This month we rebuilt hospitalitydigitalservices.com, our company website, from the ground up. It is now plain, fast pages instead of a content management system, it was built with Claude, and it scores 100 in all four Lighthouse categories: Performance, Accessibility, Best Practices and SEO.
Here is why we did it, what we built, what the numbers say, and why it matters beyond a nice score.
Why we rebuilt it: the PHP scare
On 21 October the PHP project released security fixes for two critical flaws in the language itself, CVE-2026-109618 and CVE-2026-109619, which the industry quickly nicknamed PHP2Shell. According to Rapid7, both are rated 9.2 out of 10 on the CVSS v4 scale and can lead to unauthenticated remote code execution, which means an attacker running code on your web server without needing to log in. Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and older branches no longer receive routine updates. Google Cloud's guidance adds that patching is not enough on its own: the web server process has to be restarted too.
Our previous company site ran on WordPress, and WordPress runs on PHP. We are not saying it was attacked or that it was uniquely exposed. The point is simpler. A brochure website does not need to execute PHP on every page view, and every moving part is something that has to be patched, quickly, the next time a scare like this arrives.
If you run PHP anywhere, update to a fixed version and restart the web server process. Rebuilding a website is not a substitute for patching, and it only suits sites that do not need logins or a database.
What we built
The new site is plain HTML pages, one stylesheet, one JavaScript file, optimised WebP images and self-hosted fonts. A small generator builds every page from the content, so there is no CMS to log in to, no plugins to update and no database sitting behind the public pages.
We were honest with ourselves about one thing. PHP has not vanished entirely. A single small script still sends the contact form, so that one file, and the server it sits on, still need to be kept patched. The difference is that it is one file, not a whole application.
We also kept the addresses stable. Of the 190 pages in the old sitemaps, 170 are at exactly the same paths, and the other 20 redirect with a 301. That matters for search, because moving a site without keeping its addresses is one of the quickest ways to lose rankings.
Built with Claude
The rebuild was done with Claude, Anthropic's AI model, working from our existing content. Claude migrated the pages, rebuilt the templates and styling, generated the structured data and social share images, and wrote the tooling that audits every page for search problems and packages the site for upload. We directed the work.
The results
We ran Lighthouse 13.4.1 on the home page on 26 October 2026, emulating a desktop device. The scores:
The speed metrics behind the Performance score were just as tidy: First Contentful Paint 0.3 seconds, Largest Contentful Paint 0.4 seconds, Total Blocking Time 0 milliseconds, Cumulative Layout Shift 0 and Speed Index 0.4 seconds. You can read the full Lighthouse report as a PDF.
This is a lab test of one page on one emulated device, and scores can vary between runs. It is not field data from real visitors. Lighthouse also still lists a couple of optional suggestions, image delivery and unused JavaScript, which do not affect the score.
Why it matters
A page that appears in a third of a second and does not jump around while loading is easier to use, particularly on a phone in a busy venue. Fast, stable pages are also easier for search engines to crawl and for visitors to trust.
With no CMS, no plugins and no database behind the public pages, there is far less software that can be caught out by the next advisory. The security headers on the site, including HSTS and a strict content security policy, help in the same direction.
The new company site now looks like it belongs with this one. It uses the same navy and cyan palette, the same logo and the same look and feel as hdscloudapps.com, so a customer moving between the company site and the product site sees one brand, not two.
Every page has a unique title and description, a canonical address, Open Graph and social tags, and structured data, including Organization, WebSite, BreadcrumbList and BlogPosting markup, with FAQ and Service markup where a page needs it. There is a sitemap index and a robots file, and the site is served over HTTPS with the www address redirecting to the main one. Our audit tool checks each built page for missing or duplicate titles and descriptions, canonicals, a single main heading and valid structured data.
What we would tell another operator
Check your PHP version today, patch it, and restart your web server. Then ask whether each website you run really needs the machinery it carries. For a brochure site, probably not. For anything with logins, bookings or payments, keep the machinery, patch it quickly and watch it.
If you want to see how we apply the same thinking to hospitality technology, book a demo and we will show you the platform.