, forms and the map after consent work the same way, and a first-time visitor gets 0 cookies and 0 connections to third-party domains in both versions.

WordPress with or without Elementor

WordPress without a page builder is a different service: the client would edit in the block editor or get templates with no freedom of layout. To show what Elementor alone costs, we also measured WordPress with plugins deactivated (the core and the same theme, pages from the HTML copy that Elementor saves in post_content). This variant looks different and serves only for the server measurement. A version "WordPress without Elementor, with templates as in Craft" would send practically the same HTML, CSS and JS as Craft, so we did not build it.

Server-side measurement: an auto_prepend_file in both systems, active only with a measurement header, records PHP time, peak memory, the number of loaded PHP files and the SQL statement counter on the application's own connection:

// WordPress
$sql = (int) $GLOBALS['wpdb']->get_var("SHOW SESSION STATUS LIKE 'Questions'", 1) - 1;
// Craft
$row = \Craft::$app->getDb()->createCommand("SHOW SESSION STATUS LIKE 'Questions'")->queryOne();
$sql = (int) $row['Value'] - 1;

Response time (TTFB): curl from the same host, 20 requests to warm up OPcache, then 50 measured requests for each of the site's five URLs. Weight and requests: Chromium, empty cache, scrolling through the whole page, 3 runs. Lighthouse 12.8: mobile and desktop, 3 runs per URL, median.

On the left two pages laid over each other, one drawn with a solid line, the other with a dashed line. On the right a grid of 82 squares: 78 black labelled 0 px and 4 orange labelled 1 px, above it 1440 × 900 and 390 × 844

Server: median of five URLs per site (lab, as of 2026-11)

Site and system TTFB, median and p90 PHP memory PHP files per request SQL statements
Site 1: WordPress + Elementor 42.0 and 44.4 ms 6.9 MB 1,057 83
Site 1: WordPress without plugins 19.0 and 23.7 ms 4.4 MB 502 31
Site 1: Craft 36.9 and 40.3 ms 4.5 MB 546 34
Site 2: WordPress + Elementor 52.4 and 56.7 ms 7.0 MB 1,205 117
Site 2: WordPress without plugins 28.4 and 36.5 ms 4.8 MB 504 46
Site 2: Craft 48.9 and 50.9 ms 5.8 MB 552 54
Site 3: WordPress + Elementor + WP Mail SMTP 48.6 and 54.2 ms 7.4 MB 1,290 98
Site 3: WordPress without plugins 19.6 and 22.1 ms 4.8 MB 504 32
Site 3: Craft 48.1 and 51.2 ms 5.5 MB 558 38

Browser: total of five URLs per site, empty cache

Site and system Requests JavaScript and CSS Images Without images
Site 1: WordPress 75 10 KB and 66 KB 1,064 KB 109 KB
Site 1: Craft 54 10 KB and 25 KB 1,094 KB 46 KB
Site 2: WordPress 129 421 KB and 89 KB 2,359 KB 962 KB
Site 2: Craft 70 25 KB and 45 KB 2,650 KB 508 KB
Site 3: WordPress 219 531 KB and 107 KB 2,633 KB 1,108 KB
Site 3: Craft 132 25 KB and 45 KB 2,787 KB 504 KB

Lighthouse 12.8: median of three runs on three URLs, TBT 0 ms and CLS 0 throughout

Site and system Mobile: score Mobile: FCP and LCP Desktop: score Desktop: FCP and LCP
Site 1: WordPress 98 1,054 and 2,332 ms 100 243 and 404 ms
Site 1: Craft 98 752 and 2,327 ms 100 202 and 483 ms
Site 2: WordPress 95 1,656 and 2,780 ms 100 405 and 749 ms
Site 2: Craft 96 755 and 2,777 ms 100 323 and 643 ms
Site 3: WordPress 89 1,652 and 3,760 ms 99 364 and 765 ms
Site 3: Craft 94 1,054 and 3,079 ms 100 282 and 583 ms

Where the differences come from

In the browser, Elementor makes the difference

On the pages of sites 2 and 3 WordPress sends 97 to 129 KB of JavaScript (jQuery 3.7.1, jQuery Migrate, the Elementor frontend, the webpack runtime and, with animations, their modules too), Craft 5 KB. In the total for five URLs, Elementor and jQuery account for 44, 442 and 581 KB on sites 1, 2 and 3. Site 1 already switches off Elementor's JavaScript in the theme, so there the difference is only CSS and 4 to 5 fewer requests per page. The fonts are the same in both versions, and the DOM tree in Craft has 4 to 14 % fewer nodes, without the elementor-element wrappers.

