grayhealthcare.com today
grayhealthcare.com ↗
- Main content visible
- 10.4 s
- First thing on screen
- 6.7 s
- Page visibly complete
- 6.7 s
- Frozen to taps and clicks
- 50 ms
- Layout jumping
- 0.00
Overall improvement moving to Astro on Cloudflare
On a phone+21%Google Lighthouse average (out of 100): WordPress 82.8 → Astro on Cloudflare 100.0Main content appears 89% faster
On a desktop+11%Google Lighthouse average (out of 100): WordPress 90.3 → Astro on Cloudflare 100.0Main content appears 86% faster
Security
Security settings · Mozilla independent test
WordPressD-→
Astro on CloudflareA+Score 25 → 135. Checks passed: 10 of 12 → 12 of 12.Run the test yourself: grayhealthcare.com · this demo
WordPressD-→Astro on CloudflareA+Score 25 → 135. Checks passed: 10 of 12 → 12 of 12.Run the test yourself: grayhealthcare.com · this demoParts an attacker can reachWordPress15→Astro on Cloudflare0100% removed. No server code, database, admin login or plugins left to attack.
WordPress15→Astro on Cloudflare0100% removed. No server code, database, admin login or plugins left to attack.What is counted on grayhealthcare.com
- The WordPress application, running on the server for every visit
- The database behind it
- The public admin login page
- Plugins running on the server (8)
- Third-party scripts on every visit (4 outside hosts)
Overall score = the average of the four Lighthouse scores (Performance, Accessibility, Best Practices, SEO), each the middle result of 5 runs. Security: Mozilla HTTP Observatory, where 100 is full marks and best-practice settings earn extra points; tested on 8 October 2026 (raw result, live · raw result, demo).
Astro results tomorrow
this demo ↗
- Main content visible
- 1.1 s
- First thing on screen
- 1.0 s
- Page visibly complete
- 1.0 s
- Frozen to taps and clicks
- 0 ms
- Layout jumping
- 0.00
grayhealthcare.com today
grayhealthcare.com ↗- Main content visible
- 2.1 s
- First thing on screen
- 600 ms
- Page visibly complete
- 1.2 s
- Frozen to taps and clicks
- 20 ms
- Layout jumping
- 0.01
Astro results tomorrow
this demo ↗- Main content visible
- 300 ms
- First thing on screen
- 300 ms
- Page visibly complete
- 400 ms
- Frozen to taps and clicks
- 0 ms
- Layout jumping
- 0.00
Why move
Risk today, and what replaces it
The risk of staying on WordPress
- Most weak points come from plugins. Patchstack found that 91% of new WordPress vulnerabilities found in 2025 were in plugins, not in WordPress itself. Every plugin is another supplier’s code running on your server.
- Every update is an untested change. WordPress, the theme and each plugin update on their own schedules. Any update can add scripts to every page, change how pages load or clash with another plugin, so speed and layout can drop without anyone editing the site.
- Keeping it fast is a permanent job. Holding the scores means re-testing after every update, for as long as the site runs. Without that, speed can slip away unnoticed.
What we saw on grayhealthcare.com (8 October 2026)
- WordPress 7.1.3 is named in the homepage code. That is the latest release, so core is up to date today, but the version number is public and the site depends on it staying current
- 8 plugins visible in the homepage code, each updated by a different supplier on its own schedule
- The WordPress admin login page is open to anyone on the internet (the user-list endpoint is closed, which is good)
- No Content-Security-Policy header, so the browser is not told which sources may run code on the page; Mozilla Observatory grades the live site D- (25/100) against A+ for the demo
- On a first visit, before any cookie choice, scripts load from four outside hosts: Google Tag Manager, an image CDN, a script CDN and the CQC rating widget; Google Analytics and DoubleClick requests follow
Publicly visible facts from the live homepage. They show how much is exposed and maintained, not that the site has been attacked.
What Astro gives you
- Fast by design, not by tuning. Pages are built in advance and send no JavaScript unless a part of the page needs it. The scores above were measured, not promised.
