A hacked WordPress site, replaced by
something that can't be.
Pro South Roofing is a storm-damage and insurance-claim roofer in Smyrna, Georgia, with a 5.0-star Google profile across dozens of reviews. Their WordPress site had been compromised. We replaced it with a fully static 27-page build — no PHP, no database, no plugins — with a page for every service and every Cobb County city they work.
Homepage screenshot · website-pro-south-roofing.vercel.app/ · staging URL; the client's domain cutover is pending
Eight services, eight cities, zero attack surface.
A services hub with eight pages — storm damage and insurance claims first, then replacement, repair, inspections, gutters, siding and painting — and a service-areas hub with eight city pages across Cobb County and metro Atlanta. Each city page names seven or eight real neighborhoods and carries place and radius geo schema, embedded in the page rather than spun into separate neighborhood pages.
Four real Google reviews with first-name attribution on the homepage, four project photos and four videos embedded through the privacy-friendly YouTube domain, a gallery, an about page that names the owner the way his customers do, and legal pages. Every old WordPress URL is 301-redirected.
Security is the point of this build: a content-security policy, HSTS and the full header set in the hosting config, versioned CSS and JS so a stale cache can never serve old code, and a security playbook for rotating the old host and registrar credentials at cutover.
- Python static generator (data and site modules), hosted on Vercel; versioned assets
- CSP, HSTS and hardened headers; 301 redirects from the WordPress-era URL structure
- RoofingContractor, Service, FAQPage and GeoCircle JSON-LD; robots, sitemap, llms.txt, ai.txt, security.txt
- Real reviews and AggregateRating from the 5.0-star Google profile, first-name attribution
- Form ready for Formspree or Web3Forms; the client does not run a CRM
Lighthouse performance, accessibility, best practices and SEO on the homepage, mobile emulation, measured Nov 3, 2026.
The best-practices deduction is the embedded YouTube player. The old site's score is not comparable because it was serving injected content.
Static sites do not get hacked the way WordPress does.
A compromised roofing site is not just embarrassing; it leaks spam pages into Google, poisons the brand's search results and can get the domain blacklisted during storm season, exactly when the phone should be ringing. Removing PHP, the database and the plugin surface removes the class of attack entirely. There is nothing on the server to exploit because there is no server, only files.
The same approach is why we recommend static builds to every home-service company in Central Florida that is still on a neglected WordPress install. Hurricane season is our storm season.
Want a site built this way?
Free audit for website and marketing work · ARC Rankings AI from $697/mo · No contract · USMC Veteran-Owned · BBB Accredited.