All the sites on our main hosting platform were patched by 2:44pm on Thursday 22 October, less than 14 hours after the fix was released, and they were protected by temporary measures for most of the time in between. Sites with our other hosting suppliers were patched over the following weekend. Here’s what happened, what it cost our clients in the meantime, and the question every business owner should be able to answer about their website after a week like this.

What actually happened

On Tuesday 20 October (US time), the PHP security team gave advance notice of a release fixing two vulnerabilities, both rated 9.2 out of 10 for severity. Details leaked online within hours, and the fix arrived on schedule at 14:00 UTC on Wednesday 21 October. In Australia, that was 1am Thursday.

The two flaws, CVE-2026-109618 and CVE-2026-109619, allow what’s called unauthenticated remote code execution. In plain terms, an attacker could run their own code on your web server without logging in to anything. That’s about as serious as website vulnerabilities get. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP’s own release notes didn’t soften it.

“There are no complete mitigations, updating is the only safe choice.” PHP release notes, 21 October 2026.

Why updating WordPress didn’t help

It’s worth understanding how a website is put together, because it explains why this one caught people out.

A WordPress site is a stack of layers. At the bottom is the server, run by your hosting provider. On top of that sits PHP, the programming language that does the work every time someone loads a page or submits a form. WordPress runs on PHP, and your theme and plugins run on WordPress.

Most website maintenance conversations focus on the top layers: WordPress core updates and plugin updates. Those matter, and they’re where most WordPress security problems come from. But PHP2Shell sat a layer below. As Wordfence pointed out in their analysis, updating WordPress, a plugin or a theme doesn’t update PHP. Your site could have looked perfectly up to date in the WordPress dashboard and still been exposed.

There’s a second catch that’s easy to miss. Installing the patched PHP version isn’t the end of it. Wordfence’s advice was to restart every PHP worker after updating, because processes that are already running keep using the old code until they’re restarted. A server can report the new version and still be serving pages with the vulnerable one.

What our hosting partner did overnight

Our main hosting supplier, which looks after the majority of the sites we manage, didn’t sit and wait for the patch. They posted their first notice at 2:04pm on Wednesday, half a day before the release. By 4:31am Thursday, following the PHP Foundation’s recommended advice, they had extra protections in place across their shared and managed servers, restricting form submissions and file uploads.

That sounds drastic, and it was. Enquiry forms, quote requests and anything with an upload field were affected for around ten hours, most of them overnight and early morning. In practice, only a very small number of our clients noticed their forms playing up during that window. But even if more had, it was the right call. The attack traffic Wordfence recorded was aimed at the part of PHP that processes form data and file uploads, so closing that door bought time until the proper fix could go on.

The rest of the morning was the slow part. Their platform vendor confirmed patches at 9:40am, the first patched builds were being tested by 11:16am, and the rollout across all servers was under way by 1:15pm. At 2:44pm the patches were on, the restrictions came off, and that was that.

A few hours without contact forms is an inconvenience. A compromised server is a very different conversation.

I’ll admit a morning without enquiry forms isn’t nothing for a business that depends on them. But weighed against someone running code on your server, it’s an easy trade to make.

How serious did it get?

So far, the news is reassuring. Wordfence, which protects more than five million WordPress sites, reported no confirmed compromises from these flaws as of 22 October. They put that down to how complex the exploit is to pull off.

That’s not the same as nobody trying. Wordfence’s firewall blocked more than 74,000 exploit and probing attempts in the first few days, climbing from around 1,200 on 20 October to more than 44,000 on 21 October as the details spread. Proof-of-concept exploit code is now public, which means the attempts will keep coming and get more refined. Any server that still isn’t patched is a target, and will stay one.

Closer to home, we’ve seen no evidence of any issues across the 300 websites we host, beyond those few form hiccups on the Thursday morning.

The question to ask about your website

Because PHP2Shell made the mainstream news, something happened last week that I haven’t seen before in over 25 years of doing this. I’ve never had so many clients check in about a security issue. Nearly every message came down to the same two questions: are you on top of it, and were we affected?

That’s exactly the right instinct, and I was glad to be asked. It also showed me how few business owners know the answer without picking up the phone. Every business owner should be able to answer the question underneath it for themselves: who is responsible for patching the server my website runs on, and how fast do they move?

For a lot of businesses, the answer is “not sure”. The website was built by one company, it’s hosted by another, someone in the office logs in to update plugins now and then, and nobody’s ever been asked to own the server layer. That gap is exactly where an event like PHP2Shell does its damage.

