Built properly.Built to evolve.
Websites, web applications, and WordPress plugins, engineered methodically: clean, reliable, and ready to adapt to your needs.
Tech never stands still. I’ll still be right here after launch — developer, troubleshooter, and tech friend in one — keeping it fast, secure, and current.
Decades of engineering, based in Switzerland.
Create
Websites for individuals, businesses, and clubs. Designed first, built second. From a hand-built static site that needs nothing, to WordPress when you want to run it yourself — built with as few moving parts as the job needs, and every one of them yours to understand. Form follows function; the experience follows you.
Web applications when a website is not enough: membership systems, customer portals, booking engines, data-heavy tools with their own admin. Engineered from the ground up in PHP, with the data in a database entirely in your control — never third-party software you don’t need.
WordPress plugins when the one you need doesn’t exist, or comes with a license fee, a tracking script, and forty features you’ll never use. I write the small, sharp one instead — some are public, so try one before you hire me.
Front to back — server, database, code, layout — one pair of hands, so nothing falls between departments. I keep things simple on purpose: simple outlasts clever, costs less to run, and stays supportable for years. Privacy is the default, not an option: Swiss hosting, nothing wired into your site that sells your visitors’ data, and your data stays entirely yours.
How it goes:
- we talk
- I design
- you approve
- I build and launch
You deal directly with me at every step. No agency overhead, no account manager, no endless ticket queue.
Care
A project is not finished at launch. Software ages, threats evolve, and the day something breaks is never convenient. Most developers build and disappear; I stay. That has always been true — now it has a name and a price.
Choose the level of ongoing safekeeping you need:
| Foundation | Structure | Evolve | |
|---|---|---|---|
| Keep it running | |||
| Core, plugin, and theme updates — applied and checked | ✓ | ✓ | ✓ |
| Backups | hosting nightly | restore tested | restore tested |
| Uptime and error monitoring | ✓ | ✓ | ✓ |
| Fixes when something breaks | by quote | ✓ | ✓ |
| SSL, domain, and DNS kept current | ✓ | ✓ | ✓ |
| Email deliverability checked | ✓ | ✓ | ✓ |
| Keep it safe | |||
| Web firewall and hardening | ✓ | ✓ | ✓ |
| File integrity scans | ✓ | ✓ | ✓ |
| Key and password rotation | ✓ | ✓ | ✓ |
| Login protection and spam control | ✓ | ✓ | ✓ |
| Security alerting | ✓ | ✓ | ✓ |
| Keep it yours | |||
| Content and layout changes | by quote | 2 hours / month | 4 hours / month |
| New features and extensions | by quote | by quote | 2 hours / month |
| Performance check | yearly | twice a year | twice a year |
| How we work | |||
| Summary email | quarterly | monthly | monthly |
| Response time | 2 working days | 1 working day | same day |
| Price | |||
| CHF / month | 85 | 255 | 595 |
| CHF / quarter (invoiced quarterly) | 255 | 765 | 1’785 |
| Annual prepayment CHF (in advance) | 895 (−12%) | 2’692 (−12%) | 6’283 (−12%) |
- Every new build includes three months of Structure.
- Sites I did not build can join after a review.
- Anything beyond your hours is billed at CHF 85 an hour, no surprises.
Plugins
Tools I built for my own sites. Free to take.
Small, sharp WordPress plugins, each written because the one I needed did not exist or came with a licence, a tracking script and forty features I would never use. They update from this site, not from a marketplace, and they report nothing home beyond the update check itself — the readme of each one says exactly what that sends.
KeyTurn 0.1.8
The eight authentication constants (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and their four _SALT counterparts) sign WordPress's auth cookies and…
Changelog
0.1.8
- Updates now come from designbyroger.com: the plugin carries Plugin Update Checker 5.7 and checks https://designbyroger.com/plugins/keyturn.json about twice a day. This is KeyTurn's only outbound request; the readme says exactly what it sends.
- Tested up to 7.1; security contact added to the readme.
