Most agencies hand a high-risk founder a WordPress theme, a page builder and a pile of plugins, then act surprised when the site loads slowly, fails a review or gets hacked. I have been building websites since 2014, and today I run Vitality Agency from Tbilisi, Georgia, for founders in DeFi and crypto, regenerative medicine, cannabis and the other industries most agencies would rather not touch.

Every site I ship now is built the same way: a React and Vite front end, every page prerendered to static HTML, and WordPress kept behind it as a headless content system. This post explains why. It is not a fashion choice. In a regulated industry your website gets read by more than customers. Payment underwriters, ad platform reviewers, compliance officers, search engines and, sooner or later, someone looking for a way in will all go through it. The build has to hold up to every one of them.

Where I’m coming from

I’m an American operator, not a theorist. From 2014 to 2018 I built websites and ran SEO for medical practices in Reno, Nevada: dental, hair restoration and plastic surgery. Medical marketing teaches you early that every claim gets read twice, once by the patient and once by someone whose job is to find the problem with it.

I founded Vitality Agency in 2018 and started our regenerative medicine division a year later, building funnels between labs, clinics and patients. On the crypto side I was an early contributor to BadgerDAO during DeFi Summer, advised Geode Finance on marketing during the raise that closed a $3M seed round led by Multicoin Capital, have hosted DeFi Expectations since 2021, and run Cheers Tickets on Base, an Ethereum layer 2. The longer version is on my about page.

Those are industries where a website can get you paid or get you shut down. That experience is the reason I build the way I do.

The stack in plain English

There are three layers, and each one has a single job.

  • The front end is a React application built with Vite. It handles the design, the motion, the forms and everything a visitor touches.
  • The pages are prerendered at build time, so every URL on the site exists as a finished HTML file on the server before anyone asks for it.
  • The content lives in WordPress, installed in its own folder and used only through its API. Clients and writers still get the editor they know. The public never sees a WordPress theme.

That split is what makes everything below possible.

Speed and Core Web Vitals

A traditional WordPress site builds each page on request: PHP runs, the database is queried, a theme assembles the HTML, and a dozen plugins add their own scripts and styles on the way out. Caching helps, but you are still shipping whatever the theme and the page builder decided to ship.

A prerendered page skips all of that. The server hands back a file that already exists. Vite bundles and fingerprints the scripts and styles, so browsers cache them properly, and nothing loads that the page does not use. Largest Contentful Paint, layout shift and responsiveness are the Core Web Vitals Google measures, and this setup removes most of what usually drags them down. I won’t promise you a score, because images, video and third-party embeds still matter. What I can tell you is that the architecture is not standing in the way of a good one.

SEO with real HTML, not a blank page

The common complaint about React sites is fair. A plain single-page app sends search engines an empty container and a script, then hopes the crawler waits around to run it. Plenty of React sites have lost rankings that way.

Prerendering fixes it. Every page and every blog post goes out as complete HTML with its own title, meta description, canonical URL, one H1, Open Graph and X card, and structured data, all in place before a single line of JavaScript runs. Blog posts live at clean addresses on the main domain, and the sitemap is generated from the pages that were actually built, so it never lists a page that does not exist. Search engines get a fast, readable page. Visitors get the full app the moment the scripts load.

Security: less surface to attack

Most WordPress hacks come in through the public side: an outdated theme, a vulnerable page builder, a forgotten plugin, the login page, or the endpoints that hand out usernames. With a headless build, the website visitors use is static files. There is no theme to exploit and no front-end plugin stack to keep patched.

The WordPress install behind it is locked down with a small site plugin I write for each project. XML-RPC is switched off, the public users endpoint is blocked, and author lookups that leak usernames are redirected. Contact forms post to a receiver with a honeypot, rate limits and length caps, and every enquiry is stored, so a mail failure never loses a lead. The install itself is kept out of search results. For a cannabis brand or a crypto project, where the site is a bigger target than average, that smaller surface matters.

