This is the full sequence for anyone intending to do it themselves — from nothing, to a site running reliably, to being able to recover when something goes wrong.
It is long, because skipping any stage turns into a problem later. Read it through before starting; most of these decisions are cheap to make properly and expensive to revisit.
We do this for a living, so the position should be stated: every step below is within your reach. The last section covers when doing it alone stops making sense, and that part is equally honest.
Stage 1: Decide what you actually need (half a day)
The only stage that guarantees rework if skipped.
Do not start from “I want a good-looking website”. Answer this instead: what problem does a visitor arrive with, and what do I want them to do.
The most effective method is having AI interview you until it can describe your business. This set of prompts can be pasted straight in — five groups, half an hour.
You end up with: visitor types, what each cares about, a page structure and a first draft of the home page. That is a brief, and everything else builds on it.
One check: go through the proposed structure asking which page you will not have the energy to update within three months. That page probably should not exist.
Stage 2: The domain (30 minutes, $25–40 a year)
Choosing: short, spellable, sayable. For a New Zealand business prefer .co.nz or .nz — local visitors trust them more.
Do not choose a domain for SEO. Keyword domains stopped helping well over a decade ago, and “aucklandbestplumber.co.nz” is neither memorable nor advantageous. Use your brand.
Where: any reputable registrar; prices barely differ.
The critical part: register it in your own name. Not your developer’s account, not a friend’s. Registration details are public, so search your own domain now and look at the registrant.
This sounds obvious, and a great many small businesses discover otherwise at the moment they try to change suppliers.
Turn on auto-renewal while you are there. An expired domain is among the most avoidable disasters — a few days after expiry the site is gone, and if someone else registers it, permanently.
Stage 3: Hosting (1 hour, $0 to $40 a month)
The full comparison is here. In short:
Presentation site with no logins or payments — choose static hosting. Free allowances suffice, it is the fastest option and the safest, since no running software means no software vulnerabilities.
Need an admin to edit content, or memberships or a shop — shared hosting or a VPS. Shared is cheap and low-effort, but ask about renewal pricing, where two to three times the first year is standard.
Do not choose a VPS unless someone maintains it. Its real cost is not the monthly fee but somebody’s time. An unattended VPS eventually has an incident, and is more dangerous than shared hosting, where a provider at least applies system patches.
Stage 4: Generate the site with AI (half a day to two days)
Four categories of tool, chosen by how you intend to maintain the result:
No contact with technical detail → AI features inside a site builder
Willing to learn a little, want fast iteration → prototyping tools such as Lovable or v0
Full control, comfortable with code → a chat assistant generating code you deploy yourself
The important part: feed it the brief from stage one rather than starting from “make me a nice website”. With the same tool, input quality determines output quality by a wide margin.
Control one thing during this: do not ask for every feature at once. Memberships, a shop, bookings and multiple languages in version one produces a set of features half of which sit unused a year later — and unused features are not free, since they still need updating, still produce bugs, and still need attention when a security issue arrives.
Build what you are certain you will use and add the rest when a real need appears.
Stage 5: Content (the slow part — expect it)
Half a website is content, and content arriving late is the usual reason these projects overrun.
Photography deserves the investment. In many trades conversion depends almost entirely on images, and one session lasts two or three years. Avoid stock imagery — visitors recognise it, and what it communicates is unwillingness to show the real thing.
Have AI draft the copy, with one added instruction: “afterwards, list which numbers I need to confirm”. AI invents figures — it does not know your founding year or client count and will produce something plausible. Without that instruction your website will claim things you did not know it claimed.
Publish prices if you can. Ranges with “from” are enough. Three benefits: unsuitable budgets filter themselves out, serious customers hesitate less, and when an assistant is asked what this sort of thing costs, a page without figures cannot be quoted.
Stage 6: Six checks before launch (1 hour)
None need technical background, and missing any one produces continuing loss. Details here; the list is:
1. Is the content actually in the HTML. View page source — not inspect element — and search for text you can see. Absent means it is painted in by script, and neither search engines nor AI can read it.
2. Do nonexistent addresses return 404. Add /asdfgh/ to your URL; it must be a 404. A page instead is a soft 404 and drags on the whole site.
3. Does every page have a distinct title. Check the browser tab. Identical titles leave search results indistinguishable.
4. Are images compressed. Total transfer in developer tools; over 3MB for a home page needs work.
5. How long on a phone. Throttle to slow 4G with cache disabled — that is a customer’s first visit. Over five seconds needs work.
6. Does the form actually deliver. Submit one and confirm the email arrives. Most often skipped, and a silently broken form is the most expensive failure — no enquiries arrive and you conclude nobody is asking.
Stage 7: DNS and SSL (30 minutes, accident-prone)
Full explanation here. Three rules while working:
Export or screenshot the existing records first. Old-fashioned, and the only route back from a mistake.
Watch the MX records especially. The classic accident: clearing records to reconfigure during a hosting move, setting up the website ones, forgetting mail. The site loads normally and every email to the company bounces with no indication whatsoever, surfacing days later when a customer rings to ask why nobody replied.
Use a free SSL certificate. Let’s Encrypt issues and renews automatically with identical encryption to paid ones. If someone proposes a few hundred dollars a year, ask why — an ordinary business site has no use for it.
With Cloudflare or similar, set SSL mode to Full (strict), never Flexible. The latter shows a padlock while the leg to your server travels unencrypted, which is worse than no HTTPS because it manufactures confidence.
Stage 8: The first month after launch (10–30 minutes each, all free)
1. Register Google Search Console and submit your sitemap. The only view of your site as Google sees it, and it emails when something breaks.
