Why I rebuilt my website, and what I decided myself

Last week PHP shipped emergency patches for two critical bugs: unauthenticated code execution, rated 9.2 out of 10, and already being exploited before the patch existed. Every version since 2012 is affected. The normal thing to do is update and move on.

I used it as an excuse for something else: rebuilding my personal website.

What was there

The old one dated from 2018 and lived on shared PHP hosting. It had a mailer.php for the contact form and a public info.php I forgot to delete. I don't know whether it was vulnerable; the problem is that I didn't know before either. A site you haven't looked at in eight years is a site you don't know what it does.

What is there now

The new one runs nothing on the server. It is a single HTML file with its CSS and JavaScript, no frameworks, no dependencies. It is prerendered at build time, so it reads in full without JavaScript, and Google reads it in full too. It comes in Spanish and English, has a dark mode, and a chart of my career where each bar is as long as that stage really lasted, from 1998 to 2026.

The only thing that runs on a server is the contact form: a Node function that sends the email over SMTP from my own domain, with no third parties in between. Less surface to patch.

How it is built

The build is a Node script. It loads the page in jsdom, lets the page's own JavaScript render it and saves the resulting HTML, once per language. Fonts are served from this domain, the sitemap and the feed are generated automatically, and every push to the main branch deploys to Vercel. The note you are reading was written in Markdown and went through the same script.

Who did what

An AI agent, Claude Code, wrote the code. It tested it on desktop and mobile, ran Lighthouse and deployed it. I didn't write a single line.

But I made every decision. And that is the part I wanted to talk about, because that is where the work is.

What to build. A static page that reads without JavaScript, and a form that sends over my own SMTP. Nothing else on the server.

What not to build. Frameworks, a downloadable CV, analytics with cookies. Everything that isn't there is one thing less to maintain or explain.

What to reject. Three versions of the project picker, two names for the game, and a violin that looked like a cello. AI proposes fast and proposes a lot; saying "not that" is half the job.

What to hide. This site has a false bottom: a magic trick, seven stations to find and a password to get out, with an easy mode for those outside the trade. And a tribute to Juan Tamariz. I won't say more: the fun is in the search.

The numbers

At launch, Lighthouse on mobile scored 98 for performance and 100 for accessibility and SEO. 256 KB in total, fonts included: less than a photo taken with a phone.

What I take away

Rebuilding it forced me to look back: 27 years of programming, six companies, three projects of my own and a hobby that appears on no CV. And I realised I had told almost none of it. This section exists for that: one note every Tuesday until Christmas, the long version of what I post on LinkedIn.

AI multiplies what you already know how to do. The decisions, the taste and knowing when to say "not that" are still the job.