Keeping It Simple
There's a certain similarity between building miniature scenery and building a website. It's tempting to keep adding features and complexity, but sometimes the best results come from knowing what to leave out.
I want this website to be somewhere you can comfortably browse my work, discover new creations and find information without unnecessary distractions. Just as importantly, I want it to be safe and reliable.
When not making miniature worlds, I've spent many years working in cyber security. Much of my time is spent understanding how systems are attacked, identifying vulnerabilities and protecting against an ever-changing range of cyber threats. I use the skills and experience I've gained there to help keep this website secure.
One of the most important lessons I've learnt over the years is that complexity is often the enemy of security.
Less Software, Fewer Risks
Many websites use content management systems such as WordPress. These are powerful and convenient platforms, but they rely on additional software, databases and plugins that need regular maintenance and security updates.
For this website, I've taken a simpler approach.
It's built using plain HTML and CSS.
There's no WordPress, no PHP, no database and no collection of plugins running in the background. Instead, the website consists of static pages that your browser simply downloads and displays.
From a security perspective, this significantly reduces what we call the attack surface — the number of potential weaknesses that someone might exploit.
For you, the benefit is a website that's straightforward, quick to load and less dependent on complicated software that could introduce security problems.
That's not to suggest WordPress is inherently insecure. Properly maintained, it can be very secure. However, I prefer not to introduce unnecessary technology when a simpler solution does the job just as well.
There is a trade-off, of course. Without a content management system, updating the website and adding new content takes a little more work. But it's a compromise I'm happy to make. For me, the security benefits of keeping things simple outweigh the additional effort involved.
A recent security incident, as I write this (late October 2026), provides a good example of why I've taken this approach. A pair of serious vulnerabilities in PHP — the software that runs quietly behind a great many websites — came to light, nicknamed PHP2Shell. Left unpatched, they could let an attacker run their own code on a vulnerable server, and exploitation began almost immediately, in some cases before the official fix had even been released.
Because this website doesn't use PHP, it simply wasn't exposed to those particular vulnerabilities. There was nothing to patch or fix. That's the quiet advantage of a simpler site: whole categories of risk don't apply in the first place.
Of course, no website is completely immune to security threats. The hosting environment still needs maintaining, administrative accounts need protecting and security settings need reviewing. But keeping the underlying technology simple helps reduce the risks.
Shopping and Secure Payments
You might have noticed that when you click on the Shop link, the website address changes to SumUp. This is entirely intentional.
Rather than building and maintaining my own online shopping and payment system, I use SumUp, an established payment services provider, to handle the online shop and checkout process.
SumUp complies with the Payment Card Industry Data Security Standard (PCI DSS), an internationally recognised set of security requirements designed to protect payment card information. By using a specialist payment provider, I don't need to collect or store your card details on my own website.
For you, it means a straightforward checkout process, with your payment details handled securely by an established payment provider.
An Extra Layer of Protection with Cloudflare
I also use Cloudflare, a global network that helps keep websites secure, reliable and fast.
Cloudflare acts as a protective layer between you and the website, helping to identify and block malicious traffic before it reaches the server. This includes protection against Distributed Denial of Service (DDoS) attacks, where attackers attempt to overwhelm a website with enormous amounts of traffic, potentially making it unavailable to genuine visitors.
Cloudflare also supports secure, encrypted HTTPS connections, helping protect information as it travels between your browser and the website.
There's a performance benefit, too. Cloudflare can deliver cached website content from servers around the world, helping pages load quickly wherever you're visiting from.
Much of this happens quietly in the background, which is exactly how I think website security should work. You shouldn't have to think about it when you're simply browsing.
A Final Thought
No website can ever be guaranteed to be completely secure, but that doesn't mean security should be an afterthought.
Ultimately, I want you to be able to enjoy exploring the miniature worlds I create, and purchase anything that catches your eye, without worrying about the technology behind the website.
Sometimes the best security feature is the one you never needed to install.