Here’s what to check, or to ask your web team:

• Which PHP version is your site running? In WordPress, go to Tools, then Site Health, open the Info tab and expand the Server section. The official fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. One catch: some hosting platforms apply the fix to the version you already have, so a patched server can still show an older number. Our main host is one of them. If your number looks old, ask your host before you panic.
• Who updates PHP on your server? On shared or managed hosting it’s usually the host. On a VPS or your own server, it’s whoever manages it. If that’s nobody, it’s you.
• Were PHP workers restarted after the update? It’s worth a direct question to your host or developer.
• Is your site on an unsupported version? PHP 8.1 and older don’t receive official security fixes. Some hosting platforms, including ours, backported this fix to versions as old as PHP 5.2, but that’s a favour from your host, not something to plan around.
• Is PHP 8.2 on your radar? It reaches end of life on 31 December 2026, only a couple of months away. Moving to a newer version needs compatibility testing, so now is the time to plan it.

Speed is now part of the service

We’ve been building and looking after websites since 2000, and one pattern hasn’t changed much in that time. The serious problems rarely come from the layer everyone’s watching. They come from the layer nobody owns.

What has changed is the pace. This vulnerability went from advance notice to leaked details to public exploit code in a couple of days. The window between a fix being released and attackers testing it against real websites is now measured in hours. A maintenance plan that checks in once a month was built for a slower world.

That’s the competitive point for business owners. Your website takes enquiries while you sleep, and its security can depend on someone acting quickly at 1am on a Thursday. The businesses that came through last week without a problem had someone who owned the whole stack, and a hosting partner willing to make an unpopular call overnight.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name given to two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. Both are rated 9.2 out of 10 and can allow an attacker to run code on a web server without logging in. They affect PHP itself, so they apply to WordPress sites and most other PHP-based websites.

Does updating WordPress fix PHP2Shell?

No. The vulnerabilities are in PHP, the language WordPress runs on, not in WordPress, plugins or themes. PHP has to be updated on the server to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a patched build from your host), and PHP workers restarted, before a site is protected.

How do I check which PHP version my WordPress site uses?

In your WordPress dashboard, go to Tools, then Site Health, open the Info tab and expand the Server section. If you can’t see it or aren’t sure what the number means, ask your hosting provider or web team. Some hosts patch the version you already have, so the number alone won’t always tell you whether the October 2026 fix has been applied.

What if my site is on PHP 8.1 or older?

PHP 8.1 and older versions no longer receive official security fixes from PHP. Some hosting platforms backported this fix to older versions, but you can’t count on that next time. The safe path is upgrading to a supported version, which needs compatibility testing of your theme and plugins first. PHP 8.2 also reaches end of life on 31 December 2026.

Not sure who’s looking after your server?

If you don’t know which PHP version your site runs, or who’s responsible for patching it, we’re happy to check. Our website support, security and maintenance service covers the whole stack, not just the plugins. Get in touch with the team and we’ll tell you where you stand.

The post PHP2Shell: What Last Week’s Critical PHP Update Meant for Your Website appeared first on HyperWeb.

Whichever way it lands, the website is the smallest part of the decision. What decides whether a winery does well online is the club, the stock, and whether those two talk properly to the shop, the cellar door and the back office. Sort those out and the platform question mostly answers itself.

We’ve built winery sites on both platforms for years, most recently Mitolo Wines in McLaren Vale. Here’s what we’ve learned doing it.

What did the WooCommerce builds actually involve?

Our experience went from simple stores in the early 2000s to custom WooCommerce work. For Tyrrell’s and De Iuliis Wines we built a wine club platform with allocations and pre-orders, then wired it into NetSuite for warehousing and shipping, and into Mailchimp or Klaviyo for member communications.

That’s the real job. A wine club isn’t a subscription box. Members hold allocations, allocations have rules, releases open in waves, and a pre-order has to reserve stock that doesn’t exist yet without letting the warehouse ship it early. Every one of those rules had to be written, tested and maintained by us.

Woo did the job, and did it well. But every clever thing we built was a thing we owned forever.

Why did we start building on Commerce7?

Mercer Wines was the first. A small winery moving off WooCommerce onto Commerce7, while keeping their WordPress front end. Since then we’ve built on Commerce7 for Mitolo Wines, Glenarty Road, Amato Vino, Koonara Wines and Thistle Meadery, across the Hunter, McLaren Vale, Margaret River and Barossa wine regions.

The reason is simple enough. Commerce7 was built for wineries. Clubs, allocations, tastings and cellar door point of sale live in the one system, and the club logic that we used to write by hand is just there. Less custom code to maintain means fewer things to break at 6am on a release day.

What does a Commerce7 build on WordPress look like?

Mitolo is the clearest example. We rebuilt the site in WordPress with Commerce7 running the shop, the wine club and gift cards behind it. They asked us to keep their existing look and feel, so we did.

That matters, because most replatforming stories go the other way. A winery changes systems, the website gets dragged along, and customers land on something they don’t recognise a week before a release. Same site their customers already knew, different machinery underneath.

So which one, WooCommerce or Commerce7?

The feature tables won’t settle it. What settles it is how you run.

Commerce7 wins when the club is the business. If members, allocations and cellar door sales are the operation, Commerce7 is usually the better fit, because the club and the point of sale run off the same customer record. Woo has no equivalent. The club logic is native, and there’s less bespoke code sitting between you and your own data.

