Our Sydney WordPress projects cover design, development, performance, security, and training. Discovery and design (weeks 1-3): understanding the business and designing the website. Content strategy: what content does the site need? What is the purpose of each page? How should content be organized for both users and search engines? We create: site architecture (page hierarchy, navigation structure, URL strategy), content types (what types of content will the site have — pages, posts, case studies, team members, products, testimonials — each with defined fields and relationships), and user flows (how visitors navigate through the site to reach business goals — contact form submission, product purchase, resource download). Custom design: we design custom WordPress themes — not selecting and modifying pre-built themes. Custom design means: unique visual identity (your website looking like your brand, not like a template), purpose-built layouts (each page template designed for its specific content and purpose — a case study page is different from a service page is different from a team page), and mobile-first (designing for phone screens first, then expanding to tablet and desktop — not squeezing a desktop design onto a phone). Development (weeks 3-6): building the WordPress site. Custom theme development: built on a minimal starter theme (no bloated framework — clean, fast, standards-compliant code). We use: Advanced Custom Fields (ACF) for custom content models (each content type having exactly the fields the editor needs — no generic text editors requiring HTML knowledge), Gutenberg blocks for page building (custom blocks that match the design system — editors building pages from pre-designed components, not free-form text), responsive CSS (Tailwind CSS — utility-first CSS framework producing minimal file sizes and consistent styling), and performance-optimised front-end (lazy-loaded images, deferred JavaScript, critical CSS inlined — fast by default, not fast after optimization). Plugin selection: we minimise plugins — each plugin adding potential security vulnerabilities, performance overhead, and maintenance burden. Essential plugins only: SEO (Yoast SEO or Rank Math — configured, not just installed), caching (WP Super Cache or Redis Object Cache — configured for the hosting environment), security (Wordfence or Sucuri — firewall, malware scanning, login protection), forms (Gravity Forms — for complex forms with conditional logic, or WPForms for simple contact forms), and e-commerce (WooCommerce — if the site sells products). Custom functionality: built as custom plugin code rather than installing multiple plugins — reducing dependencies, improving security, and enabling maintenance by any WordPress developer. WooCommerce development (if applicable): Australian-configured WooCommerce — GST (10% inclusive pricing displayed as "inc. GST", GST calculated on cart and checkout, GST-compliant invoices), Australian shipping (Australia Post API for real-time rate calculation, flat-rate options for free shipping thresholds, pickup option for local Sydney customers), Australian payment (Stripe — cards, Afterpay, Apple Pay; BPAY for B2B invoicing), and WooCommerce performance (product page caching, cart fragment optimization, checkout optimization — WooCommerce-specific performance tuning). Performance optimization (weeks 5-6): making the site fast. Server-side: PHP OPcache (compiled PHP cached in memory — 3-5x faster PHP execution), object caching (Redis — database query results cached, reducing database load), page caching (full HTML pages cached — serving cached pages in <100ms vs. 500-2000ms for dynamically generated pages), and CDN (Cloudflare or AWS CloudFront — serving static assets from the nearest edge location). Front-end: image optimization (WebP format, responsive images with srcset, lazy loading — images are typically 60-80% of page weight), CSS optimization (Tailwind CSS purging unused styles — production CSS under 20KB vs. 200KB+ for unoptimized frameworks), JavaScript optimization (deferred and async loading, minimal JavaScript — many WordPress sites load 1-2MB of JavaScript that isn't needed on page load), and Core Web Vitals optimization (LCP under 2.5 seconds, FID under 100ms, CLS under 0.1 — targeting "good" scores for all three metrics). Security hardening (week 6): protecting the site. We implement: WordPress hardening (file permissions, wp-config security, XML-RPC disabled, REST API restricted, admin URL changed), login security (2FA for administrators, login attempt limiting, strong password enforcement), file monitoring (detecting unauthorized file changes — alerting if WordPress core files, themes, or plugins are modified outside of expected update processes), automatic updates (WordPress core and plugin security updates applied automatically — critical security patches within 24 hours), and backup (daily automated backups to off-site storage — S3 or similar — with tested restore process. RPO: 24 hours, RTO: 1 hour). Training and handoff (week 7): ensuring the client can manage their WordPress site. We provide: custom admin training (in-person or video — walking through every content management task the client will perform, using their actual site), simplified admin (hiding unnecessary WordPress menus and options — the client seeing only what they need, not the full WordPress admin), and documentation (a custom guide for the client's specific site — how to add/edit each content type, how to manage products, how to view analytics).