Web and app development terms, plainly defined

Laravel is an open-source PHP framework for building web applications, client portals, back offices and online stores with custom business logic. A new major version comes out every year, with bug fixes for 18 months and security fixes for two years (Laravel, October 2026). We choose it when pricing, integrations or processes are specific to the business and a ready-made platform would need constant workarounds.

More: Laravel Development

PHP is a server-side programming language that runs the back end of a website: it builds pages, processes forms and talks to the database. It powers 70.2% of sites whose server language is known (W3Techs, September 2026), including WordPress and Laravel. Each PHP branch has a fixed support window: 8.2 stops receiving security fixes on 31 December 2026, while 8.4 is supported until 31 December 2028.

More: Upgrading an Old Laravel or PHP Site in 2026

Symfony is an open-source PHP framework built from reusable components, chosen for large, long-lived applications where several teams work on the same codebase. It trades a higher upfront cost for control and architectural freedom over the years, while Laravel trades some of that freedom for speed to market. About 23% of PHP developers use it, against about 64% for Laravel (JetBrains, 2025), and its usual database layer is Doctrine.

More: Laravel vs Symfony: The Most Expensive Technology Decision Is Often the One You Never Make

A CMS (content management system) is the software that lets a team edit a site's pages, catalogue, media and forms without touching code: WordPress, Shopify, Webflow or a custom admin built on a framework. The choice should follow how the business works, because an open-source CMS that was the right start can stop fitting once the catalogue, filtering logic and integrations grow. A clear sign of that point is marketing campaigns being designed around what the CMS allows.

More: When Does a Business Outgrow WordPress?

WordPress is the most widely used open-source CMS, running 39.5% of all websites and 58.3% of sites with a known CMS (W3Techs, October 2026). It handles pages, news and portfolios well; the trouble starts years later, when plugins carry the business logic and every routine update feels risky. Its popularity also makes it a target: Patchstack counted 11,334 new WordPress vulnerabilities in 2025.

More: When Does a Business Outgrow WordPress?

A headless CMS is a content management system that stores and edits content but does not render pages: it hands the content through an API to a front end built separately, for example in Next.js. One content source can then feed a website, an app and other channels, and the front end can change without migrating content. The price is two systems to build and maintain instead of one, so it suits projects with several channels or a demanding front end.

More: AI-Powered Web Design and AI Video Editing in 2025-2026

A website builder is a hosted service such as Wix, Squarespace or Webflow where a site is assembled from ready-made blocks for a monthly fee, typically $20 to $80. It is the right tool for a fixed catalogue, simple booking, a few service pages and basic e-commerce. A practical test: if you can describe what the site must do in the builder's own terms, it fits. When integrations and custom logic are needed, plugins and workarounds slowly turn into technical debt.

More: Custom Website vs Website Builder: What Should a Business Choose?

A technology stack is the set of languages, frameworks, databases and services a system is built on, for example Vue or React on the front end, Laravel or Node.js on the back end, PostgreSQL, Redis, Docker and Cloudflare. The stack shapes hiring, hosting and which integrations are easy or hard. It describes what a system uses, not what the business owns: code, data and accounts are a separate question.

More: What Building the Systems Teaches You About Buying Them

The front end is the part of a site or app that runs in the visitor's browser: layout, CSS, JavaScript and frameworks such as React or Vue. The back end runs on the server and holds the logic, the database and the integrations, built for example with Laravel, .NET or Node.js. The two age separately, so a site can feel old because of an outdated front end or CMS while the interface people know is worth keeping.

More: Do You Need a Website Redesign? Start With a Usability Audit

TypeScript is JavaScript with types: the code declares what kind of data each variable and function expects, and many errors are caught before the code runs. It matters most when a JavaScript product has grown too large to change safely, and the usual path is a gradual move, file by file, rather than a rewrite. Strict-mode TypeScript projects are one of the setups developers are selected for when they join a client team.

More: Hire JavaScript & TypeScript Developers

Node.js is a runtime that runs JavaScript on the server, so a product can use one language from the interface to the API and the database. It is used for anything from a simple Express API to event-driven services with message queues and WebSockets, and for serverless functions on AWS Lambda, Google Cloud or Vercel. A full-stack JavaScript developer can carry one feature through all of these layers; ours join client teams at $45 to $65 an hour.

More: Hire Node.js Developers

React is an open-source JavaScript library for building user interfaces from reusable components, maintained by Meta. Real React codebases range from Next.js projects with server components in strict TypeScript to older single-page applications written with class components. Moving such a product to server components or TypeScript is a migration in its own right, best led by someone who has done it before.

More: Hire React & Next.js Developers

Next.js is a framework built on React that adds server rendering, routing and data loading, so pages arrive as ready HTML that can be indexed and shown quickly. Its App Router and server components let a team decide what runs on the server and what in the browser. In a layered setup, a Next.js storefront can handle rendering, modular content and checkout while a separate back end, such as a Laravel core, owns the business rules.

More: Hire React & Next.js Developers

Vue.js is an open-source JavaScript framework for building interactive interfaces, often paired with Laravel on the back end. Nuxt adds server rendering for Vue pages that must be found in search, and Inertia.js lets a Vue admin sit directly on a Laravel core without a separate API. Products still on Vue 2 need a move to Vue 3, ideally carried out while new features keep shipping.

More: Hire Vue.js Developers

Angular is a complete front-end framework from Google, written in TypeScript and used mostly for large business applications and internal systems. Current Angular builds on standalone components and signals, while many companies still run older Angular 8 apps or even AngularJS, its predecessor, in daily operations. Maintaining or upgrading such apps calls for developers who know both generations, not only the latest one.

More: Hire Angular Developers

Python is a general-purpose programming language, and Django is its long-established web framework with an admin, an ORM and authentication built in; FastAPI is a newer choice for fast asynchronous APIs. Python also often lives in the scripts that hold a CRM, ERP, store and accounting together. Those scripts need what any production code needs: an owner, tests and monitoring.