WooCommerce holds its own when the shop is the business. If you’re mostly selling wine online, with a light club or none at all, Woo gives you total control of the build and no per-platform subscription sitting on top. It’s also the sensible answer when you’ve already got working integrations you don’t want to rebuild. If your warehouse and accounting are wired into a WooCommerce store that’s been running fine for five years, moving platforms means rebuilding all of that to get back to where you already are.

What’s harder about each?

Both have a cost, and it’s worth being clear about them before you sign anything.

Commerce7 is a hosted platform, so the usual platform economics apply. There’s a subscription. And it has its own way of doing clubs, so your processes fit into it rather than the other way round. The front-end integration is also real development work, not a plugin you switch on. That’s the part people underestimate. It’s why we build a custom WordPress front end on ours. You keep full control of page speed, SEO and the brand experience, and Commerce7 does what it was built for behind it.

With WooCommerce, the flexibility costs you later. Everything clever is custom, custom code needs maintaining, and each plugin you add is another thing that can break on update. The day-to-day cost lands on your team too: the admin wasn’t designed for a cellar door crew doing customer service, and managing club orders through it takes patience or custom admin work. It’s one of the reasons club-heavy wineries end up moving.

What hasn’t changed?

More than ten years of these builds and the pattern holds on both platforms. The wineries that do well online are the ones with clean stock data, a club their team actually understands, and systems that talk to each other properly.

Get the club, the stock and the integrations right and the sales tend to take care of themselves. That was true on WooCommerce ten years ago and it’s true on Commerce7 now.

Frequently asked questions

Should my winery use WooCommerce or Commerce7?

If your business is club-first, with allocations, releases and a cellar door, Commerce7 is usually the better fit because that logic is built in rather than built by hand. If you’re shop-first, with heavy custom integration into systems you already run, WooCommerce can serve you better and gives you more control. Both need the same discipline about stock data and integration, and that discipline matters more than the platform choice.

Can we move to Commerce7 without changing how our website looks?

Yes. That’s the pattern we used for Mitolo Wines and Mercer Wines: Commerce7 runs the shop, the wine club and gift cards behind a custom WordPress front end. Customers see the same site they already know. The machinery underneath changes.

Does Commerce7 work with WordPress?

Yes, through a custom front-end integration. Commerce7 handles the commerce, the club and the customer records, and WordPress handles the site your customers see, with the two connected so that products, club sign-ups and checkout behave as one experience. It’s development work rather than a plugin install. We’ve written about what that kind of work involves in what CRM integration actually involves.

What systems does a winery website need to talk to?

Usually four. The club or CRM that holds members and allocations, stock and warehousing, the email platform for member communications, and the cellar door point of sale. On our builds that has meant NetSuite for warehousing and shipping, Mailchimp and Klaviyo for email, and Commerce7’s own club and POS. The question to ask about any of them is which system wins when two of them disagree.

Weighing it up?

If you run a winery and you’re deciding between WooCommerce and Commerce7, we’re happy to talk it through and give you an honest read on which fits how you actually operate. No pitch, just a conversation about your club, your stock and what’s already working. Get in touch with the team, or have a look at how we approach winery web design.

If you want more of the background first, our post on what CRM integration actually involves covers the wider integration picture. How much a website costs in 2026 explains why builds like these are priced the way they are. And there’s a broader platform view in our piece on moving to eCommerce in 2026. If you’re looking further ahead, agentic commerce covers what changes when AI agents start doing the buying.

Brendan Brooks is Founder and Managing Director of HyperWeb, a Newcastle web development and digital marketing agency building for Australian businesses since 2000.

The post WooCommerce or Commerce7? What We’ve Learned Building Winery Websites appeared first on HyperWeb.

That last part is the point of this post.

Most businesses think of their website as a description of what they do. Services, team, testimonials, contact form. That model is so common we barely notice it, and for plenty of organisations it’s enough. But it quietly sets a ceiling: the website tells people about your work, and then humans do all of the actual work behind the scenes.

The platform we recently built for the Hunter Melanoma Foundation breaks that model, and it’s a useful case study in what becomes possible when you stop asking “does our website describe us well?” and start asking “what could our website actually do for us?”

A mission bigger than the headcount

The Hunter Melanoma Foundation is a registered charity working to reduce the impact of melanoma in a country with some of the highest skin cancer rates in the world. Its SWAP program, the Sun Safe Workplace Awareness Program, targets the people who carry a disproportionate share of that risk: outdoor workers. Construction crews, landscapers, road workers, trades. People whose workplace is the sun.

SWAP had been delivered in person, and it worked. But in-person delivery has a hard limit: the size of the team delivering it. The Foundation is a small charity, and the number of workplaces that need this training is enormous. Every hour spent on scheduling, paperwork and certificates was an hour not spent reaching another workplace.

The mission was bigger than the headcount. That gap is exactly what a well-built web application is for.

