From FTP to My Own CMS: Why I Finally Quit the Platforms

This site you’re reading now runs on something I built myself: a small, static-site CMS of my own. It generates plain HTML, has no database, and is built from the ground up around security. But to explain why I built it, I have to go back, all the way to the dial-up days.

The dial-up years: FTP and the “under construction” sign#

In the early years of the dial-up internet, my provider gave every user a little slice of web space where you could upload your own HTML files and make a simple page. I remember how genuinely happy I was: opening an FTP client, editing an HTML file, uploading it, and seeing it live. Of course it had the obligatory spinning “under construction” GIF, which, like an idiot, I thought was the height of professionalism. And the hit counters. Oh, the counters. I’d sit there refreshing the page to watch the number climb, and then I wrote a little script to keep refreshing it so the counter would show a really big, very impressive (and completely fake) number. Stupid, wonderful times.

Registering my first domain: PHP and MySQL magic#

Then I upgraded my hosting and registered my first real domain, aganet.gr, which came with PHP and MySQL. This is where the real dream began. This is where the magic happened. I went deep searching looking for something to run on php, and I found MKportal. It had everything I wanted, and it was easy to edit and configure into whatever I imagined. This was the exciting era. I had so much on my site, even a forum. It was also when I connected a weather station to my computer and used WeatherDisplay to FTP the live data up to my site. Then I added a webcam. I was learning constantly and loving every minute of it.

Joomla: the golden years#

Eventually mKPortal was discontinued, so I went hunting for alternatives. I tried forum software like SMF with a portal page bolted on, but it was never quite what I wanted. Then came the next big thing: Joomla. The Joomla years were the best of my whole web journey. I could edit and change themes, customize them, edit modules, post easily, categorize easily, basically do anything I wanted. (I also experimented with Drupal, but it was terrible for my brain from end to end. I could never understand how it worked or bend it to do my work. Not for me.) By this point during the years I had a webcam refreshing every 15 seconds, live weather data, and posts about my area, and the site got genuinely popular: an average of 3,000 to 5,000 visitors a day, from all over the world. I was getting comments and contact-form messages from strangers across the planet, and that made me really happy.

Webcam view:

This is a website snapshot from year 2014

The WordPress detour#

As WordPress gained popularity, I decided to move off Joomla. At first WordPress felt simpler and easier to administer. But after the move, everything went sideways:

• My Google Analytics shows visits were dropped, and I started losing visitors.
• SEO got worse (maybe my fault, I tried to keep the same keywords, but still).
• The site just wasn’t as attractive as it had been on Joomla, and building the front page the way I’d had it was harder, not easier. Honestly, I think it was a mistake. And when WordPress introduced the Gutenberg block editor, writing a post became a genuinely bad experience for me. Blocks everywhere, nothing simple. So, as always, I started looking for something better.
• As my needs grew, I found myself relying on plugin after plugin, SEO, caching, backups, forms, image optimization, security. Keeping everything updated became a job in itself, and I started wishing for something much simpler.

Discovering static site generators, and falling for Hugo#

That’s when I found static site generators. I tried Grav, then Hugo, and Hugo is where I stayed. Hugo was amazing: blazing-fast static HTML, no database, nothing to attack. The one catch: I had to be at my computer to do anything. Write a post, git commit, push, and let the CI pipeline build the HTML and SFTP it to my host. In the AI era I even built myself a Go-based Hugo editor that listed all my posts and let me edit and manage them, then push, and it worked well. But I still had to be on my computer.

The idea: a static generator with an online backend, built for security#

Then, at work, I started using AI heavily and got more and more proficient with it. As I started using AI heavily at work, the idea finally clicked:

What if I built a static-site generator like Hugo, but with an online backend I can use from anywhere, even my phone, and made it secure by design from the very first line? That became the engine that runs this site today.

What it actually is#

It’s the lesson of every step of this journey, distilled, and it does exactly what I always wanted:

• Posts, pages, and notes. Posts are the proper articles. Pages are the standalone stuff (about, contact, and so on) that drives the menu. And notes are my favourite part: a microblog for the daily, off-the-cuff things. A quick thought, a photo, a link, anything I want to share in a few seconds without the ceremony of a “real” post. They get their own timeline, so they double as a running journal of mine. After years of fighting tools to do this, it’s finally how I think.
• Static for reading, dynamic for editing. Like Hugo, visitors get pre-built HTML: fast, cheap, with almost no PHP running for them. But like WordPress and Joomla, there’s a real admin you log into and a Publish button. No terminal, no Git, no build step. I can post from my phone.
• No database. At all. Posts and pages are Markdown files; settings and account data are JSON/PHP. Backing up the whole site is copying two folders. After the mKPortal-and-MySQL years, there’s something deeply satisfying about that simplicity.
• Runs on plain shared hosting. No Node, no SSH, no Docker. It deploys over FTP, exactly like that very first HTML page I uploaded decades ago. Full circle.
• Little touches, because it’s mine. I even built a custom 404 page with a bit of personality, so a wrong link isn’t a dead end but something fun. When the whole thing is yours, you get to enjoy the small details too. (Go on, try a URL that doesn’t exist and see.)

Why “focused on security”#

This is the part I cared about most, because every CMS I’d ever used was a target. So I built it so the boundary is the architecture itself, not a plugin you hope is patched:

• The only thing the web server exposes is a single front controller in a web/ subfolder. All my content, config, and secrets live above the document root, physically unreachable by a browser, on any web server, with or without .htaccess.
• The admin password is Argon2id-hashed and stored in a PHP file that executes to nothing if it’s ever requested directly. Even content files carry a guard line so a draft can’t leak as plaintext.
• CSRF on every action, hardened sessions, an escalating login throttle (a built-in fail2ban for the login), an audit log, a strict Content-Security-Policy, and optional two-factor authentication with backup codes.
• No SQL layer means no SQL-injection surface. An entire class of attacks simply doesn’t exist here.

Full circle#

I started this journey uploading a hand-made HTML page over FTP, thrilled just to see it live. Decades later, through mKPortal, a forum, a weather station, a webcam, Joomla’s golden years, the WordPress detour, and the Hugo era, I’ve ended up writing my own engine that, in a way, brings it all back to the beginning: plain static HTML, uploaded to simple hosting. Only now I can write from anywhere, it builds itself, and it’s secure by design. For the first time in all these years, I’m not bending myself around someone else’s tool, or hunting for the next platform that almost fits. I built a website that does exactly what I want. No compromises, nothing fighting me, nothing I have to work around. Every part of it is the way I want it because I made it that way. That feeling is hard to describe.

What’s next#

For now this is my own project, running my own site. But at some point I plan to share it publicly and release it as open source, so anyone who wants a fast, secure, database-free site they can run from their phone on cheap shared hosting can use it too. If that sounds like something you’d be into, I’d genuinely love to hear from you. Whether you want to try it, give feedback, or build on it together, get in touch through the contact page. I’d be happy to work with anyone who shares the itch to make the web simple, fast, and secure again. That little “under construction” sign is finally gone. The site is built. And I built the thing that built it. 🚀