- No plugins, no server code to patch. There is no database, admin login or plugin on the live site for anyone to attack.
- Speed checked before every release. Every change is tested with the same Google Lighthouse and look-alike checks shown on this page before it goes live, so speed cannot drift quietly.
What Cloudflare gives you
- DNS: the foundation. Your domain and email records run on Cloudflare’s DNS, which Cloudflare describes as “consistently measured as one of the fastest” in the world.
- Firewall in front of the site. Cloudflare’s web application firewall is available on all plans; its Free Managed Ruleset gives “protection against high-impact and widely exploited vulnerabilities”.
- Attack and bot protection, always on. DDoS protection is “always on for all Cloudflare plans”, and Bot Fight Mode on the free plan challenges known bad bots.
- One provider for the full service. DNS, firewall, delivery from data centres near every visitor, and hosting (Cloudflare Pages, which runs this demo) in one place.
Sources: Patchstack: State of WordPress Security in 2026 · Cloudflare DNS · Cloudflare WAF managed rules · Cloudflare security features (checked 30 September 2026).
What we would build for Gray Healthcare
Three layers, each doing one job
WordPress does everything in one place: pages, database, plugins, images and security. Here each job goes to a specialist, and the content layer is only added when it earns its place.
- 3. Content, when needed
Content management (CMS), digital assets (DAM) and product information (PIM)- CMS: your team edits the site. An editing workspace built around your content, with live preview: “content teams see changes instantly without waiting for builds or deployments.” Official Astro integration.
- DAM: one home for images and files. Sanity Media Library lets teams “manage assets in a centralized place… then use them across your entire organization.”
- PIM: one source for product data. Holds products, variants and their images together, and can “connect all product information from all your sources like ERPs, MDM, PLMs and unify all information in one place.”
When: Add it only when you need it: CMS if your team edits pages often; DAM for a large image and document library; PIM for a product catalogue.
- 2. WebsiteThe pages your visitors see
- Ready-made pages. Every page is built in advance, so there is nothing to assemble when a visitor arrives. That is where the scores above come from.
- No code visitors don’t need. Astro sends no JavaScript to the browser unless a part of the page needs it.
- Nothing to hack on the server. No login page, database or plugins sit behind the Gray Healthcare site.
When: Always. It replaces WordPress for the pages.
- 1. FoundationCloudflareDNS, global network, security and hosting
- Your domain’s address book (DNS). Cloudflare runs the DNS that points your domain and email to the right places. Cloudflare describes its DNS as “consistently measured as one of the fastest” in the world, and it is free.
- Served close to every visitor. Pages are delivered from a Cloudflare data centre near each visitor, not from one server in one building.
- Firewall and attack protection. A web application firewall filters attacks before they reach the site, and DDoS protection (against floods of fake traffic) is always on.
- Hosting. This demo already runs on Cloudflare Pages: no web server, database or plugins to patch.
When: Always. Every site starts here.
Vendor statements quoted from: Cloudflare DNS · Sanity and Astro · Sanity Media Library · Sanity for PIM (checked 30 September 2026).
How we measured, and exactly what is different on the Astro version
- Tool: Google PageSpeed Insights (Google's hosted Lighthouse). Each site tested 5 times per device, alternating, in the same time window; the middle result (median) is shown. Ranges: mobile 41–59 on WordPress, 100–100 on Astro.
- Test conditions: PageSpeed Insights defaults: mobile = simulated mid-range phone on slow 4G; desktop = simulated desktop on a fast connection. 5 fresh runs per URL per device (a unique #fragment on each request stops PageSpeed returning a cached result; fragments are never sent to the web server), alternating original and copy in the same time window.
- Visitor: First visit, no cookie consent given, no scrolling or clicking during the test (the same for both sites).
- Look-alike check: pass.
- What this does not show: these are lab tests, not measurements of real visitors, search rankings or sales.
Raw results: mobile WordPress: 1 2 3 4 5 · mobile Astro: 1 2 3 4 5 · desktop WordPress: 1 2 3 4 5 · desktop Astro: 1 2 3 4 5 · Re-run yourself: WordPress site · Astro version