More: Hire Python Developers

Server-side rendering (SSR) means the server builds the full HTML of a page before sending it, so text, links and headings are present before any JavaScript runs. Search engines and AI crawlers read such pages reliably, and visitors see content sooner, especially on slow phones. Frameworks such as Next.js and Nuxt provide it for React and Vue. On our own site the article contents are drawn on the server, so they no longer push the text down after the first paint.

More: 3D on a Live Site: Our three.js Experiment and What Google Saw

three.js is an open-source JavaScript library that draws interactive 3D scenes in the browser on top of WebGL. It powers product viewers, configurators and immersive brand pages, but a scene is heavy, so loading has to be planned. Text drawn inside a 3D canvas is only pixels to Google, which is why every heading and link should stay in normal HTML outside it. On our site, lighter loading of the 3D scenes took the home page PageSpeed score on mobile from 32 to 78.

More: 3D on a Live Site: Our three.js Experiment and What Google Saw

WebGL is the browser technology that lets a web page draw 2D and 3D graphics with the device's graphics chip; libraries such as three.js are built on it. When a device has no usable graphics chip, Chrome draws WebGL in software on the main processor, which is slow and can freeze the page. A careful site checks the renderer before loading a 3D scene and gives such devices the same text and links in a light version.

More: 3D on a Live Site: Our three.js Experiment and What Google Saw

jQuery is an older JavaScript library for working with page elements, and Bootstrap is a CSS framework of ready layouts and interface components; both still sit under many business sites. Versions matter: any jQuery build older than 3.5.0 has a documented cross-site scripting vulnerability, and Bootstrap 3 and 4, which depend on jQuery, reached end of life in July 2019 and December 2022. Updating them is rarely a one-line change, because themes and scripts are written against the old behaviour.

More: Most Companies Don't Need a New Website. They Need a New Structure.

A web application is software that runs in a browser and does work for its users rather than only showing information: a client portal, an order or booking system, an internal tool or a SaaS product with accounts, roles and data. Unlike a website, it is built around user roles, permissions and integrations. Our web application projects start from $25,000, and large products are split into stages with separate estimates.

More: Web Application & SaaS Development

A client portal is a web application where clients, dealers or members sign in and see only their own data: orders, documents, project status, invoices or requests. It replaces email threads and spreadsheets with one place both sides trust. The critical part is access: each account must be technically unable to reach anyone else's data, and automated tests should prove it. Our own portal works this way, with two-factor sign-in for the team and meetings shown in each participant's time zone.

More: Web Application & SaaS Development

An admin panel, or back office, is the internal interface where staff manage the content, orders, customers and other data behind a website or app. A good one gives each role its own view: a manager, a warehouse worker and a wholesale partner see and change different things. Its convenience decides whether the site stays current, because if adding a project or a product takes an evening, updates stop within months.

More: Laravel Development

SaaS (software as a service) is software rented by subscription and run by the vendor in the cloud, such as a CRM, an accounting tool or an e-commerce platform. It fits standardized processes and gets a team running quickly, while custom software fits capabilities that are too specific or strategic to rent; a mix of both is common. Before committing, ask what data lives there, what happens if the price changes or the service closes, and how long leaving it would take.

More: The Software Should Fit the Business

Custom software is software designed and built for one business around its own processes, data and rules, rather than configured from a ready-made product. It costs more upfront and needs ongoing maintenance, but has no per-user fees and does exactly what the business needs. It pays off only when the process gives a real advantage and can be described clearly. Typically the business owns the logic, workflows, data structures and integrations, while hosting, payments, authentication and AI models remain rented services.

More: The Software Should Fit the Business

Off-the-shelf software is a ready-made product that a business configures rather than builds, such as a packaged CRM, ERP or store platform. It is cheaper and faster to start, but licences, add-ons, implementation and customisation add up over three to five years. The sensible order is to choose the platform, learn how far configuration goes, find the real gaps, and only then decide whether they justify custom development.

More: Which CRM Is Right for Your Business? A Practical Guide to Choosing a CRM System

Salesforce is a cloud CRM platform for sales, service and marketing, and a common default choice in the US. It is not always the right one: US list prices start at $100 per user per month, and deeper customisation usually needs a certified partner. Replacing it is not the only option when it fits poorly; a custom integration layer can connect it to other systems, for example syncing orders both ways with a warehouse system.

More: Which CRM Is Right for Your Business? A Practical Guide to Choosing a CRM System

HubSpot is a cloud CRM with marketing, sales and service tools, often chosen as a lighter alternative to Salesforce. It suits, for example, a company of 20 to 50 people with a distinctive but manageable sales process. Its free tier, like Zoho's, lets a small team test the process in practice before paying for more capacity or concluding that it needs something custom.

More: Which CRM Is Right for Your Business? A Practical Guide to Choosing a CRM System

Odoo is a modular ERP that covers sales, purchasing, inventory, accounting and more in one system. Like Dynamics 365 Business Central, NetSuite or SAP Business One, it fits businesses whose purchase, stock and sale cycles are close to standard. The main risk is the business bending to the vendor's data model. Plans need a careful look: in Odoo's pricing only the Custom plan lists external API access, Odoo Studio, multi-company and external hosting.

More: ERP Development

Microsoft Dynamics 365 is Microsoft's family of CRM and ERP applications, reaching from sales and service to finance and supply chain. Because it ties into Microsoft 365, Azure and Power Platform, choosing it becomes an architectural decision rather than just picking a CRM. Its packaged ERP, Business Central, is priced per user per month on yearly terms, with a Team Members licence at $8.

More: Which CRM Is Right for Your Business? A Practical Guide to Choosing a CRM System

1C is a Russian family of accounting and business software that is still embedded in the operations of many Ukrainian companies. Ukraine has sanctioned it, in the public sector since 2017 and its developer since 2024, and it is on the open list of software prohibited for state bodies and critical infrastructure. Moving off it is a data migration project: reference data, balances and history must be cleaned and carried into a new system, and old installations may be tied to licences a new owner cannot simply inherit.

More: CRM vs ERP: What Is the Difference and Which One Do You Need?