Not videos on a webpage

It would have been easy to treat this as a content problem: record the training, put it behind a login, done. That version gets built a lot, and it fails a lot, because delivering a real training program requires much more than hosting videos.

The Foundation needed structured courses with lessons, assessments, learner accounts and progress tracking. It needed provable completion: personalised certificates for workers and reliable records for employers, because this is workplace safety training, not casual viewing. It needed payment flexibility for everyone from a sole trader booking one course to a large employer enrolling a whole workforce. And it needed all of that to run without manual administration, because a small charity team can’t spend its week re-keying enrolment data.

One more constraint shaped everything: the audience. Outdoor workers don’t complete training at a desk. The platform had to work on a phone, in a work vehicle or a site shed, on patchy regional internet.

What we built

The SWAP training platform now lives at training.hmf.org.au, a dedicated learning management system built on the LearnDash and BuddyBoss stack within WordPress. It carries the Foundation’s brand while standing visually distinct as its training arm. In practical terms, here’s what it does:

• Delivers the courses. Structured lessons and assessments, learner dashboards, and password-protected resources like toolbox talks and workplace checklists. New courses can be added as the program grows.
• Takes the money. Stripe payments supporting one-off purchases, subscriptions, discount coupons, free courses and custom packages for larger organisations, all managed by the Foundation’s team without a developer in sight.
• Proves the training happened. Completing the final assessment generates a PDF certificate personalised with the learner’s name, downloadable on the spot and emailed automatically. Employers can run reports by course, learner or group and see exactly where their team is up to.
• Talks to the Foundation’s systems. Integrations with Zoho CRM and Xero mean enrolments, payments and contact records flow through automatically, with email notifications keeping administrators and learners informed.

Underneath all of that sits the unglamorous work that makes a platform trustworthy: security hardening around user accounts and payments, speed optimisation, responsive development, and on-page SEO from day one. We finished with hands-on training for the Foundation’s team at their Waratah premises, because a platform you can’t run yourself is a liability, not an asset.

The number that matters is zero

Here’s the outcome I keep coming back to. When a new business enrols its team in SWAP today, the administrative cost to the Foundation is zero. No forms to process, no certificates to create, no records to update, no invoices to chase into the accounting system. The platform does all of it.

That’s what lets a small charity operate with the reach of a much larger training organisation. Scale didn’t come from hiring; it came from removing the administration between the Foundation and every workplace it serves.

“Working with Brendan and the Hyperweb team has been an excellent experience. They’ve consistently demonstrated creativity in responding to our requests and have been timely and reliable in all communication. The result is a high-quality product in the SWAP training platform, which reflects their skill, professionalism, and commitment to delivering great work.”

Sue-Ellen Evans, Project Manager, Hunter Melanoma Foundation

You can read the full project breakdown in our SWAP training platform case study.

What this means for your organisation

You may not run a sun-safety charity, but the underlying question travels well: what work is your team doing by hand that your website could be doing for you?

If you deliver training, the answer might look like SWAP. But the same pattern applies to membership content, certification and compliance, client onboarding, bookings and recurring billing, gated resources, or reporting that customers currently have to email you for. In each case the shift is the same: from a website that describes the service to a web application that performs it.

A few tests we would apply to your situation, based on this build:

• Is the process repeatable? If you run the same sequence for every customer (enrol, deliver, certify, record), that sequence can almost certainly be systematised.
• Is admin the bottleneck? If growth means proportionally more paperwork, automation changes your economics, not just your convenience.
• Does proof matter? Where completion, compliance or membership status must be provable, automating the record-keeping is worth more than automating the delivery.
• Can your team run it without us? A purpose-built platform should end with handover, not dependence. If a proposal keeps the developer permanently in the loop for daily operations, question it.

To be clear, this isn’t an argument that every business needs a web application, and it isn’t an AI story either; SWAP is a learning platform, built on proven tools, doing structured work reliably. Some organisations genuinely need a well-crafted brochure site that tells the right story, and nothing more. The mistake is never asking the question, or assuming the answer requires enterprise budgets. It doesn’t.

Frequently asked questions

What is the difference between a website and a web application?

A website presents information about your organisation. A web application performs work: it handles accounts, payments, content delivery, records and reporting. The SWAP training platform is a web application, delivering an entire training program without manual administration.

How do you deliver online training with certificates from a WordPress website?

A learning management system built on WordPress with LearnDash and BuddyBoss can deliver structured courses, assessments, learner accounts and progress tracking, generate personalised PDF certificates automatically, and take payment through Stripe, including subscriptions and organisation packages.

How much does a custom learning platform cost to run day to day?

Built correctly, very little. Automating enrolments, certificates, notifications and CRM and accounting integration means each new learner adds no administrative workload. The Hunter Melanoma Foundation team runs the SWAP platform themselves, without developer involvement.

Start with the program, not the platform

The SWAP build worked because we started with the program: who the learners are, where they train, what employers need to prove, what the Foundation’s team could sustain. The technology choices followed from those answers, not the other way around.