0.1.7
- The arming backup of wp-config.php is now removed on the first verified admin page load after arming, instead of at the first rotation — no more weeks of file-scanner alerts on a file with no remaining value.
- Readme: mailers with a store-credentials-in-wp-config mode sidestep the re-enter-after-rotation step.
0.1.6
- Wording pass across readme, settings page, arm preview, notices and emails: encrypted-secrets (SMTP) consequence stated at every commitment point; crontab-removal reminders on restore; overdue guidance names the crontab path and php binary; careless-delete FAQ corrected and given a hand-finish; nginx snippet corrected.
- Fix: rotation email no longer reports a WP-Cron "next due" date when rotations run from system cron.
0.1.5
- Readme: known interactions — plugins that encrypt secrets against the salts (SMTP), host migrations breaking crontab paths; cron FAQ: which-php check, MAILTO, URL-only panels.
- Settings: crontab example shown whenever a schedule is set, not only after System cron is saved; PHP-binary and MAILTO note.
0.1.4
- Documentation: changelog brought current.
0.1.3
- Incident panel attention treatment: red warning heading with dashicon, bold preamble.
0.1.2
- Recovery instructions rewritten: ordered sequence, plain-language secrets, double-rotation rationale; incident panel mirrored.
0.1.1
- Versioning: plain patch bumps, dev-suffix dropped.
0.1.0
- Initial release.
Full description
The eight authentication constants (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and their four _SALT counterparts) sign WordPress's auth cookies and nonces. KeyTurn rotates them on a schedule — weekly, monthly, or quarterly — and gives you a one-click "Rotate now" button for incidents.
What rotation buys you: stolen cookies get a bounded useful life, leaked constants go stale, and post-incident cleanup is one click. What it costs: every rotation signs *every* user out of the site — including the administrator who triggers it. KeyTurn tells you this before you commit, on a preview screen, and again in every warning. Plugins that encrypt stored secrets against the salts — SMTP plugins are the common case — will ask for those secrets again after each rotation (see the FAQ).
Architecture, in two sentences. KeyTurn edits wp-config.php exactly once, replacing the eight define() lines with a small marked block that loads a dedicated file, keyturn-salts.php, sitting beside wp-config.php. Every rotation thereafter rewrites only that one file — atomically — so wp-config.php is never regex-edited on a schedule.
One outbound request, and you can see it. About twice a day KeyTurn asks designbyroger.com whether a newer version exists — the same check WordPress makes to wordpress.org for directory plugins, sending the same things: your site URL, plugin, WordPress and PHP versions, and locale. Nothing else ever leaves your server: no telemetry, no salt values. Salts are generated locally with PHP's cryptographic random source. One bundled library (the update checker), no build step, no custom database tables. The one other HTTP request is a self-test that requests your *own* site's URL over loopback to confirm the salts file isn't being served as text — it contacts no external host.
Requirements: PHP 8.1+ and WordPress 6.2+. Single-site only for now; multisite is refused at activation and planned for a later release.
Security contact: report vulnerabilities privately to admin@designbyroger.com.
ShowLove Donations 1.0.6
ShowLove Donations adds a donation form to your WooCommerce site and optionally a Donation Leaderboard.
