Motley CMS

Motley CMS is the content management system we build websites on. We wrote it, we maintain it, and it runs this site along with many of the sites we look after for clients.

Most content management systems get their features from plugins. A page builder from one company, contact forms from another, security from a third, each on its own update schedule and its own renewal date. Motley CMS does that work itself, as one product. Almost everything else on this page follows from that.

This is the part we spend the most time on, and it shapes the rest of the product.

Failed logins are throttled and accounts lock on their own, with an email and a dashboard warning the moment a pattern appears. The whole admin can be restricted to a list of trusted addresses. The sign-in page can be moved off the obvious address, so the bots that hammer it find nothing there. Rich text is cleaned against a strict allow-list when it's saved, uploads are checked by their real file type rather than their name, and permission checks run on the server rather than in the interface.

The part that matters at nine on a Friday evening is the response. Blocking an attacking address, signing a compromised account out of every device, tightening the lockout rules, or taking the public site offline cleanly are all buttons in the admin. No SSH, no developer, no hosting ticket. There's a written playbook built in that walks a non-technical admin through each situation a step at a time.

Where the claims stop. Large traffic floods are handled at the network edge rather than inside the application, and the built-in playbook says so. Our security reviews are recorded engineering work, repeated on a regular basis rather than done once at launch, and they aren't an independent penetration test. Where a project needs one of those, we arrange it.

A content management system is only as good as the Tuesday afternoon when someone needs to change the opening hours.

Pages are assembled from blocks: text, images, columns, calls to action, pricing tables, galleries, forms, maps, video. There are more than thirty, though nobody meets them all on day one. A site starts in a simple mode that offers just the everyday ones and unlocks the rest when the person running it wants them. That's one setting, not a rebuild.

Whole sections switch on and off. Turn the blog off and it disappears from the navigation, the web address and the listing page, and it’s all still there when you turn it back on. Rename “Blog” to “Articles” and the menu, the page title, the breadcrumb and the address all follow.

The rest is the everyday furniture, built in rather than bought in: a media library that tells you where a file is used before you delete it, a form builder that keeps its submissions in the admin, navigation and redirects, site search, scheduled publishing, a cookie consent banner, scheduled backups, visitor numbers and search queries on the dashboard, and a shop for the sites that need one.

An AI writing assistant sits in the admin as well. It runs on your own key and stays off until you add one, so nobody pays for it by default.

Blocks build a page. Sections are the bigger structures: a news feed, an events diary, a team page, a shop. Each one is a switch. Turn it on and you get the admin screens, the listing page, the web address and the navigation entry together. Turn it off and all of it leaves the site, with the content still sitting there for whenever you want it back.

Most sites use a handful. The rest stay out of the way.

More people now ask ChatGPT, Copilot or Perplexity instead of searching. Most websites are invisible to that, because the things those systems read are the things most sites never publish.

Motley CMS publishes them as standard. Your site carries a machine-readable guide to the business, including what you don't do, so an assistant can't invent services on your behalf. Every public page is also available as clean text an assistant can actually read. Question and answer sections are marked up so they can be quoted directly. Search engines can be told the moment something is published instead of waiting to be crawled.

You can also see whether any of it is working. One report shows which AI crawlers say they are reading the site. Another asks the assistants whether they name your business when someone describes what you do, and who they name instead. That one runs on your own key, so it stays off until you add one.

Most people asking for a website ask for WordPress, because it's the name they know. That's fair. What the name covers is the part that tends to surprise people.

A typical WordPress site is WordPress plus twenty-five to thirty-five separate plugins, handling the page builder, the forms, the SEO, the security, the caching, the cookie banner and the rest. A dozen or so of those are paid. To reach the standard Motley CMS starts at, the plugin licences alone come to somewhere around £950 to £1,300 a year, per site, every year the site is live. That spend buys nothing the site couldn't already do on day one.

The bigger cost arrives later. Plugins are the most common way WordPress sites get broken into. Two dozen of them updating on their own schedules is why so many sites need a monthly care plan, and why so many owners stop updating and let the site rot. Any paid plugin can be sold, repriced or abandoned, and when that happens it's your site with the problem.

We still build on WordPress. For a large or unusual online shop, hundreds of products, subscriptions, several currencies, WooCommerce is the more mature option and we'd tell you so. There are also more WordPress developers to hire, which matters to some people. We think our own CMS is the better answer for most business websites, and we'd rather argue the case than pretend we have no view. When it isn't the right answer for you, we'll say that too.