Astro
Astro is a website framework that builds every page into a finished HTML file ahead of time, so a visitor downloads a complete page rather than waiting for a server to assemble one on request. It suits marketing sites, brochure sites, and any business site whose visitors do not need to log in.
The practical difference shows up in two places. Pages load close to instantly, because there is no database query and no server-side code running between the click and the content arriving. And there is far less to attack, because a static file has no admin login, no plugin ecosystem, and no PHP runtime sitting behind it waiting to be exploited.
Astro is the default recommendation for new Shadowtek builds when a client-managed CMS is not strictly required. This website runs on it.
Cloudflare Pages
Cloudflare Pages is a hosting platform that stores a website's files across Cloudflare's global network and serves each visitor from the location physically nearest to them, rather than from a single server sitting in one country. It is built for static sites rather than for running application code.
For an Australian business with customers overseas, or a site that occasionally takes a traffic spike, this removes the single point of failure. There is no origin server to overload, and no extra distance between a visitor in Perth or Auckland and the page they asked for. Cloudflare operates in more than 300 locations worldwide.
All Shadowtek Astro builds deploy here. Hosting is $10 per month standalone, or included in Astro Site Management from $40 per month, which adds WAF, SSL, DNS, and uptime monitoring as well.
Cloudflare WAF
A Cloudflare WAF (web application firewall) is a filter that sits between your website and the internet, inspecting every incoming request and blocking the ones that match known attack patterns before they ever reach your server. It runs on Cloudflare’s network rather than on your hosting.
It stops the attacks that routinely take small business websites offline: SQL injection, cross-site scripting, brute-force login attempts, and traffic floods. Because the filtering happens at the network edge, malicious traffic is dropped before it consumes your server's CPU or memory. A site under attack stays fast for real visitors instead of slowing to a crawl or falling over entirely.
Shadowtek configures a WAF on every site it builds or hosts, on Cloudflare's free plan, and offers the same hardened ruleset as a standalone product for sites hosted elsewhere.
Core Web Vitals
Core Web Vitals are three measurements Google uses to score how a real visitor experiences a page: how quickly the main content appears, how fast the page responds to a tap or a click, and how much the layout shifts around while it is still loading.
They matter for two separate reasons. Google uses them as a ranking signal, so poor scores quietly cost you visibility. More importantly they measure genuine frustration: a page that jumps while you are reading it, or ignores your first tap, loses people regardless of what any search engine thinks of it.
On a Shadowtek Astro build these scores are a consequence of how the site is constructed rather than something tuned afterwards, because there is very little JavaScript competing to block the page in the first place, and nothing for the browser to wait on.
DDoS mitigation
DDoS mitigation is the practice of absorbing or filtering a flood of junk traffic aimed at knocking a website offline, so that genuine visitors keep getting through while the attack is running. A distributed denial of service attack works by volume rather than by exploiting any particular flaw.
These attacks do not need to be clever, only large. Most sites that get hit were never targeted personally: they were caught in an automated sweep looking for anything that falls over. A small business site on shared hosting can be taken down by traffic volumes that a large network barely registers, which is why the defence has to sit upstream of the server.
Every site Shadowtek builds or hosts sits behind Cloudflare's network, which absorbs this traffic at the edge. This is standard on every plan, not an upsell.
Discovery sprint
A discovery sprint is a short, paid scoping engagement that establishes what a piece of custom software actually needs to do before anyone quotes a price to build it. The client comes away with a written technical specification, a recommended architecture, and a fixed-price quote.
It exists because a number given before anyone understands the problem is a guess, and guesses are how software projects end up at double the price and six months late. Half a day mapping what the software has to do, who uses it, and what it connects to removes most of that risk before any money is committed to a build.
Shadowtek charges $1,440, credited in full against the build if the client proceeds. If they do not, they keep the specification and the quote and are free to take them to another developer.
Headless WordPress
Headless WordPress is a setup where your team still writes and edits in the familiar WordPress admin, but visitors never load WordPress itself. The content is pulled out through an API and rebuilt as static pages, which are then served from a global network rather than from your web server.
It resolves the trade-off that normally forces a choice between a CMS your team can actually use and a site that is fast and hard to attack. Editors keep the interface they already know. The public site has no login page, no plugin surface, and nothing executing per request, so the usual WordPress attack routes simply are not there.
Shadowtek builds this as Headless WordPress plus Astro, from around $5,000 depending on scope and how much existing content needs migrating across from the current site.
Imunify360
Imunify360 is server-level security software that scans for malware, blocks known attack patterns, and quarantines infected files across every website on a server. It works independently of what any individual site has installed, because it runs beneath the sites rather than inside them.
That distinction from a WordPress security plugin is the whole point. A plugin runs inside WordPress and can only see WordPress, which means a compromise that reaches the file system can often disable the very thing meant to catch it. Imunify360 sits below the site, so it keeps working when the site above it has already been breached.
It runs on all Shadowtek managed hosting alongside CloudLinux account isolation, which stops one compromised site on a server from reaching its neighbours. Patchstack monitoring for known plugin vulnerabilities runs alongside both of them.
Interaction to Next Paint (INP)
Interaction to Next Paint (INP) measures how long a page takes to visibly respond after someone taps, clicks, or types. It became one of Google’s Core Web Vitals in March 2024, replacing First Input Delay, and it is measured across the whole time a visitor spends on the page.
The replacement matters more than it sounds. First Input Delay only measured the pause before the browser began handling your very first interaction. INP measures every interaction, end to end, until the screen actually updates. Plenty of sites that comfortably passed the old measurement fail the new one, because the problem was never the first click.
The usual cause is JavaScript competing for the browser thread. Astro ships no JavaScript by default and Shadowtek adds it only where a component genuinely needs it, which is why INP is rarely the problem on these builds.
LiteSpeed
LiteSpeed is a web server, the piece of software that receives a request for a page and returns it. It replaces Apache on a WordPress host and serves cached pages substantially faster, particularly when a number of visitors arrive at the same time.
The difference is smallest when a site is idle and largest at exactly the moment it matters: a mention that sends real traffic, a campaign landing, a busy trading period. A server that handles concurrency badly turns a good day into a slow site, and slow sites lose the visitors that the good day brought in.
Every Shadowtek managed WordPress hosting plan runs LiteSpeed rather than stock Apache, with its caching layer configured as part of onboarding rather than left for the client to work out. Hosting starts at $20 per month.
Static site generation
Static site generation is the practice of building every page of a website once, at publish time, rather than assembling it fresh for each visitor. The result is a folder of plain HTML files that any server or content network can hand out without running code.
This is what makes the security difference structural rather than additive. On a conventional site you bolt on a firewall, a malware scanner, and a login protection plugin to defend the moving parts. With static generation there are no moving parts on the public site: no database to inject, no admin endpoint to brute force, and no server-side code to exploit in the first place.
Every Shadowtek Astro build is generated this way and deployed to Cloudflare Pages, which is why these sites carry no plugin vulnerability risk at all.
WordPress health check
A WordPress health check is a full audit of an existing site covering security, performance, database condition, and code quality, carried out before anyone takes on responsibility for maintaining it. It establishes what condition the site is actually in rather than what it appears to be from the front end.
It exists because inheriting an unknown site means inheriting its problems. Sites arrive with abandoned plugins carrying known vulnerabilities, database tables bloated by tools removed years ago, and customisations nobody documented. Committing to maintain that without looking first is how a maintenance plan turns into an emergency in month two.
Shadowtek charges $375 one-time and requires it before maintaining any site it did not originally build. The output is a written report with a prioritised remediation plan, which the client keeps regardless of what they decide to do next.