Elementor's stylesheets and scripts load in the <head> and block rendering of the page. On a slow connection every such file adds time to the first contentful paint (FCP), on mobile 0.3 to 0.9 s. Elementor's entrance animations hide elements until the scripts have run, so in the gallery of 82 images the largest element (LCP) waits almost 7 s. Lighthouse's LCP breakdown for WordPress: TTFB 451 ms, resource load delay 1,238 ms, resource load duration 82 ms, element render delay 6,961 ms, eight render-blocking resources. Craft: one blocking resource and a render delay of 3,229 ms with the same entrance animation, only without waiting for jQuery.

On the server, Elementor doubles WordPress's time

Bare WordPress with the same theme: 502 to 504 PHP files, 31 to 46 SQL statements, 19 to 28 ms. With Elementor: 1,057 to 1,290 files, 83 to 117 statements, 42 to 52 ms. In MariaDB's query log (general_log, one view of site 1's home page) WordPress sent 71 statements, 25 of which asked for options that do not exist in the database at all (default settings of Elementor's experiments; without a persistent object cache WordPress asks for them on every request):

SELECT option_value FROM wp_options WHERE option_name = 'elementor_…' LIMIT 1

On the server, Craft costs about as much as WordPress with Elementor

The Yii 2 framework, Twig and the element layer amount to about 550 PHP files per request and 30 to 55 SQL statements, which means 37 to 49 ms. Of the 29 statements on site 1's home page, most are configuration (sections, entry types, field layouts, volumes, image transforms), the rest are element queries. The lower memory use (4.5 to 5.8 MB) comes mainly from the smaller number of loaded files. So Craft is not "faster than WordPress": bare WordPress prepares a page twice as fast as both systems compared here.

Images come out at different sizes in each system

On sites 2 and 3 Craft has more bytes of images and fewer of everything else. That is why we compare weight separately with and without images; the second trap below explains why.

Bar chart of TTFB in milliseconds for sites 1, 2 and 3. Each group has three bars: WordPress core, that is without plugins, as a dashed outline at 19, 28 and 20 ms, WordPress + Elementor in black at 42, 52 and 49 ms, Craft CMS in orange at 37, 49 and 48 ms

Challenges we overcame

The gallery in Craft: 439 SQL queries for one page

The gallery page with 82 images, each with a srcset of four transforms, had 439 SQL statements and a TTFB of 106 ms in the first version, more than WordPress with Elementor. .eagerly() loads the assets in one query, but $asset->getUrl('transform') looks up the ready transform in the imagetransformindex table with a separate query for every image and every transform. One line in the template loads the transform index for the whole gallery at once:

{%- set images = block.images.eagerly().all() -%}
{%- do craft.app.imageTransforms.eagerLoadTransforms(images, ['medium', 'large', 'thumbnail', 'mlarge']) -%}

WordPress has its own version of the N+1 problem in the same gallery: two queries per image (SELECT * FROM wp_posts WHERE ID = … and a query for the meta). Loading the gallery images in advance reduces them in the test, without changing the client's theme:

add_action( 'elementor/frontend/widget/before_render', function ( $widget ) {
    if ( 'theme-gallery' === $widget->get_name() ) {   // name of the theme's gallery widget
        _prime_post_caches( wp_list_pluck( (array) $widget->get_settings( 'gallery' ), 'id' ), false, true );
    }
} );
Gallery of 82 images (site 3)TTFBSQL statements
WordPress + Elementor, as handed over66.8 ms260
WordPress, images loaded in advance (test)61.7 ms98
Craft, first version of the template106.0 ms439
Craft, transforms in one query58.2 ms33

The same on site 1: the project list went from 67 to 34 statements, the gallery from 62 to 33. In both systems the template also "works" without this.