Compliance-friendly content control

In a regulated industry, what the site says matters as much as how fast it says it. Because the core copy lives in the codebase and every change goes through version control, there is a record of what was published and when. Nothing slips onto a page because someone dragged in a widget.

It also means the build itself can check compliance. On Regenerative Direct, a build-time check audits every product claim before the site goes live. On Stem Cells Direct, every claim is sourced to the FDA and peer-reviewed literature. That discipline is the heart of how we approach regenerative medicine marketing: say what can be supported, cite it, and make it hard for anyone to publish what can’t.

Consent-first analytics

Privacy is not a box to tick at the end. On every site I build, a small consent script loads before anything else on the page, so its rules are in force before any tracking can run. Visitors from the EU, the UK and Switzerland start with analytics off. Anyone who declines is remembered. A browser sending Global Privacy Control is opted out of advertising signals. One analytics tag runs under those rules, not a dozen pixels fighting over the page.

That is good practice, and it is also good business. A clear privacy policy and an honest cookie notice are part of what underwriters and reviewers look at, which is why they sit at the center of our work for high-risk merchants.

A deploy pipeline that checks its own work

Every site ships through the same pipeline, one script, in this order:

  1. Build the React app and pull the latest posts from WordPress.
  2. Prerender every page and post to static HTML and generate the sitemap.
  3. Run an SEO check on every page: title and description lengths, one H1, a matching canonical, a social card at the right size and valid structured data. If anything fails, the deploy stops before a single file is uploaded.
  4. Upload over SFTP, adding and replacing files but never deleting them.
  5. Install the site plugin, then verify the live pages respond correctly and run a smoke test.
  6. Back the project up to a private GitHub repository.

The result is that every deploy is also a backup, and a broken page or a missing meta description gets caught by the build, not by a client or a crawler.

What it looks like in practice

Everything above is running on live sites today. A few from the Vitality Agency portfolio:

  • Pretty In Ink Brow Academy: a headless storefront over WooCommerce for a permanent makeup studio and state-licensed training academy, with live booking, deposit checkout, and the medical intake and consent paperwork moved online.
  • Identity Salon Suites: a leasing site for fifteen private salon suites in Reno, with a video hero, the brand’s gold eye drawn live in WebGL, an interactive floor plan, an artist directory and a headless WordPress blog.
  • Regenerative Direct: video-hero landing pages for JUVASONIC, iMRS prime, SmartPulser PEMF and Nutagen, with consultation booking and the build-time claims audit.
  • Boundless PTSP and Boundless PT Golf: sister sites for one physical therapy practice, where an SEO check on every deploy blocks any keyword the main site already targets.
  • Jobsee: a youth jobs platform launching in Wrexham, North Wales, with a 3D hero whose eyes follow the visitor and a consent-first waitlist.
  • Cheers Tickets: event ticketing settled on chain, with smart contracts issuing tickets and governing resale. If you are building in Web3, my DeFi and crypto marketing page covers how we launch.

Is this the right build for you?

Not always, and I will tell you when it isn’t. If you want a five-page brochure you rearrange every week with a drag-and-drop editor, a hosted builder will be cheaper and simpler.

This build makes sense when the site has to earn its keep: when the ad platforms are closed to you and search has to carry the load, when a processor or a compliance team is going to read every page, when you are a target, or when you simply want to own your stack instead of renting it. That describes most of the founders who find me.

Let’s build yours

If you are in DeFi, regenerative medicine, cannabis or another high-risk space and your current site is slow, fragile or one plugin away from trouble, tell me what you are building. I’ll look at what you have, tell you plainly what I would change, and show you what it would take. Contact Vitality Agency or email me at paul@vitality.agency.

Paul Jerome Thomas is the founder of Vitality Agency LLC. He builds websites, funnels and on-chain products for DeFi, regenerative medicine, cannabis and high-risk businesses from Tbilisi, Georgia.