2. Create a Google Business Profile. Essential locally. Many people searching for a nearby service call from the map results without opening a website at all.
3. Get a few external links. Social bios, industry listings, partner sites, a local chamber. With nothing anywhere linking to you, Google has little route to finding you.
4. Make company details consistent. Name, address and phone identical across website, business profile and social accounts. While they disagree, neither search engines nor AI can confirm these are one company.
Then wait a fortnight. Indexing takes days to two weeks; ranking takes months. Do not search for yourself on day three and worry.
Stage 9: Routine maintenance (30 minutes a month)
A website is not a deliverable; it needs looking after. Neglected, it does not break — it decays.
Monthly:
Security updates for the platform and plugins, if you use something like WordPress. An unmaintained WordPress is the most commonly compromised thing on the internet.
Submit a test through your own form and confirm it arrives. Thirty seconds, guarding the most expensive failure.
Click through the main pages, particularly those you never visit yourself. Missing images, broken embeds.
Quarterly:
Check the not-indexed count in Search Console. A sudden rise usually means something broke.
Measure home page speed and write it down. Sites slow gradually — more images, more plugins, each costing a little, until a year later it takes twice as long and you adapted without noticing.
Stage 10: Monitoring (set up once, 30 minutes)
The goal is problems being found before you find them. Four items, all free:
Certificate expiry alerts. Free services email 30 days ahead. The highest-return item here — automatic renewal breaks and announces nothing, and at expiry the entire site becomes a red warning page.
Availability monitoring. Every five minutes, email on failure. Second-by-second is pointless; you are not getting up at three either way.
Search Console notifications. Useful even unread, since it contacts you about crawl problems, indexing drops and security issues.
A monthly calendar reminder to test the form.
The full list is here. The principle: monitoring that emails you is worth far more than a dashboard you must remember to open.
Stage 11: Backups (set up once, check monthly)
The most important section, because it is the only thing that works on the day it matters.
Three parts: files (code, templates, images), the database (content, settings, orders), and configuration (server settings, DNS records, scheduled tasks). Many “automatic backups” cover only the first two, and the gap appears when restoring onto a new server takes hours of reconfiguration.
Retention should be layered, not a week. Daily for recent days, weekly for recent weeks, monthly for recent months. A week of retention leaves you helpless against anything planted a fortnight ago — and that is precisely the kind you discover late.
At least one copy elsewhere. Backups in a directory on the web server are barely backups: when that server fails, is compromised or is deleted, they go with it. Compromise makes it vivid — anyone gaining access usually deletes the backups first.
The critical sentence: a backup nobody has restored is not a backup.
The usual failures are all discovered at the worst moment: corrupt archives, incomplete database dumps, configuration that no longer matches, an archive password nobody kept. Rehearse every six months — restore fully into a test environment and record how long it took. That duration is your real recovery capability.
Stage 12: When something actually goes wrong
Three severities, handled differently.
Case one: you broke it (most common)
A template edited, a plugin installed, a configuration changed. You know roughly when.
First: do not panic and do not start changing things. Further changes usually complicate the situation and make it harder to diagnose.
Second: rule out caching. Open it in a private window, or add a random parameter to the URL. A great many “it broke” reports are caching, eliminated in two minutes.
Third: undo the last change. With code in version control this is one command and returns you to precisely before that change without disturbing anything added since. Far better than restoring the whole site, which also reverses form submissions and articles from the interim.
Fourth: only then reach for a backup.
Case two: compromised
Content injected into pages, visitors redirected, or a warning from your host.
First: change every password immediately. Admin, database, FTP, hosting panel, domain registrar. Consider who else has access before you start.
Second: do not only remove what you can see. Attackers generally leave a backdoor file, so deleting the visible code returns you to the same position tomorrow.
Third: restore from a point you are confident was clean. This is why retention is layered — you need to identify which day was still clean, and it may be two weeks ago.
Fourth: update everything immediately after restoring. Otherwise the same vulnerability is used again. Almost every compromise has the same cause: something left unupdated for a long time.
If customer data was exposed, this needs professional help and may carry notification obligations. Do not assess that yourself.
Case three: the server is gone
A provider disappears, an account is suspended, hardware fails. Uncommon and it happens.
What you need: a complete off-site backup (files, database, configuration), control of the domain — straightforward if it is in your own name — and written recovery steps.
The last is what is usually missing. During an actual incident you are stressed, which is a poor moment to reconstruct technical detail. Write it now: where the hosting is, what the accounts are, where backups live, how to import the database, how to change DNS. Store it somewhere other than the website.
When to stop doing it alone
Every step above is achievable yourself. In four situations the balance shifts:
The site starts taking money or personal information. Payments and data handling involve other people’s money and privacy, and the consequences are asymmetric. Not a place to learn as you go.
You no longer want to look after it. Stages nine to eleven are continuous. If you will not spend that half hour monthly, someone should — neglect does not break anything immediately, it produces an incident while you are busy with something else.
The fifth revision starts breaking things. If changing one thing breaks another, the structure has come apart and adding to it will not help. Rewriting is usually cheaper than continuing to patch.
The business it carries can no longer absorb mistakes. Two hours down while experimenting is fine; two hours down when it takes your orders is a different matter entirely.
Keep the record
Throughout this, the conversations you had with AI — how requirements were settled, why things are arranged this way, which alternatives were rejected — tidy them up and keep them.
Returning in three months, you will not have to reconstruct your own reasoning. And if the work is ever handed on, that record is worth more than the site itself — what a new person most needs is not what it is, but why it is that way.
We welcome clients who arrive with their own version. The problems already hit and the requirements already settled carry straight across, and that stage moves far faster than starting from nothing.