The same quality, different bytes

Transforms from the same WebP originals, in the same dimensions and with the same quality (80 and 82), are 8 to 11 % larger in Craft (site 1: 4.3 and 4.8 MB for all transforms, site 3: 47.8 and 51.6 MB). WordPress downscales with the Triangle filter and light sharpening, Craft (the Imagine library) with Imagick's default filter. On top of that, Craft recompresses the file by default when it is uploaded from outside the control panel: after the import all 32 originals of site 1 had different bytes than in WordPress, until we switched this off:

$asset->sanitizeOnUpload = false;   // files from WordPress are already sanitised; otherwise Craft writes the WebP again

Imagick does not fit in memory_limit

ImageMagick's memory does not count towards the PHP limit, and within one process it is not released between images. Importing 308 images and the first visit to the gallery (transforms generated on display, the generateTransformsBeforePageLoad option) ended with the process being killed in the 512 MB container, with no response for curl:

exit 137

At about 1,100 transforms in one process ImageMagick reported:

cache resources exhausted ... @ error/cache.c/OpenPixelCache/3931

WordPress creates the sizes on upload, one image per request. In Craft we generate the transforms in advance with a separate command in a one-off CLI container with a higher limit:

docker run --rm -m 2g ... cs-cms-php:8.3 craft site/import/transforms   # one-off CLI container, the same image

The WordPress theme without Elementor: a fatal error

When we measured "WordPress without plugins", site 1 returned a 500:

PHP Fatal error:  Uncaught Error: Class "Elementor\Plugin" not found in /var/www/html/wp-content/themes/<theme>/inc/elementor.php:161

The culprit was the wp_print_footer_scripts hook that switches off Elementor's JavaScript on pages without interaction. A theme built for a page builder is tied to it more closely than the admin panel shows; for the measurement we removed this one hook with a temporary file in mu-plugins.

Re-running schema/apply in Craft 5 wiped the content

Craft 5 stores field values in the JSON column elements_sites.content under the UID of the field layout element, not of the field itself. A schema script that created new layout elements on every run "lost" all texts after the second run: they were in the database, but under the old UIDs, and resave/entries made the loss permanent. The fix: reuse the UIDs of the existing layout elements. Important for anyone who keeps a Craft schema in code.

Text from Elementor is not the text on the page

Elementor stores raw HTML, and on output WordPress runs it through wptexturize: a hyphen between words becomes an en dash (–), straight quotes become typographic ones. An import from Elementor's data would have produced different characters than on the live site, so we took the texts and titles of site 2 from the rendered HTML.

Search gives different results for the same content

WordPress searches with LIKE in post_content, where Elementor keeps an HTML copy of the page together with the alt texts and file names of the images. Craft searches an index of words from fields marked as searchable, and in Craft 5 a field is not searchable by default: the search only found titles. With the index switched on, WordPress returns 6 pages for the same word, Craft 4; in two of them the word appeared only in image file names.

Four horizontal bars of SQL statements for the gallery of 82 images: Craft 439, Craft with eagerLoadTransforms 33 in orange, WordPress 260, WordPress with _prime_post_caches 98; next to the bars the times 106, 58, 67 and 62 ms

Installation, security and ease of editing

WordPress (sites 1 to 3)Craft (sites 1 to 3)
Code size without images173 to 184 MB: core 91 MB, Elementor 77 MB, WP Mail SMTP 10 MB (site 3), theme 0.3 to 0.4 MB192 MB: vendor 191 MB (Craft 42.5 MB, CKEditor 41.2 MB, libraries), site code 0.2 to 0.3 MB; after the control panel is first opened, 47 MB of control panel resources
PHP files in the installation3,366 to 4,109 (core 1,316, Elementor 2,023, WP Mail SMTP 733, theme 17 to 33)8,016 to 8,020 (vendor 8,000, module 6 to 9, configuration 8 to 9)
PHP files reachable from the browser3,366 to 4,109, the whole installation directory is public1 (web/index.php), the rest outside the public directory
PHP files loaded per request1,057 to 1,290541 to 560
Database13 tables (site 3: 17), 1.0 to 9.3 MB71 to 72 tables, 5.0 to 7.0 MB
Updatesfrom the admin panel, automatic too; core and plugins separatelyComposer and deployment (in production, changes in the control panel are switched off), the control panel shows available versions

Craft has more PHP files (the Yii 2, Twig, Guzzle and Symfony libraries), but only one of them sits in the public directory, so no other file can be called by URL. In WordPress every PHP file of every plugin sits in the public directory; that is a typical attack route through vulnerable plugins.