If your organisation delivers training, membership content or certification, and the administration is holding back the mission, we should talk. Book a free initial consultation with the HyperWeb team, or browse more of our case studies to see what purpose-built looks like in practice.

By Brendan Brooks, Founder and Managing Director of HyperWeb. Brendan has spent 25 years helping organisations turn their websites into working parts of the business rather than separate islands.

The post Your Website Can Run a Program, Not Just Describe It: Building SWAP for the Hunter Melanoma Foundation appeared first on HyperWeb.

Here’s the honest answer, and it might surprise you: sometimes, yes. For some businesses, at some stages, an AI site generator or a website builder is exactly the right call. Telling you otherwise wouldn’t serve you, it would just serve us.

But “sometimes yes” isn’t the same as “always yes”. The same tools that are perfect for one business become a quiet, compounding tax on another. And AI generation, for all its speed, has quietly raised the stakes on getting this decision right. The trick is knowing which situation you’re in before you commit, not eighteen months later when you’re trying to migrate away and discovering how much you’ve built on rented ground.

So let’s do this properly. Here’s when an AI generator or a builder genuinely makes sense, when it starts to cost you, and how to tell the difference for your own business.

When the answer is genuinely yes

AI site generators have moved remarkably fast. You can now describe a business in a sentence and watch a pure-play generator like Durable or Framer, or the AI built into Wix and Squarespace, produce a complete, tidy site in minutes. For the right business, that’s a feature, not a compromise.

An AI generator or builder is often the right choice when:

• You’re testing an idea. If you’re validating a new product, service or side venture and you don’t yet know whether there’s a market, spending serious money on a custom build is premature. Generate or build something live, learn, then invest properly once the demand is proven. This is where AI generation genuinely shines: speed to a working prototype is hard to beat.
• Your site is genuinely a brochure. A handful of pages, your story, your services, a contact form. If your website’s job is to confirm you exist and look professional, these tools do that well.
• Budget is the binding constraint. If the realistic choice is an AI-generated or builder site now or no site for another year, the fast option wins. A modest online presence beats an ambitious plan that never ships.
• You have someone in-house who enjoys it. These tools are designed for non-developers. If a capable team member wants to own the site and keep it fresh, that ongoing care has real value.

There’s no shame in any of these. I’ve told prospective clients, more than once, that they didn’t need us yet, and watched them walk out without spending a dollar with us. Some came back two years later when the business had outgrown the platform. That’s the right order to do it in.

Telling you to spend money you don’t need to spend isn’t advice. It’s a sales pitch.

The real question isn’t the platform

Here’s where most of these conversations go wrong. “AI, Wix or custom?” is a tactical question, and it’s being asked far too early.

AI has, if anything, made this worse. When a usable site is one sentence and sixty seconds away, the temptation is to skip straight to “which tool?” and never ask the question that actually matters.

The decision that matters isn’t which tool to use. It’s what your website needs to do for the business: who it needs to reach, what it needs to achieve commercially, and how central it is to the way you win customers. Sort that out first and the tool question usually answers itself.

This is the same principle we apply across every engagement. Platform and tool decisions should follow purpose and people, not lead them. Decide what you’re trying to achieve and who you’re trying to reach, then choose the tool that serves it. Choosing the tool first, and bending your goals to fit its limits, is how businesses end up with a website that looks fine and performs poorly. It’s a pattern we’ve watched play out across 14 years of digital strategy, and it hasn’t changed: strategy before tactics, every time.

When it starts to cost you

This is the part the “the AI did it for free” and “it’s only $30 a month” framings conveniently leave out. The tool is cheap, sometimes free. The constraints aren’t, and they show up precisely where they’re hardest to see at the moment of generation.

The commodity trap

This is the one that’s changed most in the last year, and it’s the one most people underestimate.

AI generators are trained on the same patterns and draw from the same pool of designs, layouts and language. Feed them similar prompts and they produce similar sites. The result is a web filling up with pages that are clean, competent and almost interchangeable.

Google has noticed. Because AI lowered the barrier to producing a passable site, the search quality bar has risen to meet it. Google’s own commentary now draws a sharp line between content that shows real expertise and “commodity” content that could’ve been produced by anyone, and the latter is increasingly skipped rather than ranked. A generated site that looks like a thousand others is, by definition, commodity. It’s the digital equivalent of looking exactly like every competitor while trying to explain why you’re different.

When everyone can generate a tidy website in ten minutes, a tidy website stops being an advantage. It becomes the baseline.

Generation isn’t engineering

This is the subtle trap, and it catches sensible people. An AI generator hands you something that looks finished. That’s not the same as something that’s been engineered for a business outcome.

We’d know. We use AI heavily in our own development work, every day, and it’s made us faster and better. It’s also exactly how we know the difference between generated and engineered: AI is brilliant at the first draft, and the value sits in everything that happens after it.