Business process automation is replacing repetitive manual work, such as approvals, notifications, document handling and copying data between systems, with rules inside existing tools and integrations between them. Custom software is needed only where no platform fits. The best start is the single process that costs the most time or errors, and such a process can often be fixed in three to four weeks. In professional services it is typically client intake, documents, scheduling or reporting.

More: Business Digitalization

A progressive web app (PWA) is a website that behaves like an app: it can be added to the home screen, opens visited pages offline through a service worker and can send push notifications. It needs no app store review and no separate iOS and Android codebases, though iOS limits some features more than Android. For many businesses it is enough before, or instead of, a native app. Our own site is a PWA.

More: When Does a Business Actually Need a Mobile App?

Push notifications are short messages an app or a website sends to a user's device even when it is not open, used to bring people back with an update, an order status or new content. They are a strong channel in native apps, depend on the platform in a progressive web app and are limited on the regular web. Because a user can block them with one tap, they work only when each message is useful to the person receiving it.

More: When Does a Business Actually Need a Mobile App?

A native mobile app is an app built for iOS or Android with each platform's own languages and tools, such as Swift or Kotlin, and distributed through the App Store and Google Play. It earns its cost when the product needs background location, deep camera or AR features, offline-first work, biometrics in the core flow or heavy processing on the device. Apple and Google update their systems on a regular schedule, so a native app needs ongoing maintenance, not only a launch budget.

More: When Does a Business Actually Need a Mobile App?

A cross-platform app is a mobile app written once, for example in Flutter, and released to both iOS and Android from one codebase. It shortens development compared with two native apps, but rarely removes platform-specific work entirely. One Flutter developer can cover both stores. Our mobile app projects start from $30,000, and Flutter, Swift or Kotlin developers can join a client team at $45 to $65 an hour.

More: Mobile App Development

App Store review is Apple's check of every new app and every update before publication; Google Play runs a similar review. It can take from hours to days, and an update can be rejected for reasons unrelated to whether the app works, often policy and compliance rules that trip up first-time teams, so release plans need room for it. Whoever controls the developer accounts, signing certificates and recovery emails controls whether an update can go out at all, which is why that control should be mapped early.

More: When Does a Business Actually Need a Mobile App?

A backend for frontend (BFF) is a server layer built for one specific client, usually a mobile app, that gathers data from the CRM, ERP, store and other systems and shapes it into exactly what the app's screens need. It keeps the app simple and shields internal systems from direct calls. Most of a business app's complexity and cost lives in this layer and its integrations, not in the screens users see.

More: When Does a Business Actually Need a Mobile App?

Digital architecture is the way a company's systems relate to each other: which system owns which data, which one is the source of truth, how information moves and what happens when something fails. Technology choices only implement those answers. It usually spans layers: customer experience, applications, domain systems, data and integrations, and infrastructure. Good architecture isolates change, so replacing a CRM does not mean rewriting authentication, while a structure mismatched to the business cannot be optimized into fitting it.

More: Digital Architecture: How to Build a System That Can Grow With Your Business

Business logic is the set of rules a business works by, written into software: how prices and discounts are calculated, how quotes are built, who approves what and how tax applies in each market. It is the part of a system that is truly specific to the company. When a pricing model or a quoting process no longer maps to a plugin, a custom system is already being built inside the wrong constraints. Undocumented logic makes every change slower and can produce plausible but wrong numbers.

More: When Does a Business Outgrow WordPress?

A domain model is the representation in code of a business's own objects and rules: products and their attributes, prices per market, orders, customers, tax logic, price on request. It is what makes software fit the business rather than the other way round. In e-commerce the model usually splits into domains such as catalogue, inventory, commerce, customer, marketing, content and operations, each with clear boundaries, so every area can change at its own pace.

More: The Software Should Fit the Business

Modular architecture is a way of building software and sites from independent, reusable modules, business objects and interface blocks, instead of one inseparable whole. A new market, campaign or customer journey then recombines existing parts rather than requiring a rebuild. The opposite mistake is one giant custom monolith; the sound approach uses ready components where they are enough and builds custom parts only where they create a real difference.

More: How We Design E-Commerce: From Objects to Experience

A service layer is the part of an application where business logic lives, in dedicated service or action classes kept apart from controllers, forms and database queries. Validation goes to request classes, business rules to services that can be tested on their own, and controllers only coordinate. A 400-line controller that validates, calculates, queries and formats at once is a business liability, because no one can change one rule without touching all the others.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

Database schema design is planning how data is stored: which tables exist, how they relate, which foreign keys protect integrity and which indexes match the queries the application actually runs. Mistakes here are cheap to avoid and expensive to fix, because all code and integrations depend on the structure. They also hide well during development: 500 test records run fast, while 500,000 real ones expose every missing index.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

Database migrations are versioned scripts that change the structure of a database step by step, adding a table, a column or an index, with a way to roll each change back. Because they live in the code repository, every environment can be brought to the same structure and every change leaves a record. A well-kept migration history reads like a changelog of the product, while a neglected project contains edited old migrations and manual changes made directly in production.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

An ORM (object-relational mapping) is a layer that maps database tables to objects in code, so developers work with orders and customers instead of writing raw SQL for every query. Laravel ships with Eloquent, and Symfony usually uses Doctrine. An ORM speeds up development and keeps data access consistent, but it can hide inefficient queries, such as the N+1 problem, until real data volumes arrive.

More: Laravel vs Symfony: The Most Expensive Technology Decision Is Often the One You Never Make

The N+1 query problem is a performance flaw in which code loads a list with one database query and then runs one more query for each item in it, for example one query for 100 orders and 100 more for their customers. With test data it is invisible; with real data and concurrent users the page slows down sharply. It is usually fixed by loading related data in advance (eager loading), and it tends to appear together with missing indexes and repeated calculations.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

Queues and background jobs let an application hand slow, non-urgent work, such as sending emails, building reports or calling an AI model, to a separate worker and answer the user at once. The result appears a little later instead of making the visitor wait or the request time out. AI requests that take several seconds make a queue close to mandatory. A proper setup also makes failed jobs visible and retryable, so nothing disappears silently.

