Your Website Shouldn't Need Babysitting

Many business websites still run on WordPress, shared hosting and cPanel email, and each of those is a separate thing that can break. A serverless setup swaps them for a few specialised services, so your site is easier to maintain, cheap to run and built around what you actually need to change.

I wrote this for clients, and for anyone who has asked me why I build websites this way now. Hosting prices and promotions change often, so I update this guide regularly, and each service below links to its own pricing page.

How I got here

I built my first website in 2017 with Mobirise, planning to learn code along the way. Then I learned WordPress, and at the time it made a lot of sense. But how we use websites has evolved, how I like to build them has changed, and how my clients and I want to modify and grow a site has changed too. Moving to a serverless setup is a natural evolution, and the rest of this piece is about what it means for you.

Where the old setup struggles

A typical WordPress site is several parts working together: WordPress itself, a theme, a stack of plugins, a shared hosting server, and email running through cPanel on that same server. When something fails, it is rarely obvious which part is responsible. Across my clients I kept seeing a different version of the same story:

Email that drops at random. Logging in through webmail or cPanel shows the mailbox working, yet mail still drops. Another client could not get their mailbox working in Outlook, which is the program they actually use.
Plugin surprises. A plugin is installed for one feature, and suddenly the site starts doing something else.
Training. A full WordPress dashboard takes time to learn, even when staff only need to do a couple of jobs on it.
Built within WordPress’s rules. WordPress is inherently limited, because you have to build within its guidelines. I was fitting each client’s business to the tool, instead of the other way round.

Each of these can be fixed on its own. The trouble is that every site had a different one, so I was always firefighting.

The serverless alternative, piece by piece

Serverless does not mean there are no servers. It means you no longer rent, configure and maintain one yourself; each job is handled by a specialised service instead.

Job	Old setup	New setup
Building the site	WordPress theme and plugins	React or Astro, both JavaScript-based
Storing the code	On the hosting server	GitHub, which I can share with you
Hosting	One shared hosting server	Cloudflare, Netlify or Vercel
Logins and data	WordPress database on the same server	Supabase
Email	cPanel mailboxes	Zoho Mail
Admin	The WordPress dashboard	A custom admin panel built around your needs

Behind the scenes, Node.js powers the build tools. Which host I pick depends on what the site is built with and what we are trying to achieve, but most go on Cloudflare because it is the easier option.

What it costs, and what to watch for

For most of my clients, hosting and data cost nothing. The free plans have worked well for the sites I build and manage myself. The one real monthly cost is email.

Service	Role	Free plan	If you outgrow it, or what to watch
Cloudflare Pages	Hosting	Yes	500 builds a month on the free plan, which is rarely a limit for a business site
Netlify	Hosting	Yes	Usage is measured in monthly credits rather than separate limits
Vercel	Hosting	Yes (Hobby)	Hobby is for non-commercial use; commercial sites need Pro at $20 per user per month
Supabase	Logins and data	Yes: 500 MB database, 50,000 monthly active users	Free projects pause after 1 week of inactivity; Pro is $25 per month and never pauses
Zoho Mail	Email	Up to 5 users, web access only	Paid plans start at about $1 per mailbox per month, billed annually (roughly $12 to $15 a year each)

The Supabase pause is the one free-plan catch I plan around. I set up a small automated check that keeps a free project active between visits, so it is ready when you log in. For a business-critical site, the Pro plan removes the question entirely.

Zoho is the one cost I will not dress up. Every mailbox is a recurring charge, and it grows with your team: ten mailboxes is roughly $120 to $150 a year. Hosting can fall to zero on a free plan; email does not.

How that compares with traditional hosting

The traditional route bundles hosting and email into one plan, and you pay for the whole term upfront. Three common providers for small business sites are GoDaddy, Hostinger and StableHost.

Provider	Plan	Paid upfront at sign-up	Renewal, per year	Email
GoDaddy	Economy	About $84 for 1 year, or $216 for a 3-year term	About $120 to $144	Included; some email is only free for the first year
Hostinger	Premium	$47.88 for 12 months, or $143.52 for 48 months	About $132 ($10.99 a month)	Included; reviews report mailbox limits were cut recently, so check before relying on “unlimited”
StableHost	Starter	About $72 for the first year at the promotional rate	About $127 to $144	Reviewers report unlimited email accounts on shared plans

Those upfront prices are promotional. You pay for the whole term at sign-up, and when it ends the plan renews at the regular rate, roughly 1.5 to 3 times higher. One of my clients paid about $60 for their first year of hosting and now pays about $157 a year.

On the figures above, three years on one of these plans (the first-year price plus two renewals, my arithmetic) costs roughly $310 to $370, before any add-ons. A domain name is needed either way, but hosting on the serverless setup is $0 on the free plans.

In fairness, a plan with unlimited email can beat Zoho’s per-mailbox pricing on paper when a company needs many mailboxes. What the serverless setup buys is separation: your email no longer lives on the same server as your website, which is where I saw the dropped mail and the Outlook problems.