A generated site is a starting point wearing the costume of a final product. The structure is generic, the copy is plausible but shallow, the images are stock by default, and the technical detail that actually drives results, things like schema, performance and considered architecture, is whatever the tool happened to produce. Looking done and being built aren’t the same thing, and the gap between them is exactly where results live.

The technical ceiling on visibility

This matters more in 2026, not less.

Being present online and being found online are now two very different things. Search has split. You’re no longer just trying to rank on Google, you’re trying to be cited by ChatGPT, surfaced by Perplexity, and pulled into Google’s own AI Overviews. We’ve written before about why Google’s authority over search now stops at its own boundary, and why the real opportunity sits in the engines it can’t speak for.

Getting cited by those engines depends heavily on technical foundations: clean, controllable structured data (schema markup), fast load times, sensible site architecture, and crawlable, well-organised content that demonstrates genuine expertise. This is the territory of generative engine optimisation, and we’ve set out exactly how to make your content citable by AI engines. Builders and AI generators give you limited control here, and AI generation adds a problem of its own: the very sameness that makes it fast is what AI engines have least reason to cite. They reward distinctive, authoritative sources, not the median of everything they’ve already seen.

You’re building on rented ground

With most builders and AI platforms, you don’t own your platform, you rent access to it. Many AI generators go a step further and keep you inside a closed ecosystem, with limited access to the underlying code. That sounds like a technicality until the day it matters.

Pricing changes, you absorb it. A feature you rely on gets deprecated, you adapt. You want to move to a more capable platform, and you discover that exporting your content, your design and your hard-won SEO equity cleanly is somewhere between painful and impossible. The switching cost is the lock-in, and it grows quietly the longer you stay.

The wall you hit when you grow

Builders and generators are designed for a common set of needs. The moment your requirements step outside that set, things get hard.

Custom functionality, a specific booking or quoting flow, deep integration with your CRM or operational systems, a content structure that doesn’t fit the template, advanced commerce logic: these are where these tools strain or simply can’t go. When Sydney University Football Club came to us, they needed live fixtures, member-only content and a sponsorship structure that earns real revenue. No template or generator could’ve delivered that, because those tools are built for the average case, and your point of difference is by definition not the average case.

Plenty of businesses have outgrown a builder eighteen months in and faced a full rebuild, paying twice and losing momentum in between. The cheap option wasn’t cheap. It was deferred.

How to tell which situation you’re in

You don’t need us to make this call. You need a few honest questions. Run your business through these:

1. How does your website earn its keep? If it’s a digital business card, a builder or generator is likely fine. If it’s a primary channel for leads, sales or discovery, the stakes change.
2. How important is being found in search and AI engines? If most of your customers come through referral or relationship, technical visibility matters less. If you need to be discovered by people who don’t yet know you, it matters enormously.
3. How likely are you to outgrow it? Be honest about your two-year plan, not just today. Building for where you’re heading is cheaper than rebuilding when you arrive.
4. How differentiated do you need to look? If credibility and distinctiveness are central to winning your customers, a shared template or a generated site that resembles every other is a constraint worth questioning.
5. Who will maintain it, and do they have the skills and the time? A capable, willing in-house owner shifts the equation in favour of a builder.

If your answers cluster around “simple, stable, referral-driven, low complexity”, a builder or AI generator may genuinely be your best value. If they cluster around “central to the business, discovery-dependent, growing, differentiated”, the cheap option is likely the expensive one. It’s worth pairing this with an honest look at where you actually stand against competitors online, because the platform decision and the competitive picture are tightly linked.

The honest bottom line

AI site generators, and the established builders like Wix and Squarespace, are good tools. For the right business at the right stage, they’re a smart, pragmatic choice, and we’ll happily tell you so.

But the question isn’t really “can we just let AI do it, or use a builder?” It’s “what does our website need to do, and will this tool let us do it, now and as we grow?” Answer that honestly and you’ll rarely choose wrong, whichever way you land.

And here’s the part worth sitting with. As AI makes the average website faster and cheaper to produce, the value of a genuinely considered, distinctive, well-built one goes up, not down. When the baseline rises, advantage moves to whatever sits above it. The businesses that win the next few years won’t be the ones who generated a site fastest. They’ll be the ones who were clear about what their website needed to do, and built accordingly.

Frequently asked questions

Can I just use AI to build my business website?

For simple sites, prototypes and validating an idea, yes, and the speed is genuinely impressive. The risk is that AI generators draw on the same patterns and produce similar, generic sites. Google now holds commodity content and templated sites to a higher bar, and AI engines have little reason to cite a site that looks like every other. For a business that depends on being found and standing out, AI generation is a strong starting point but rarely a finished, competitive website.

Is Wix or Squarespace good enough for a business website?

For some businesses, yes. If your site is essentially a brochure, you’re testing an idea, budget is the binding constraint, or you have a capable in-house person to maintain it, a builder can be a smart, pragmatic choice. The answer changes when your website is central to how you generate leads, sales or discovery.