More: An AI Project Stuck on a Legacy System? Upgrade First, Then Automate

Scheduled tasks, or cron jobs, are commands a server runs automatically on a timetable: nightly imports, sitemap builds, reminder emails, data syncs. Nobody sees them run, so they are easy to forget. In an undocumented system, critical cron jobs are among the first things a new developer has to discover, and they can fail silently; one was found running from a forgotten folder on an old server. A list of them with their owners belongs in the project documentation.

More: Your Website Doesn't Fail When Your Developer Leaves. It Fails Years Earlier.

An API (application programming interface) is a defined way for two systems to exchange data and commands, for example a store sending orders to an ERP. It does not decide who owns the data, what it means, when to sync or what happens if a sync fails; those are architecture decisions. Modern systems expose their data through APIs, so an AI feature or a partner can request exactly what it needs, while older ones rely on exports and nightly scripts. Every API is also a security boundary.

More: Digital Architecture: How to Build a System That Can Grow With Your Business

API versioning is releasing changes to an API as numbered versions, so connected systems keep working on the old version until they are updated. Providers retire old versions on a schedule, which means every integration has a maintenance clock. Shopify, for example, releases a new API version every quarter and supports each stable version for at least 12 months, so connectors to an ERP, warehouse or CRM need a compatibility check at least once a year.

More: Moving to Shopify Plus? 8 Things to Check Before You Migrate

System integration is connecting separate business systems, such as the CRM, accounting, warehouse, project tool and website, so data moves between them without manual re-entry. Most businesses have an integration problem rather than a software problem: each tool works, but they share no data, and prices or stock are updated by hand in several places. Connecting everything to everything creates a tangle, so the goal is deliberate boundaries. A proper integration handles conflicts, retries, failures and reconciliation, which a single plugin rarely does.

More: Digital Architecture: How to Build a System That Can Grow With Your Business

An integration layer is custom middleware between existing systems that moves and translates data among them instead of replacing any of them. It can sync orders both ways between a CRM and a warehouse system, or connect a packaged ERP to the store, CRM and accounting. Built with clear boundaries, it lets one provider be swapped without destabilizing the rest, because the business depends on the capability, not on a vendor. Without it, a CRM wired straight into a site template turns every redesign into an integration project.

More: Custom CRM or ERP: When Standard Software Stops Fitting

A one-way integration sends data in one direction, like a product feed or an export, while a two-way integration keeps two systems updating each other, like a store and a CRM that both edit customer records. One-way is a feed; two-way is a contract between two systems that both expect to be right. That contract needs rules for conflicts, retries and reconciliation decided in advance, or the result is wrong stock, duplicated orders and invoices that do not match.

More: What Actually Makes E-Commerce Development Expensive

A source of truth, or system of record, is the one system that owns a given piece of data and whose value wins when systems disagree: typically the ERP for stock, costs and finance, the PIM for product information, the CRM for customers, the store for orders and the CMS for editorial content. If two systems can change stock independently, the numbers drift apart. Owners should be decided before software is chosen, along with how quickly other systems learn that the truth has changed.

More: CRM vs ERP: What Is the Difference and Which One Do You Need?

Data migration is moving data from an old system to a new one: exporting it, removing duplicates, mapping fields and testing the import on a closed copy before the real switch. In an ERP the usual order is clean reference data first, then opening balances at a cut-off date, then open documents, with older history kept in a read-only archive. Preparation often takes longer than installing the new system, and imports should validate data and stage changes with a way back.

More: CRM vs ERP: What Is the Difference and Which One Do You Need?

A parallel run is the period when the old and the new system work side by side until their numbers match and the new one is accepted; cutover is the moment the business switches over for good. A new store can be tested on real orders while the old one stays available, and an ERP can be rolled out department by department, starting where errors cost most. The switch itself happens at a quiet time with a rollback plan, and most of the hard work is done before the DNS changes.

More: Leaving Magento in 2026: Upgrade, Shopify Plus or Custom Laravel?

QA testing, short for quality assurance, is the systematic checking of software against its requirements before and after every release: manual test cases, automated tests, regression, performance and load testing. Its job is to find defects before users do, not to fix them; fixing is development work. Our QA specialists work from $30 an hour, either by the hour or full time for a fixed monthly amount.

More: QA & Software Testing

Automated testing is the use of code that checks software on every change, from unit tests of single functions to end-to-end tests that click through the interface with tools like Playwright or Cypress. The goal is to control the cost of change, not to reach a coverage percentage, so tests belong first where being wrong is expensive: pricing, permissions, orders, payments and inventory. For a product that changes daily, manual checks come first; automation pays off once the same checks run before every release.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

Regression testing is rechecking existing features after each change to make sure that what worked before still works and old bugs have not returned. It is the answer for teams that keep finding the same bugs after every release. Visual regression testing compares screenshots to catch unintended interface changes. In one of our upgrades the most frequent problems were styles that depended on old library versions, and they were caught on the test copy before going live.

More: QA & Software Testing

Cross-browser testing is checking that a site looks and works correctly in different browsers and on different devices, such as Chrome, Safari and Firefox on desktops and phones. Browsers interpret the same code slightly differently, and the gaps show up in layout, forms and media. A small CSS rule can behave very differently: one meant for gallery images leaked into article images, and Safari showed them cropped at full size while Chrome and Firefox degraded gracefully.

More: Claude Can Build the Website. It Can't Build the Understanding. Not Yet.

User acceptance testing (UAT) is the client's own check of a finished system before it goes live, done by the people who will use it, against their real tasks. It works when it has a defined window (five to seven business days is a practical pattern), a test list, one place for feedback, one person who consolidates it and a clear line between a defect and a new request. Without that line, acceptance turns into a second round of scope.

More: How Long Does an E-Commerce Build Actually Take, and What the Client Has to Do

Load testing is checking how a system behaves under realistic or peak volume before launch, by simulating many users, orders or data updates at once. For an online store it covers bulk price and stock updates, the delay between the ERP and the storefront, recovery after an integration failure and syncing during an order peak. A pilot with a handful of users forgives slow queries, so a load test or a soft launch should come before the system quietly becomes infrastructure.

