Every site starts as pages, media and forms. Twelve modules flip on per tenant, from one toggle. A module that is off ships nothing at all: no admin tab, no routes, no JavaScript, no cron work. The same theme serves a brochure site and a webshop.
Articles and tags with scheduled publishing: set a publish date in the future and the post stays invisible until it passes. Per-locale translations, an RSS feed, tag archives and automatic "read next" from shared tags.
Products, categories, tags and tax classes, with variants when you need them: option types like size and colour produce per-variant SKU, price, stock and weight. Search page included. Useful on its own for a "featured work" grid, without any shop.
Registration with email verification, login with remember-me, password reset, and an account area with profile, password and address book. Every screen and every mail is a template your theme can override.
Anonymous and persistent carts. Each line snapshots the name and price at the moment it was added, so editing a price never rewrites somebody's open cart. Products can ask for a note per line: the text to engrave, the allergy to avoid.
Address and payment picker, cash on delivery, Mollie and Stripe with verified webhooks, receipt to the customer and a notification to your own inbox list. The order is an immutable snapshot, which is what an accountant needs it to be.
Carriers, zones and rate tables. A zone is a set of countries, optionally narrowed to postcode ranges, prefixes or exact codes, and rates go by weight and package size. Two carriers in one zone means the customer picks; cheapest is offered first.
Promo codes: percentage, fixed amount, free shipping, or buy-X-get-Y over the cheapest qualifying units. Validity window, minimum order and a hard redemption cap that is counted once, on the order that actually gets paid, and frozen onto it.
Automatic repricing with no code typed. A sale on one product or a whole category, or quantity tiers where reaching 10 reprices the entire line, not just the units past the break. Shelf, cart and till all read the same resolver.
One template plus a CSV is N published pages: five services across nine cities is 45 URLs, each with its own slug and meta pattern. The import validates every row, slug clash included, before it writes anything.
Collections backed by a media folder. Dropping a photo in the folder adds it to the gallery, and the folder order is the gallery order. Deep-linkable tabs with arrow-key navigation, and every panel stays visible when JavaScript does not load.
Double opt-in capture and campaigns that send in batches of 50 with a pause between, because a burst tanks deliverability for the whole domain. One-click unsubscribe from the mail client, which is what keeps you out of spam folders.
A Dutch plate becomes brand, model and year on a quote form, free through the RDW open register, cached per site. When the registry cannot answer, the field is a plain text input and the visitor still submits.
Enable in dependency order and the site grows a catalogue, accounts, a cart and a checkout. The pages, the theme and the URLs the client already has stay exactly as they are.
Products, categories, tax classes, variants.
Accounts, verification, address book.
Lines that snapshot price and name at add.
COD, Mollie, Stripe, receipts, orders.
A caterer with one van serves postcodes, not countries. Zones take ranges, prefixes and exact codes, and the postcode zone beats the country-wide one. Switch on "only accept orders we can deliver" and an out-of-area order is refused at checkout by name, instead of arriving and needing a phone call back.
Vouchers are typed in: percentage, fixed, free shipping or buy-two-get-one on the cheapest qualifying unit, with a cap that cannot oversell even under a re-delivered webhook. Catalog rules need no code at all: a category on sale, or a volume tier where buying 10 reprices the whole line.
Stock goes up to your bol offers, orders come down as ordinary orders you fulfil next to your own, every fifteen minutes. Your listings and your bol prices stay yours: the sync never creates an offer and never pushes a price. A dry run shows exactly what a real sync would change, having written nothing.
Six layers on every submission: per-IP and per-form rate limits, an HMAC-signed field schema, a three-second time gate, CSRF, a honeypot, and content scoring for the human-written junk that clears all five. Spam is quarantined for review, never bounced, so a false positive never tips off a spammer.
A form can take files. They are stored by content hash, and the notification mail carries signed links that expire with the retention window instead of the bytes. Type is checked on the file's magic bytes, so a renamed executable is refused whatever the extension says.
Anything you upload is converted to MP4, given a poster frame and downscaled copies, and rearranged so it starts before it has finished downloading. The player picks a size per screen and connection, and a phone can be given a still image instead of the loop entirely.
Images resize on request and are served as WebP where the browser says it can take them, with width and height in the markup so nothing jumps as the page loads. First four in a gallery load eagerly, the rest lazily, without anyone deciding it per page.
A translation is a language tab on the page you already have, so template, structure and parent stay in step. An untranslated page falls back to the default language instead of 404ing, and only genuinely translated locales are offered in the switcher and in hreflang.
Title, description, canonical, Open Graph, JSON-LD, hreflang and sitemaps are emitted for you and editable next to the page copy. A new site starts hidden from search engines, in the meta tag, the header and robots.txt, until you deliberately go live.
Accept or reject, remembered twelve months, in a dozen languages, following the visitor's locale. Bump the policy version and everybody is asked again. Statistics are first-party: server-side pageviews plus time on page, scroll depth and outbound clicks, with identifying cookies minted only after consent.
Set the Place ID and the daily sync mirrors the reviews locally. The widget renders from that mirror, never from a live API call at render time, so a rating badge in the header costs nothing and cannot slow a page down.
Snapshot and restore a tenant's content on its own. Storage is broken out per site: media, renditions, backups, attachments and every deployed theme version. Roles run from editor to super admin, login takes a passkey, and acting as another user is written to the audit log.
Send us two of your existing sites. We mirror them into a sandbox tenant with the modules they would actually use switched on, and you click around in it for half an hour.