When should a business avoid a website builder or AI generator?

When the website is a primary channel for the business and depends on being found in search and AI engines, when you’re likely to outgrow it within two years, when you need custom functionality or deep integrations, or when distinctiveness is central to winning customers. In those cases the technical and structural limits can cap your growth.

Do website builders and AI generators affect SEO and AI search visibility?

They can. Being found in search and cited by AI engines like ChatGPT, Perplexity and Google’s AI Overviews depends on technical foundations such as structured data (schema), site speed and architecture, plus genuine originality. Builders and generators limit how much control you have, and the sameness of AI output gives AI engines less reason to cite it, which can place a ceiling on visibility for businesses that depend on discovery.

How do I decide between AI generation, a builder and a custom website?

Start with what your website needs to do, not the tool. Ask how it earns its keep, how much you depend on being found online, how likely you are to outgrow it, how differentiated you need to look, and who’ll maintain it. If your answers point to simple and stable, a builder or generator may be best value. If they point to central and growing, a custom build is usually the cheaper choice over time.

If you’re weighing this up and want a straight answer rather than a sales pitch, that’s a conversation we’re glad to have. We’ll tell you if an AI generator or a builder is the right call. We’ll also tell you, with specifics, where it’ll cost you, so you can decide with your eyes open. Get in touch and we’ll give it to you straight.

The post Can’t We Just Get AI to Build Our Website? An Honest Answer appeared first on HyperWeb.

At HyperWeb, we’ve guided hundreds of businesses through this critical decision. Our experience shows a clear truth: platform selection must align with both current business needs and future growth ambitions.

The Strategic Framework for Platform Selection

WordPress: The Strategic Choice for Growth-Oriented Businesses

WordPress powers over 43% of all websites globally, not because it’s the easiest option, but because it delivers the flexibility and scalability that growing businesses need. This market dominance creates a compound advantage: extensive developer expertise, continuous innovation and proven enterprise reliability.

Strategic WordPress Benefits:

• Scalability Architecture: WordPress can handle everything from startup landing pages to enterprise-level content management systems. As your business grows, your platform grows with you, without the need for costly migrations or rebuilds.
• SEO Foundation: WordPress sites are built for search engine success. Clean code structure, optimised loading patterns and semantic markup provide immediate search benefits. Combined with our GEO (Generative Engine Optimisation) strategies, WordPress sites achieve better visibility in both traditional search and AI-powered query responses.
• Customisation Capability: Unlike template-based platforms, WordPress allows truly bespoke solutions. We create custom functionalities, integrate specialised business systems and build unique user experiences that reflect your competitive positioning.
• Community Innovation: Thousands of developers worldwide contribute to WordPress’ evolution. This means your platform benefits from continuous security updates, performance enhancements and feature innovations, protecting your technology investment long term.

Platform Diversification: Right Tool, Right Purpose

Strategic businesses often require multiple platform solutions. Our expertise spans the full technology ecosystem, so we can select the right platform for each business function.

E-Commerce Excellence: For businesses that prioritise online sales, Shopify provides conversion-optimised infrastructure and seamless payment processing. Our Shopify implementations focus on user experience optimisation and sales funnel performance, typically achieving 20-30% conversion rate improvements.

Custom Solutions: When standard platforms can’t support unique business requirements, custom development creates competitive differentiation. We build bespoke systems that integrate with existing business processes, providing operational advantages competitors can’t replicate.

Professional Website Development: The Competitive Advantage

Performance Optimisation

Website performance impacts business results. Our development methodology achieves 40-60% speed improvements through advanced optimisation techniques, caching, image optimisation, code refinement and server configuration.

This isn’t just a user experience enhancement. Google’s Core Web Vitals make page speed a direct ranking factor. Faster sites rank higher, get more traffic and convert more visitors into customers.

Mobile-First

Mobile traffic exceeds 60% across most industries. Mobile optimisation isn’t optional; it’s business critical. Our mobile-first development ensures flawless performance across all devices and protects revenue from the growing mobile audience.

Conversion Focus

Every design element serves a purpose. We implement data-driven design principles, conversion funnel optimisation and user experience enhancements that typically improve lead generation by 25-35%. Your website becomes a sales asset, not just a digital brochure.

Future-Ready Infrastructure

AI Integration and GEO Readiness

The search landscape is changing fast. AI-powered search engines, voice queries, and generative responses are redefining how customers find businesses. Our development approach includes Generative Engine Optimisation strategies that position your website for success in this AI-driven environment.

We’re not building websites for today’s internet; we’re creating digital assets that will remain competitive as search technology advances.

Security and Reliability

Professional development includes enterprise-grade security: multi-layered protection protocols, automated backups, proactive monitoring and rapid response systems. This comprehensive security approach prevents costly downtime and reputation damage from security breaches.

Scalable Growth Infrastructure

Your website infrastructure should support business ambitions, not limit them. We architect platforms that handle traffic growth, content expansion and feature additions without performance degradation or costly rebuilds.

