The tools
I actually use.

Default for anything WooCommerce, membership, or high-traffic content. GCP infrastructure, sensible PHP-worker headroom, honest support.

Best when the client already has an agency-agnostic workflow — Local, Blueprints, environments. Overkill for a brochure site.

Where I put clients who need managed WordPress on Vultr/DO/Linode without wanting a bill in the thousands.

In front of every site I care for. DNS, WAF, cache, image resizing, tunnels. The free tier is more capable than 90% of paid CDNs.

For sites without a managed WAF. Real-time IP list is worth the licence alone.

When Wordfence isn't enough — high-value targets, post-hack recovery, sites that need edge blocking.

For the fleet-scale malware sweeps. Server-side scanner beats anything running inside WordPress.

5-minute pings on every site. Basic but reliable.

For the sites where I need to see the slow query, not guess.

The one I trust for restore reliability. Incremental, off-site, staging one-click, migration one-click.

For clients already on Jetpack — piggybacks nicely.

Snapshots of the underlying droplet/server, not just the WordPress install.

Where every recovery, migration, and plugin test starts. Free, fast, and doesn't fight me.

With PHP Intelephense, ESLint, Prettier, and the WordPress hooks IntelliSense extension.

For WP-CLI, rsync, mysqldump, and the daily WordPress ops that never touched a GUI.

The single most-used tool in the stack. See the field guide for search-replace, user rotation, transient sweeps.

For inspecting wp_options autoload rows and the occasional emergency SQL.

REST API smoke tests, webhook replays, and gateway callback debugging.

My own. Wires Person / Organization sameAs into the site's JSON-LD without touching the theme.

Default SEO plugin. Cleaner schema output than Yoast, lighter DB footprint, faster admin.

Cache + deferred JS + database cleanup. The rare paid plugin that pays for itself in a week.

Lighter than Gravity Forms, better conditional logic than WPForms.

For the migrations where WP-CLI isn't an option.

Because 'we don't know why the contact form stopped emailing' is not a diagnosis anyone should have to make in 2026.

Every client on active care has my direct WhatsApp. Median first response 11 minutes.

Runbook per site. Migration notes, credentials in 1Password links, incident timelines.

Every credential. Never in a Google Doc, never in Slack.

For agencies on white-label retainers who prefer a channel to WhatsApp.

36 GB RAM. Runs three Local sites, VS Code, DevTools, and a Zoom call without complaint.

Second display. Colour-accurate enough for design review, sharp enough for 12 hours a day.

TKL mechanical, browns. Ten years on the same layout.