
PHP bug critique (October 2026): resolved
Regarding the critical PHP vulnerability (PHP2Shell) from October 2026: there is no hack, which we have already done and which is still to come.
Read onSome websites appear on your screen within a second, others make you wait ten seconds. When a website loading slowly, it's rarely by chance. The difference can usually be traced back to a few concrete choices in hosting, code, and media.
In this article:
In a fraction of a second, a lot happens behind the scenes:
Every step takes time, and at each step you can make it shorter or longer. A website that loads slowly loses time on several of those steps at once. That makes diagnosis difficult: there is almost never a single cause.
The first place to look when a website is loading slowly is your hosting. A cheap package where hundreds of sites share one machine will be felt in your loading time. A slow or overloaded server simply takes longer to respond, and you'll see that before the first byte reaches the browser.
Distance is added: if your server is in North America and your visitor is in Asia, that data travels thousands of kilometres back and forth. A CDN (Content Delivery Network) places copies of your site on servers distributed across the world, so a visitor is always served from a nearby location. Often of greatest benefit for sites with an international audience.
The biggest speed gains are often visual. One photo can easily be three or four megabytes, and on a page full of photos, that adds up quickly. Compress your images and use modern formats like WebP or AVIF. The same applies to video: use a separate video host instead of serving large files yourself.
Google's own Guidelines for Largest Contentful Paint Confirm it: images are usually the biggest culprit behind a slow-loading website. Good news: this is also the type of fix you can often implement in an afternoon.
The biggest speed gains are made early in a project, with the fundamental decisions already made then.
– The Fresh-Dev team
The code itself also counts. A lot of heavy JavaScript needs to be downloaded and executed before your browser can display the page. Especially on an older or slower device, your visitor will notice that immediately.
An important concept is render-blocking: code that stops the page from rendering until it's ready. Less of this means your visitor sees something faster. When building a new website, we keep this tight from the start; for existing sites, an audit is often golden.
Nearly every modern website is packed with services from others: analytics, advertisements, fonts, chat widgets, tracking scripts. Each seems innocent enough, but each requests its own connection to an external server. Before you know it, your page loads dozens of external resources, and you're left waiting for the slowest one.
Periodically review your integrations and remove anything you no longer use. It's one of the quickest ways to speed up a slow-loading website. We often find widgets that have been unused for months but are still slowing down every page load.
Before you start optimising, measure first. Tools like PageSpeed Insights, WebPageTest, and your browser's developer tools will show you exactly which file or script is causing the delay. Without that measurement, you're just guessing, and guessing rarely pays off.
Speed is more than just a technical detail. A slow site loses visitors even before it's loaded; people simply click away. Furthermore, loading time affects how well you are found in search engines and how long people stay on your site. Speed directly impacts your reach, your conversion, and your revenue.
Leave your website, then we will analyse it and let you know where the time goes. Within one working day you will have a concrete answer, without any sales talk.
Curious where your website is losing time? We'll map it out and fix it, from hosting and images to code. We'll build you new websiteThen speed is present from the first line. Or plan directly a consultation.

Regarding the critical PHP vulnerability (PHP2Shell) from October 2026: there is no hack, which we have already done and which is still to come.
Read on
We counted 173 contact forms on 58 sites: how many fields they ask for, what a phone field does with your requests, and which two fields can be omitted.
Read on
Website downtime costs more than lost revenue. Seven hidden costs and how to prevent them before they add up.
Read on
Measuring GEO optimisation without search rankings. Six figures that show whether AI mentions you, what you'd better not measure, and how to set up a baseline measurement.
Read on
Search Console has been showing what Google sends to your Instagram, TikTok, X and YouTube since July. We checked twelve Dutch search queries.
Read on
We have combed through four weeks of server logs from 52 sites: 45 per cent human, GPTBot seven times busier than Googlebot and 243 intrusion attempts per day.
Read on