Strategic Indicators for Platform Investment

Several indicators suggest your current platform may be limiting business growth:

• Performance Issues: Slow loading times damage user experience and search rankings, and directly impact revenue potential.
• Mobile Limitations: Poor mobile performance excludes your business from the majority of potential customers.
• Scalability Constraints: Your platform can’t support business growth plans or new feature requirements.
• Search Visibility Problems: Low organic rankings limit discoverability and lead generation.
• Conversion Challenges: High traffic but low conversion rates indicate user experience or technical issues.
• Integration Difficulties: Your website can’t connect with essential business systems or marketing tools.

The HyperWeb Advantage

Our approach combines technical excellence with strategic business thinking. We don’t just build websites; we create digital growth platforms that deliver measurable competitive advantages.

Development Methodology: Every project starts with business goal alignment to ensure technical solutions support growth objectives.

Innovation: We integrate AI tools, GEO strategies and performance optimisation to give you a first-mover advantage.

Results Focused: Our development is metrics-driven: search rankings, conversion rates, user engagement and revenue generation.

Long-term Partnership: We provide ongoing optimisation, security monitoring and strategic guidance to protect and enhance your investment.

Your Next Step

In today’s competitive landscape, your website platform choice affects everything from customer acquisition to operational efficiency. The businesses that will dominate their markets are making platform investments today.

Professional web development isn’t an expense, it’s a strategic investment that pays dividends through better search visibility, higher conversion rates, scalable growth infrastructure and competitive differentiation.

Your digital presence should be a growth engine that works for you 24/7 to support your business goals. The question isn’t can you afford professional development, it’s can you afford to not have it?

Ready to turn your website into a business asset?

Let’s talk about how our WordPress expertise, multi-platform capabilities and strategic approach can drive your business growth.

HyperWeb works with ambitious businesses to create digital platforms that deliver sustainable competitive advantage. Our approach combines technical expertise with business sense to help clients achieve growth in competitive markets.

The post Why Website Platform Selection Matters appeared first on HyperWeb.

Independence and Ownership: Building your business website on self-hosted platforms such as Shopify and Squarespace means sacrificing control to an intermediary. These platforms can change at a whim or, worse, collapse altogether. Just like you wouldn’t rely on a Facebook or LinkedIn account as your primary home online, as a business, you need total independence and control. If your business is mature or is growing, your website, too, becomes more and more of an asset. An asset you own is far more valuable than an account with a service provider. If selling your business is part of your plans, this factor is important, particularly if you are selling products online, as your self-contained website becomes an asset in the sale.

Align with your site’s goals: Before choosing the best website platform, you need to consider what you want your website to be and do. Understanding what functionality your website has to have will help narrow down the options of platforms. Developing an e-commerce website? Pick a platform that specialises in e-commerce or has easy integrations for e-commerce like WooCommerce.

Unlimited integrations: Plugins allow you to enhance your website’s functionality. You can easily incorporate features like shopping carts, contact forms, application integration, and more. It’s important to select a website platform that supports custom plugins and integrates seamlessly with popular business tools. This will empower you to automate and streamline your daily operations effectively.

Access to Customisation: Choosing a website content management system that allows you to customise the theme, design and functionality of your website is important for the right user journey. Some platforms use themes that are harder to adjust, while others allow you to customise almost every aspect of the web page with no coding whatsoever. Be careful when choosing self-hosted platforms that they don’t limit your customisable features behind steep pricing premiums. Platforms such as WordPress have unlimited web page design options and don’t limit your creativity.

SEO Features: SEO (or search engine optimisation) is the process of improving your website to increase visibility to Google and other search engines. A good website content management system has, or allows for, SEO elements to be analysed and adjusted to suit the keywords your business wants to target. Many self-hosted platforms do not allow for dedicated development access required to fully optimise a site for search engine success.

Blogging Tools: Blogging is an important feature for search visibility, creating authority, and fresh new content for your website. It allows you to share information about your business and its services, but it also allows you to share opinions and thoughts on certain topics. Make sure the website content management system you choose has an easy-to-use blogging tool that is accessible and attractive to your users.

What we recommend:

Platform systems such as Shopify and Squarespace can be useful if you are new or a start-up and you want to keep initial setup costs low. We can deliver effective solutions with these platforms within their constraints. However, we recommend WordPress because it is easy for business owners to use, and it gives businesses complete freedom and ownership of their website without being beholden to enforced platform changes. It offers this while allowing us, as website developers, the ability to develop a website designed to suit your target market. It also allows us to develop the functionality you require for your business operations without making any trade-offs or sacrifices. Basically, it is the best platform for businesses that want to make no compromises when it comes to presenting a compelling experience to their users or integrating with business operations.

If you are contemplating a new website and considering which content management system and website platform to choose, we would be happy to assess your current situation and future goals.

Interested? Contact us to book your free initial consultation.

The post Choosing the Right Website Platform for Your Business appeared first on HyperWeb.