WordPress + ElementorCraft
Building a pagedragging blocks on the preview, settings in a side panela form with Matrix blocks, live preview alongside
Freedomwide: spacing, colours, typography of every widgetblock fields and a "Layout" table; the templates keep the design
Risk of breaking the designhigh, every editor can override styleslow
VersionsWordPress revisions and Elementor historydrafts, revisions and scheduled publishing in the core
Multiple languagesa plugin, e.g. WPML or Polylangin the core
Content as datalayout and content together as JSON in wp_postmeta and an HTML copy in post_contentfields and blocks as separate elements, import and export without parsing HTML

The "Layout" table in Craft (values for desktop, tablet and mobile) is less convenient than Elementor's sliders. In a normal Craft project the layout lives in the templates and the editor only chooses block variants; here we kept these settings to reproduce the websites 1:1 and give the editor a similar freedom as in Elementor.

Two grids of PHP files. On the left WordPress: the orange frame of the public directory encloses the whole grid, labelled 3,366 to 4,109. On the right Craft: a larger vendor grid of 8,000 files outside the frame, the orange frame encloses only the single file web/index.php, labelled 1

Ideal conditions and a typical WordPress site

This comparison shows both systems under ideal conditions: both versions built from scratch, with one plugin on the Craft side and one page builder on the WordPress side, no ready-made theme and no plugins "just in case". A typical WordPress site looks different. We have data on that from the same three websites, which we measured before rebuilding them on clean WordPress (table below, the same site numbering; site 3 has no Lighthouse measurement from before the rebuild).

After the rebuild every site has one page builder plugin, site 3 also a plugin for sending mail. Clean WordPress and Craft are a few Lighthouse points and a few milliseconds on the server apart. The typical WordPress these websites started from is tens of points and up to tens of seconds of LCP away from both.

The difference lies not in the core of the system but in what the system lets you add. Craft has no marketplace of ready-made themes or page builders: Twig templates are written from scratch for every project, and in production, where configuration changes in the control panel are switched off, plugins only come in through Composer and a deployment, not with one click by an editor. A Craft website is therefore always built to the standard that this test calls ideal. WordPress lets you build a website just as cleanly, as our rebuilds show, but it does not enforce it: the result depends on the discipline of whoever builds the site and on what gets installed later.

Lighthouse mobile scale from 0 to 100 for sites 1 and 2. Site 1: typical WordPress with plugins as a dashed range from 67 to 72, WordPress + Elementor as a black range from 98 to 100, Craft CMS as an orange dot at 98. Site 2: 30 to 63, 81 to 96 and 96

The same three websites: before the rebuild, after the rebuild and in Craft (Lighthouse on mobile)

Measurement Site 1 Site 2 Site 3
Plugins before the rebuild 9 (5 active) 15 21
JavaScript per page before 65 to 89 KB 807 to 810 KB 402 to 422 KB
Lighthouse before, 3 pages 67, 72, 71 63, 50, 30 not measured
LCP of the heaviest page before 11.9 s 64.8 s not measured
After the rebuild on clean WordPress, i.e. "WordPress" in this comparison 100, 99, 98 points, LCP 2.4 s 95, 81, 96 points, LCP 2.8 s 98, 91, 98 points, LCP 3.4 s
Craft in this comparison, median of 3 pages 98 points 96 points 94 points