More: Moving to Shopify Plus? 8 Things to Check Before You Migrate

Code review is the practice of another developer reading a change, usually as a pull request, before it is merged into the main code. It catches bugs, security holes and shortcuts, and spreads knowledge of the code across the team. With AI-generated code it matters even more, since the typical failure pattern is prompt, generate, glance, commit, and DORA's 2025 research found that AI strengthens high-performing teams and worsens struggling ones. When development is outsourced, the arrangement works best if someone on the client side can review code.

More: The Cost of AI Isn't Generation. It's Verification.

A CI/CD pipeline (continuous integration and continuous delivery) is an automated path that builds, tests and releases every code change from development to staging to production, with a known way back. It replaces logging into the server and uploading files by hand, which is a small technical debt payment made on every release. A good deployment is intentionally boring. If every release waits for the one person who knows how the pipeline works, the pipeline itself has become a bottleneck.

More: DevOps & Cloud

A staging environment is a closed copy of a live site or application, with the same code, settings and a copy of the data, where changes are tested before real users see them. It should be closed at the server level, not only marked noindex, and personal data in the copy is best anonymized. In our Laravel 7 to 13 upgrade, staging caught two failures that would otherwise have reached the live site.

More: Six Laravel Versions in Three Days

A rollback plan is a written and tested way to return a system to its last working state if a release or an upgrade goes wrong: the previous code version, a database backup, the deployment steps and the person who decides to roll back. It turns a failed release into minutes of inconvenience instead of an outage. In our upgrades every step has one, and it stays ready until the client confirms that everything works.

More: Website Modernization: PHP, Laravel & CMS Upgrades

A Git repository is where a project's code and its full change history are kept under version control, usually on a platform such as GitHub or GitLab. Every change is recorded with its author, time and reason, and any earlier state can be restored. Code is safest in the company's own organisation, with contractors added as collaborators, rather than in a developer's personal account. Owning the repository is still not owning the capability if private packages, environment settings or deploy scripts are missing.

More: Most Companies Don't Own Their Website. They Own a Collection of Dependencies.

Technical documentation is the written explanation of how a system works and why: its architecture, how the parts connect, how deployment, backups and recovery work, and why key decisions were made. An admin manual or an old specification is not technical documentation. It is the company's memory of its own software, and it decides how quickly a new developer becomes useful. It now has a second reader as well: AI coding agents, which need to know what not to touch and when to stop and ask.

More: Your Website Doesn't Fail When Your Developer Leaves. It Fails Years Earlier.

AGENTS.md is a plain Markdown file at the root of a code repository that tells AI coding agents how to work in the project: commands, rules, constraints and everything that is not obvious from the code. Most major coding agents read it, and since December 2025 the format has been stewarded by the Agentic AI Foundation under the Linux Foundation. At handover our clients receive one with the code, deployment commands and a rollback procedure.

More: Your Codebase Needs a Manual for AI

A handover package is the set of materials a client receives at the end of a project so that any other team can continue the work: the code, deployment commands, server requirements, a rollback procedure and documentation. Without it, the next developer starts by reverse-engineering the system. Ours also includes an AGENTS.md file, so an AI coding agent can work in the project without guessing.

More: E-Commerce Development

Production-ready software is software that can safely run a real business: it is secure, stays reliable under real traffic, is integrated with payments, CRM and analytics, is tested across browsers and devices, and can be deployed, monitored and changed over time. A prototype only shows that an idea can work. A product built in two days with AI describes generation, not ownership; once it starts taking payments or storing personal data, it usually needs hardening and sometimes a rebuild.

More: Claude Can Build the Website. It Can't Build the Understanding. Not Yet.

Vibe coding is building software by describing what you want to an AI model in plain language and accepting the code it writes, often without reading it. Andrej Karpathy coined the term in February 2025. It is a fast way to test an idea, but a vibe-coded product that takes payments or personal data needs a review of its security, data handling and code before real customers arrive.

More: You Built an MVP With AI. Keep It, Fix It or Rebuild It?

Boilerplate code is the repetitive code most applications need in a similar form: create, read, update and delete (CRUD) screens, standard components, API endpoints and configuration. This is where AI tools save the most time, generating it quickly once the problem is understood. Their impact drops for refactoring and is low for architecture and very low for strategy, so faster boilerplate does not shorten the parts of a project that decide whether it works.

More: How AI Is Changing Product Development in 2026 (But Great Ideas Still Win)

Refactoring is restructuring existing code to make it clearer and easier to change without changing what it does for users. It is how a team pays down technical debt in small steps, and the phrase 'we will refactor this later' is often how that debt starts. A framework upgrade of a neglected application can require a major refactor, the second most time-consuming part of a migration after testing. Since AI coding tools spread, refactoring has fallen from 25% of changed lines to under 10% (GitClear).

More: How Much Does a Custom Website Cost in 2026?

A legacy system is software still in daily use whose platform, language version or framework is outdated or out of support, such as a store or a CRM on an old version of PHP or Laravel. It may work fine day to day, yet it blocks security updates, new integrations and AI tools, whose packages require current versions. The usual choice is between a staged upgrade and a rebuild.

More: An AI Project Stuck on a Legacy System? Upgrade First, Then Automate

Technical debt is the accumulated cost of past shortcuts in software: outdated versions, quick fixes, copied templates, abandoned plugins and undocumented integrations that still work but make every change slower and more expensive. It is usually invisible while the system runs and surfaces during a redesign, a migration or an AI project. An audit before such work shows the debt before it shows up in the budget.

More: The Hidden Technical Debt That Makes Website Redesigns More Expensive Than Planned

Cognitive debt is the growing cost of understanding a system: why a piece of code was added, what depends on it and whether the business still uses it. Technical debt makes software harder to change; cognitive debt makes it harder to understand, and the related intent debt is the lost reasoning behind past decisions (Storey, 2026). This cost is paid again before every change and rarely appears in estimates, which is one reason small changes in old systems take so long.