Changelog
1.0.6
- Updated description and installation documentation
- Renamed tabs: General Settings, Shortcodes
- Removed video links
- Renamed Gutenberg block to ShowLove Donations
1.0.5
- Added self-hosted update support via Plugin Update Checker 5.6
- Added Update URI header so updates are served from designbyroger.com
1.0.4
- Renamed leftover vendor-prefixed CSS class, helper functions and script names to the sld prefix
- Removed a dead nav tab icon style
- No functional changes
1.0.3
- Leaderboard rows now stay on a single line and scale down in narrow containers
- Donation amount now matches the row font size, bold only
- Leaderboard dates now use a short 3-letter month format (e.g. 5 Mar 2026)
- Added a configurable leaderboard heading, set under Label settings
- Added leaderboard shortcode documentation to the Shortcode settings tab
1.0.2
- Removed leftover "Get Pro Version" markup from the settings page (crown icon, upgrade feature list)
- Fixed invalid HTML nesting on the settings page
- Removed dead upgrade-button and stale admin-slug CSS rules
- Fixed empty nonce field on the General Settings tab
1.0.1
- Fixed leaderboard CSS
- Updated settings page title
- Removed "Get Pro Version" tab
- Added support for legacy order flags in leaderboard
1.0.0
- Initial release
- Forked and rebranded with security improvements
- Added donation leaderboard shortcode
- Added donor privacy controls at checkout
- Removed external update checker (phone-home)
- Fixed SQL injection vulnerabilities
- Added nonce verification to AJAX handlers
- Sanitized all user inputs
Full description
ShowLove Donations adds a donation form to your WooCommerce site and optionally a Donation Leaderboard. Visitors can choose their own donation amount and optionally leave a message with the donation.
How it works
On activation, ShowLove creates a virtual WooCommerce product to track donations. Use the [sld_donation] shortcode to display the donation form on any page or post.
If you prefer, you can create your own donation product to override the ShowLove default product (simple, virtual) and select it in ShowLove -> General Settings -> Select Donation Product.
Multiple campaigns
To run separate campaigns (e.g. "Support Education", "Wildlife Fund"):
- Create a simple, virtual product for each campaign
- Check "Donation Product" on the product's edit page - this replaces "Add to Cart" with a donation form
- Either link to the product page directly, or use
[sld_donation product_id="123"]to embed that campaign's form anywhere
Donor leaderboard
Display your top donors with [sld_leaderboard]. Donors can choose to remain anonymous at checkout.
Shortcodes
Donation Form:[sld_donation][sld_donation product_id="123"]
Donation Leaderboard:[sld_leaderboard] - Shows top 10 donors by total[sld_leaderboard limit="5"] - Limit number shown (1-100)[sld_leaderboard orderby="date"] - Sort by most recent instead of highest[sld_leaderboard style="2"] - Use bordered style[sld_leaderboard limit="5" orderby="total" style="2"] - Combined options
Template Code
<?php echo do_shortcode('[sld_donation]'); ?><?php echo do_shortcode('[sld_leaderboard limit="10"]'); ?>
New releases are announced in the newsletter.
Consult
For organisations
Deciding what to build, whether to build it at all, and how to run it afterwards. I help you choose the right tools, find the right hosting, and work out what to keep in-house and what to hand out — and whether AI belongs in your workflow, and where it doesn’t.
For people
Owner-operators who need a trusted second pair of eyes, and learners who want to move past tutorials to finally understand their own site instead of fearing it.
The perspective
I look at building a business on the web through a different lens: as someone who has planned, run, and consulted for organisations far outside the internet — and who runs his own small online business, 6 Treasures, on this exact stack.
Booked time, by the hour, by video (kMeet) or in writing (Matrix): CHF 85 an hour, the first half hour free. Larger engagements — systems, integrations, longer advisory — by conversation.
About
Before I wrote software for a living, I was an aerospace engineer, a planning engineer, a logistics engineer, a programme manager, and a business consultant. I have spent most of my career doing one thing in different costumes: understanding how a system fits together, then making it run reliably. Websites and apps are simply where I do that now — and after decades of doing it, I still open the code editor with the same appetite I had on day one.
Design, to me, is not decoration. It is deciding what to leave out, then making what remains entirely obvious to the person using it.
I work alone, by choice, with tools chosen deliberately: open-source software where possible, Swiss hosting always, and nothing that sells my clients’ data. I also work with AI daily — Claude is effectively my pair programmer and sparring partner. It makes me faster; it does not make the decisions. Everything that ships has been through my hands and my judgement.
You won’t find me on social media, though I can give you advice on it. You will find me on the phone or in a café: my clients get my personal number, my email, and my Telegram.