What we take from it

  • Under ideal conditions Craft and WordPress are close to each other. Craft sends half as much data apart from images and shows the content on mobile sooner, because it has no page builder. On the server both systems are within a few milliseconds of each other, and bare WordPress is twice as fast as both.
  • Craft is not faster than WordPress as such. It enforces a standard: templates from scratch, no ready-made themes or page builders, one public PHP file. In WordPress this standard depends on the discipline of whoever builds the site, and a typical site with a dozen or more plugins is far from it (Lighthouse on mobile 30 to 72 instead of 81 to 100).
  • The page builder costs the most. Elementor doubles WordPress's time on the server, adds jQuery and render-blocking files, and a theme built for it does not work without it.
  • The N+1 problem affects both systems. A gallery that does not load its images and their transforms in advance makes hundreds of queries in Craft and in WordPress; one line of code decides the result, not the system.
  • Two versions side by side, under identical load, settle the question faster than a discussion. We compared PHP 7.4 and 8.2 the same way in the PHP 8.2 session lock project.

That is why for a new company website, especially in several languages, we choose Craft CMS, and we do not move a well-built, lightweight website on WordPress for speed alone. We plan a move to a different system when the current website cannot be kept to this standard.

Wondering whether to stay with WordPress or move to Craft CMS? We will measure your current website and show you what the plugins and the page builder cost before you decide. The first step is an intro call.

Sources

The versions and figures come from our lab; the description of the features comes from the vendors' documentation (as of 2026-11):

Two routes of a plugin to the production server. At the top WordPress: from the wp-admin panel an arrow straight to the server with 21 plugin squares. At the bottom Craft CMS: composer require, an orange deploy gate, a server with one plugin square

The first step: a CMS check for WordPress and Craft CMS

CMS check: WordPress and Craft CMS

For companies with a business-critical WordPress or Craft CMS website and no agency or maintainer any more: before a takeover, before a major update or after a security incident.

  • Versions of CMS, PHP, database and server, and their support status
  • Plugins and themes: what is maintained, what is abandoned and what should be replaced
  • Updates: what is missing and how risky it is to catch up
  • Backups: what is backed up and whether a restore has been tested
  • Security: admin access, two-factor login, user permissions and known vulnerabilities
  • Licences for the CMS and commercial plugins: which ones exist and in whose name they are registered

At this stage we change nothing on the website. We check custom themes and plugins for maintenance status and known vulnerabilities, not line by line. The check covers one website; we price further websites individually.

What the result contains

A written report with the risks in order of priority and a plan for takeover, updates and ongoing support. The report is yours.

Typically 2 working days

Request a CMS check

Related situations

  • Google warns visitors about your website, visitors end up on unknown sites, or the hosting provider has suspended the account? We isolate the website, close the vulnerability and clean the website within 24 hours of access, weekends included. Afterwards you receive a written report.

  • Your system runs, but nobody knows it in detail. We record application, database, server and email, assess the risks, recommend the next step in writing and, if you wish, take over operations.

  • Security updates for PHP 8.2 end on 31 December 2026, and for PHP 8.1 and older they have already ended (As of 2026-10). We move long-running PHP applications, including those with Smarty templates and jQuery front ends, to PHP 8.4 or 8.5 and test every stage.

More projects

  • A list of nine nightly backups at 01:30: two with a long black bar and 285 MB, seven with a short orange mark and 751 B

    The MySQL backup was 751 bytes: one damaged MyISAM table and the restore test

    For seven nights the cron backup script wrote a 751 B file instead of about 280 MB: one MyISAM table was marked as crashed, mysqldump stopped at LOCK TABLES, the script exited with code 0 and cron discarded the message. We reproduced the failure, repaired the table, moved the databases to InnoDB and introduced a backup that test-restores itself every night and raises an alarm.

  • Three lanes from a field of dots end at an orange wall labelled WAF; one lane from a laptop passes through the gap to a shop front

    A shop flooded by bots that looked like customers

    A WooCommerce shop with 52 products loaded slowly or not at all. The cause was a paid network of bots sending tens of thousands of requests an hour, each from a different home address, and every single bot behaved perfectly. Our engineers stopped the traffic at the edge of the network, and when the bots changed tactics a month later, the second rule took the load off within two minutes.

In 20 minutes we work out which first step fits your system

You tell us the goal and the current state, and we say openly whether and how we can help. Reply within one working day, no obligation.

Phone (German, Polish, English) +48 501 250 220
Email Email

Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)