More: The Code Remembers Every Version of the Business

Tribal knowledge is the unwritten knowledge of how a system and a business really work: fixes, exceptions and rules that exist only in someone's head or spreadsheet. It surfaces when that person leaves or the system is replaced, because the hard part of leaving an old system is discovering its undocumented customisation. An AI model sees the code, not the history, so someone has to write down what the old system actually does before it is modernized or automated.

More: Why Most AI Pilots Stall Before Production, and How to Get Yours Live

Website modernization is bringing an existing site's code, programming language, framework, CMS and speed up to date while keeping the interface, the content and everything that works. It differs from a redesign: a site can look new on an old back end, or look dated on a healthy stack, and only an audit shows which. The work goes version by version on a closed copy, with a rollback at every step and no downtime. Our audit costs from $300 for small sites and from $1,000 for large ones.

More: Website Modernization: PHP, Laravel & CMS Upgrades

A major version upgrade is the move of a site or application to a new major release of its framework or programming language, where breaking changes are expected. Laravel ships one every year, so a site left untouched for five years is about five versions behind. The safe way is one version at a time on a closed copy, with tests and a rollback plan. One of our projects went from Laravel 7 to 13 in three days.

More: Upgrading an Old Laravel or PHP Site in 2026

Upgrade vs rebuild is the decision whether to bring an existing system to current versions or to build a new one. An upgrade keeps content, page addresses and search history, and fits when the system matches the business, the data model is sound and it runs on PHP 7 or 8. A rebuild deserves discussion when the upgrade estimate approaches about 60% of a clean rebuild, or when the team is already rebuilding inside the old system through workarounds. Rewrites in 2026 cost from $80,000 to over $3 million.

More: Six Laravel Versions in Three Days

End of life (EOL) is the date after which a software version no longer receives security fixes from its maintainers. Nothing breaks that day; the risk and the cost of catching up grow quietly afterwards. PHP 8.1, for example, reached end of life on 31 December 2025 and 8.2 follows on 31 December 2026, while Laravel 11 lost security fixes on 12 March 2026. What ends is support for a version, not the platform, so the usual answer is an upgrade rather than a replacement.

More: Upgrading an Old Laravel or PHP Site in 2026

Software dependencies are the external packages, plugins, libraries and SDKs a system relies on instead of writing everything itself. Most applications rest on thousands of open-source components, and the risk lies not in using them but in not knowing them. Dependencies set minimum versions and drop support for old runtimes, so they often force upgrades; a payment provider's SDK, for instance, may refuse an old stack. Mature teams track each dependency, why it is there, its licence and its owner, and watch for vulnerabilities.

More: Upgrading an Old Laravel or PHP Site in 2026

An abandoned package is a library or plugin that its author no longer maintains, so it gets no fixes and no support for new framework or language versions. In an upgrade it is often the real obstacle, more than the framework itself. During our own Laravel 7 to 13 upgrade the hardest part was an unmaintained admin forms library used more than 200 times in 29 templates; a small compatibility layer kept the old calls working instead of rewriting every form field.

More: Six Laravel Versions in Three Days

Laravel Shift is a paid automated service that upgrades a Laravel application one major version at a time, at about $19 to $39 per step. By its own estimate it saves about two hours on an upgrade to Laravel 12. Together with Rector and AI coding agents, it is the do-it-yourself route for upgrades. It changes the code but does not check whether the business still works afterwards: forms, mail, integrations and scheduled tasks still need testing.

More: Six Laravel Versions in Three Days

A code audit, or technical audit, is a structured review of a software system: language runtime, framework, packages, integrations, hosting, mail, database, scheduled jobs, permissions and indexing rules. It ends with a written report on what is sound, what is risky and what to do next, with an upgrade path, price and timeline. Audits regularly find what nobody noticed, such as error messages shown to visitors or contact form emails silently rejected. Ours cost from $300 for small sites and from $1,000 for large ones, and the report belongs to the client.

More: Upgrading an Old Laravel or PHP Site in 2026

A project takeover is the transfer of a live site, store or product from a previous agency or freelancer to a new team: collecting access and code, finding out how the project is deployed, stabilizing it and continuing development. It is needed when the previous contractor has left, stopped answering or keeps missing deadlines. Ours starts with an audit from $2,500, and nothing changes in production until backups work.

More: Project Takeover

A silent failure is a fault that breaks part of a system while everything looks normal: mail, uploads, scheduled tasks, indexing or integrations stop working without any error on screen. The contact form still says thank you, but the lead never arrives, or the live site is accidentally closed to Google. It is the most dangerous kind of failure after an upgrade or a move. Right after go-live, check that the site is open to search engines, send a real test lead and wait for the email, and confirm that integrations respond.

More: Six Laravel Versions in Three Days

DevOps, from development and operations, is the practice of automating how software is built, tested, deployed and run, so that releases are frequent, repeatable and reversible: continuous integration and delivery (CI/CD) pipelines, infrastructure as code, monitoring, backups and access control. In a small company it often means that releases stop depending on one person's laptop. Our DevOps engineers work at $50 to $70 an hour.

More: DevOps & Cloud

Hosting is the service and the servers on which a website or application runs and keeps its files, database and email. A hosting account controlled by someone outside the business is a dependency risk, and some settings exist only on the old server, which surfaces at the first move. Defaults matter too: a host's firewall or bot protection can block Google or AI crawlers without the owner ever deciding it. Many older systems still run on plans set up for a site that only showed pages.

More: Upgrading an Old Laravel or PHP Site in 2026

Cloud hosting is running a site or application on rented, scalable infrastructure from providers such as AWS or Google Cloud, where capacity grows or shrinks with demand. It is not automatically the right choice: depending on the load, the best setup may be AWS or Google Cloud with Kubernetes, a few servers at Hetzner or DigitalOcean, or regular hosting. The right setup is the simplest one that holds the load. When a cloud bill grows faster than traffic, it calls for a cost review.

More: DevOps & Cloud

Docker is a tool that packages an application with everything it needs into a container that runs the same way on any server, and Kubernetes is a system that runs, scales and restarts many such containers across servers. Together they replace hand-built servers with repeatable, described environments. Kubernetes adds real operational complexity, so we use it only when the load needs it.