The security side

WordPress itself is rarely the weak point; the plugins around it are, and the latest industry data shows that attack surface growing. Here is what the most recent reports found:

Volume is rising. Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before.
Plugins are the problem. 91% were in plugins and 9% in themes. Only 6 were in WordPress core, and all were low priority.
Fixes often do not exist yet. 46% had no patch from the developer when they were made public, so “keep everything updated” is not enough on its own.
Attacks arrive fast. For the most heavily targeted flaws, the median time to mass exploitation was 5 hours.
Premium is not safer. Premium plugins and themes had three times as many known exploited vulnerabilities as free ones.
Hosting does not fully cover for it. In Patchstack’s tests, common hosting defences blocked only 26% of vulnerability attacks.

Core is not immune either. On 17 July 2026 WordPress force-pushed emergency updates (6.9.5 and 7.0.2) for a flaw nicknamed wp2shell, which let an anonymous attacker run code on a default install with no plugins, and public exploits appeared within days. The same Patchstack report also saw malicious file uploads nearly triple in November and December 2025, so the holiday season is a high-risk window.

There is a server-side factor too. WordPress runs on PHP, and every PHP version has a fixed lifespan: two years of active support, two more of security fixes only, then end of life. According to the PHP project, 8.2 gets security fixes only until 31 December 2026, 8.3 until the end of 2027, 8.4 until the end of 2028 and 8.5 until the end of 2029. PHP 8.1 and older no longer receive fixes, so it is worth asking your host which version your site runs.

The catch is that you do not always control it. Some hosting providers set the PHP version for the whole account, so neither my clients nor I can move to the newest version ourselves; we have to wait for the host to do it. And when the version does change, an older theme or plugin that is not compatible can take the site down with WordPress’s “There has been a critical error on your site” message.

What changes with serverless

The public pages are built ahead of time and served from the host’s network, so there is no PHP engine, plugin marketplace or WordPress login page for automated attacks to probe. Where a site needs logins or an admin panel, that data sits in Supabase behind its own access rules, and your email sits with Zoho instead of on the website’s server.

The safest case is a fully static site. If your site does not need an admin side for frequent changes, I can build it as plain pages and serve it through Cloudflare. With no database or login behind it, there is far less for an attacker to exploit. The admin panel and Supabase only come in when you genuinely need to update content often.

Serverless is not automatically secure, though. The admin panel is custom code, so its safety depends on how I build it, and Supabase only protects data if its access rules are set up properly. JavaScript sites also depend on third-party packages, which need monitoring too. And in fairness, a WordPress site with few plugins, fast updates and monitoring can be run securely; the difference is how much of that work depends on someone remembering to do it.

What changes for you

The biggest difference is the admin panel. During onboarding we agree on what you actually need to change on the fly, and I build the admin around exactly that. Different people can be given different jobs. A few examples:

ZBM: staff can do different things on the site, and the admin covers product uploads and blogs, and that is about it.
David Mascott Country School: speed and uptime were the priorities, so the site needed to be fast and stay up.
Forestry & Garden: an affordable platform, without paying for hosting they did not need.
Everyone: reliable email that works in Outlook or in the Zoho app.

There are no more surprises from a plugin that was installed last week. If you need to grow beyond what we agreed, we sit down, scope it and build it out. In my experience, something that took about three weeks to build in WordPress takes about one week this way.

Forms, spam and WhatsApp

Contact forms that send to an email address attract bots, so my fix is to move the conversion point to WhatsApp. Bots fill in website forms around the clock, mostly with sales pitches, and the messages land in your inbox. I have tried reCAPTCHA, hCaptcha and other methods. They help up to a point, but some clients still get 5 to 10 spam emails or more a day, especially on info@ addresses. The reverse happens too: a real enquiry can disappear into the spam folder and never be seen.

On my own site I switched the conversion point to WhatsApp and I have not been spammed so far. It costs the visitor a few extra clicks, but clients who made the same switch have seen higher quality enquiries, because someone willing to take those extra steps is genuinely interested.

It is not right for every business. Someone has to be available to answer on WhatsApp, and visitors who prefer email have fewer options. Form spam is also not unique to WordPress; any site with an email form can get it.

What switching costs

Pricing is case by case, but for sites I have already built, moving to this setup starts at around $250 and takes about 5 working days.

The honest trade-offs

No drag and drop. WordPress was built around it; this setup was not.
More code. That is extra work on my side, and bigger layout or structural changes go through me.
The admin does what we agreed. Anything extra is a conversation and a scope, not a plugin install.
Email costs per mailbox. Zoho is a recurring charge that grows with your team.
Free plans have limits. Supabase pauses idle free projects, and Vercel’s free plan is not for commercial sites.

Is it right for you?

It suits you if you can name the handful of things your team updates, such as products, blog posts or stock, and you want reliable email, a fast site and low running costs. WordPress may still suit you better if you want to redesign pages yourself by dragging blocks around, without a developer.

The short version

This is easier. Fewer moving parts, email that works, an admin built for your team and a site that costs little to run.