More: Hire DevOps Engineers

Infrastructure as code is describing servers, networks, databases and other cloud resources in code files, usually with Terraform, instead of setting them up by hand in a control panel. The infrastructure can then be recreated, reviewed and changed like any other code, with a history of every change. The reverse side is ownership: a departed DevOps engineer often leaves Terraform code and pipelines that nobody dares to touch. DevOps engineers who can take such code over join teams at $50 to $70 an hour.

More: Hire DevOps Engineers

Hosting migration is moving a site or application to new servers, a new hosting provider or the cloud, ideally onto accounts the owner controls. Done properly, it is planned with a copy, a test and a switch at a quiet time, and it can be combined with a version upgrade, for example a controlled move plus a PHP 8.2 upgrade in two evenings. Two checks are often skipped afterwards: SPF and DKIM records, without which form leads land in spam, and whether the new host blocks search or AI crawlers.

More: DevOps & Cloud

A domain is a site's address, the registrar is the company it is registered with, and DNS is the set of records that points the domain to the servers for the site and email. Whoever controls the registrar account controls the business's address. An ownership check establishes who the registrant is, who holds the registrar account, the recovery emails, DNS and billing, and when the domain renews. A domain tied to a personal email or a former developer is a basic ownership risk.

More: What You Own vs What You're Renting: The Digital Ownership Audit

An SSL certificate (technically TLS) is a digital certificate that lets a site work over HTTPS, encrypting traffic between the browser and the server and confirming the site's identity. Browsers warn visitors away from sites without a valid one. Certificates expire and must be renewed, usually automatically, and an expired one is a typical failure that reveals who really controls the infrastructure, so it belongs in any ownership audit.

More: Your Website Doesn't Fail When Your Developer Leaves. It Fails Years Earlier.

A CDN (content delivery network) is a network of servers around the world that delivers a site's files from a location close to each visitor and filters traffic on the way; Cloudflare is a common example. It speeds up pages and absorbs attacks. It also holds rules for caching, redirects and security, which over time become load-bearing for search, performance and uptime. A CDN set up by one team member and never documented is a typical blind spot once that person leaves.

More: Your Website Doesn't Fail When Your Developer Leaves. It Fails Years Earlier.

Backups are copies of a system's code, database and files kept so it can be restored after a failure, an attack or a mistake, and a restore test is actually restoring one to prove it works. A backup nobody has ever restored is only a hope. The basics are daily copies stored away from the server and a restore procedure that works without a specific person. Three questions show the real state: do recent backups exist, has anyone restored one, and could it be done if that person left.

More: Website Maintenance & Support

Disaster recovery is the documented plan and the means to bring a system back after a serious failure: a lost server, a hacked site, deleted data or a provider outage. It defines where backups live, who acts, in what order and how long recovery may take. In technical due diligence it is reviewed together with hosting, environments, backups, DNS and monitoring, and the absence of a documented plan rates as a high risk.

More: How to Audit a Website or Digital Product Before You Buy It

Monitoring and observability are the tools and practices that make a system's health visible: errors, failed jobs, uptime, slowdowns and resource use. Monitoring watches known signals and raises alerts, while observability makes it possible to understand why something went wrong. The goal is that the system, not a customer's call, reports a failed payment, a broken integration or a stopped queue. Uptime monitoring is part of our support plans, which start from $1,000 a month.

More: DevOps & Cloud

Website maintenance and support is the ongoing technical care of a live site: monitoring, daily off-site backups, security and framework updates, performance work, content changes and error checks. It keeps the site safe and current between projects, instead of fixing things only after they break. Multilingual sites and online stores need engineers rather than a script, because every integration can fail silently. Support starts with an onboarding audit of the code, infrastructure and access.

More: Website Maintenance & Support

Email deliverability is whether a site's emails, such as form leads, order confirmations and password resets, actually reach the inbox rather than spam or nowhere. It depends on DNS records such as SPF and DKIM, which prove the server may send mail for the domain, and on the sender's reputation. A hosting move without these records can send contact form leads to spam or make them vanish, and audits also find forms still sending to a former partner's address. That is why deliverability is checked after every upgrade or move.

More: Upgrading an Old Laravel or PHP Site in 2026

HTTP 403 and 429 are server responses that refuse a request: 403 Forbidden means access is denied, and 429 Too Many Requests means the client has sent too many requests in a short time. They are deliberate refusals by the server or its bot protection, not timeouts. They hurt visibility when they hit the wrong visitors: after one hosting move, GPTBot and Meta's crawlers received 403. Server logs and crawler tests show who is being refused.

More: We Sent an AI Agent Shopping in 15 US Online Stores. Here Is Where It Gave Up

Environment variables are settings and secrets kept outside the code, in Laravel usually in a .env file: database credentials, API keys, mail settings and the application key. They let the same code run differently in development, staging and production, and keep secrets out of the repository. Undocumented environment variables can stop anyone else from running the delivered code at all. Some values must never change: regenerating a Laravel APP_KEY on a live environment breaks sessions and every encrypted value.

More: What You Own vs What You're Renting: The Digital Ownership Audit

Page speed is how quickly a page loads and becomes usable, and PageSpeed Insights is Google's tool that measures it by running Lighthouse on a throttled mid-range phone. The lab score itself does not move rankings; field Core Web Vitals from real users do, with thresholds of 2.5 s for LCP, 200 ms for INP and 0.1 for CLS. Office tests mislead: one homepage that loaded in under a second on office wifi took about six seconds on an average phone, until image compression and a hosting change brought it under two.

More: 3D on a Live Site: Our three.js Experiment and What Google Saw

OPcache is a built-in PHP extension that keeps compiled PHP code in memory, so the server does not recompile every script on every request. It is a server setting rather than a code change, which makes it one of the cheapest speed gains worth checking on any PHP site. On our old Laravel 7 site, enabling OPcache cut server response time from about 55 ms to about 21 ms.

More: Six Laravel Versions in Three Days

Caching is storing the result of expensive work, such as a database query, a rendered page or an API response, so it can be reused instead of computed again. It is one of the main ways to keep a site fast under load, and many older systems lack a proper cache. Applied blindly, caching can also break things: in our Laravel setup, a route cache froze routes without their language prefixes and turned every page into a 404 on staging, so routes there are never cached.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

Lazy loading is delaying the download of images, video, 3D scenes and other heavy content until the visitor is about to reach it, instead of loading everything with the page. It shortens the first load and saves data on phones. Content in the first screen should never be lazy-loaded, or the main image appears late. On our site the footer 3D starts loading about 800 px before the footer (350 px on phones), and the contact page diorama waits until the browser is idle.

More: 3D on a Live Site: Our three.js Experiment and What Google Saw

Responsive images are images prepared in several sizes and served in modern formats such as WebP and AVIF, so each device downloads only the version it needs and a phone never loads a desktop file. The browser picks the right size from a list in the page code. Combined with lazy loading, they keep image-heavy sites such as portfolios and catalogues fast. Cover images for social previews are still best kept in JPEG, which every network displays.

More: Website Design for Architecture Firms: What Clients Look For Before They Call

Access management is controlling who can reach which systems and data, on the principle of least privilege: each person gets a personal account with only the rights their work needs. Shared logins, one person holding all admin or billing access, and former contractors who still have production credentials are the typical gaps. The basics are personal accounts, a company-controlled password manager, the code repository in the company's organisation and production changes through review. After an acquisition, credentials should be rotated and users reviewed within the first 30 days.

More: IT Outsourcing & Outstaffing

Role-based access control (RBAC) is a way of granting permissions by role, such as manager, accountant or partner, rather than person by person. For each role it defines what may be seen, changed, approved and exported, and this should be written down before screens are designed. Hiding a button is not access control: rules must be enforced on the server and in the database. In an ERP that means deciding who may change a price, approve a purchase order, write off stock or see margins, and checking it with automated tests.

More: Web Application & SaaS Development

Two-factor authentication (2FA), or multi-factor authentication (MFA), requires a second proof of identity besides the password, such as a code from an app, a hardware key or a confirmation on the phone. A stolen password alone is then not enough to sign in. It belongs on every account with access to admin functions, money or customer data. The recovery codes matter as much as the second factor itself, so an ownership check asks who holds them.

More: Web Application & SaaS Development

UAE PASS is the national digital identity of the United Arab Emirates, which lets residents sign in to services and sign documents digitally without a separate password. Integrated into client accounts and B2B systems, it removes registration friction and adds a verified identity. It requires a UAE trade licence and an agreement with the provider, and onboarding goes through four phases, which should be planned into the project timeline.

More: Digital Agency for Businesses in Dubai and the UAE

The OWASP Top 10 is the standard list of the most critical security risks for web applications, published by the Open Worldwide Application Security Project and used as a baseline for secure development and audits. In the 2025 edition broken access control is first, and some form of it was found in every tested application. AI-written code needs the same check: in Veracode's 2025 research, 45% of AI-generated code samples introduced OWASP Top 10 vulnerabilities.

More: Web Application & SaaS Development

Cross-site scripting (XSS) is an attack in which a malicious script is injected into a page that other people open, letting the attacker steal sessions, change content or act on the user's behalf. It exploits places where a site outputs user input without proper escaping. Old libraries carry known holes: any jQuery build older than 3.5.0 has a documented XSS vulnerability. AI-generated code is not immune either, as Veracode found XSS defences failing in 86% of relevant AI-generated cases.

More: Most Companies Don't Need a New Website. They Need a New Structure.

A CVE (Common Vulnerabilities and Exposures) entry is a public identifier assigned to a known security vulnerability, so vendors, scanners and teams can refer to it precisely. Once a CVE is published, attackers know about the hole too. Versions past end of life get no fixes for new CVEs, so they collect known vulnerabilities while still looking fine. One recent example, CVE-2025-48757, exposed data in more than 170 projects built with the AI tool Lovable.

More: Most Companies Don't Need a New Website. They Need a New Structure.

Secrets management is how a team stores and controls passwords, API keys, tokens and payment credentials: outside the source code, never in code that runs in the browser, and with production credentials separate from development ones. Secrets live in environment settings or a dedicated vault, with limited and logged access. Every password should have an owner. Passwords saved in someone's personal browser instead of a company password manager are an early warning sign.

More: What Separates a Premium Laravel or Symfony Build From a Merely Functional One

Row-level security is a database feature that decides which rows of data each user may see or change, so the database itself enforces access, not only the interface. In an application with many customers it is what stops one customer from reading another's records even if a screen or an API has a bug. It is the key weak point of many AI-built MVPs: in one audit of 50 such apps, 88% had database-level security entirely disabled.

More: You Built an MVP With AI. Keep It, Fix It or Rebuild It?

An audit trail is a tamper-resistant record of who did what, when and why in a system: the user or AI agent, the tool used, the approval, the decision and the result. Ordinary logs record that something happened; an audit trail lets you reconstruct why. In an ERP, every change to stock, price or document status is recorded with the user and the time, and closed periods cannot be edited without a correcting document. With AI agents acting in business systems, it is the basis for governing them.

More: Agentic AI Compliance: How to Secure, Govern and Monitor AI Agents

Bot protection is the set of firewall rules and services, such as Akamai, PerimeterX or Kasada, that detect and block automated visitors before they reach a site. It stops scraping and attacks, but it decides before robots.txt does, so default settings can block Google or AI crawlers without the owner choosing to. In our test of 15 US online stores, bot protection stopped an AI shopping agent in 4 of them, with a 403, a waiting page, a press-and-hold check or a 429.

More: We Sent an AI Agent Shopping in 15 US Online Stores. Here Is Where It Gave Up

A software bill of materials (SBOM) is a structured inventory of every component a piece of software depends on: libraries and packages with their versions, licences and origins. It lets a company answer quickly whether it is affected when a vulnerability is published in a widely used component. Regulation is moving toward requiring it, through US Executive Order 14028 and the EU Cyber Resilience Act, so dependency visibility is becoming a compliance question as well as an operational one.

More: Most Companies Don't Own Their Website. They Own a Collection of Dependencies.