For most organisations, the website is no longer just a brochure. People use it to apply for services, to learn about the organisation, and to find urgent information during a crisis. Teams use it to publish information that others rely on. The website has become part of how the organisation does its work.
Yet the decision that shapes it most is often made quickly: which content management system (CMS) should we use? A CMS is the software staff use to create, edit, and publish a website's pages.
There are many CMS products, but most organisations end up choosing between two kinds. The first is the free or low-cost CMS, and the best-known example is WordPress. The second is the enterprise CMS: large, expensive platforms sold to big organisations with complex needs. Both solve real problems. Both also carry costs that are easy to miss when the choice is made.
The free and low-cost CMS
WordPress is popular for good reasons. It is free to download and quick to set up. There are thousands of ready-made designs, called themes, and add-ons, called plugins, that add features such as forms, galleries, or online booking. Many developers know how to work with it. A small team can have a decent website online within days, and for a simple site, that may be all they need.
The problems appear after launch.
WordPress builds each page at the moment someone asks for it. When a visitor opens a page, the server runs code, pulls content from a database, and assembles the page on the spot. The staff login page usually sits on the same public server as the website. Most of what a WordPress site can do comes from plugins written by thousands of separate developers. Some are well maintained and some are not. Each plugin is more code running on the server, and more code means more places for a security flaw to hide.
Because so many websites run on WordPress, it is one of the most common targets for attackers. One flaw in a popular plugin can put thousands of websites at risk at once. New flaws are found all the time. Some are "zero-day" flaws, which attackers start using before a fix exists. Organisations have had their homepages defaced, harmful code planted on their sites, data stolen, and sites knocked offline when they were needed most.
Keeping a WordPress site safe is therefore not a one-off job. It is ongoing work:
- The core software, themes, and plugins must be updated constantly.
- Every update must be tested, because updating one plugin can break another.
- Extra protection must be added and paid for, such as security plugins, firewalls, monitoring, backups, and more secure hosting.
- Someone must watch for newly found flaws and apply urgent fixes, often outside working hours.
This is the hidden cost of a "free" CMS. The software costs nothing, but keeping it safe takes time, tools, and skilled people, and that work never ends. If it slips even once, the damage is not just financial. It can hurt the organisation's reputation and the public's trust.
The enterprise CMS
Organisations that outgrow WordPress, or cannot accept its risks, often move to an enterprise CMS. These platforms are built for large organisations. They let teams:
- Organise content in a structured way
- Set approval steps before anything is published
- Control who can edit what
- Show different content to different visitors
- Get support from the vendor
For keeping control of a large website, they are a real improvement. But they are heavy to run.
An enterprise CMS usually needs a lot of infrastructure: separate systems for editing content and for serving the website, plus servers, databases, and search. All of it must be kept running and in step. Building a website on these platforms is complicated. It often needs developers trained in the vendor's own tools, usually hired through an outside firm, and projects take months rather than weeks. Licence fees are high and often rise with the number of websites or users.
The costs keep coming after launch. Upgrading to a new version can become a project of its own. A small change to a page layout may need a developer and a formal release. People with the right skills are hard to find and expensive to hire. Over time, many organisations find they are paying mostly for the effort of keeping the platform running, not for what it does for them.
Two options, one shared problem
Both options share the same underlying problem: most of a website's cost comes after it goes live.
With a free CMS, that cost is constant patching, security tools, and the risk of attack. With an enterprise CMS, it is infrastructure, licence fees, specialist staff, and slow, expensive changes. Either way, running a website gets more expensive over time, and the cost grows with every extra website. An organisation running dozens of sites for different departments, brands, or agencies pays these costs dozens of times over. (More in What a website costs after it goes live.)
For years, organisations have accepted this as the only choice: go cheap and live with the risk, or go enterprise and live with the cost and complexity.
Then AI changed how websites are made.
AI changes how websites are made
With the latest AI tools, teams can go from an idea to a working website much faster than before. A designer can describe a page and see it built in minutes. A communications team can try several layouts in an afternoon instead of waiting weeks. A product manager can put together a small website without waiting for developers to be free. Work that once took a project team several months can now start in a single sitting.
This raises expectations. Managers will ask why a new campaign site takes three months when a first version took three hours. Teams will expect to keep improving their sites all the time, not redesign them every few years.
Neither of the two traditional options was built for this.
The enterprise CMS wasn't built for AI
Enterprise CMS platforms were designed for a time when specialist developers built websites slowly, using the platform's own building blocks. Every design had to be rebuilt, piece by piece, inside the platform. That approach assumes design is expensive and changes are rare.
AI turns both assumptions around. A design made with an AI tool cannot simply be placed into a traditional enterprise CMS. Developers still have to rebuild it by hand in the platform's own format, which brings back the delay AI had removed. Where enterprise vendors have added AI, it is usually an extra feature on top, such as a writing helper in the editor. These features are useful, but they do not change how websites are designed, built, published, and improved on the platform.
The free CMS is no better placed. AI can help create a WordPress design, but it cannot remove the plugins, the database, the public login page, or the constant updates. When websites are quicker to create, organisations end up with more websites and more changes, which means more to keep secure. The same AI tools that help people build websites also help attackers find weak spots faster.
Organisations need a platform designed with AI in mind from the start, not an older platform with AI features added on.
Visor started somewhere different
Most website platforms start by solving for speed, flexibility, or ease of use. Each is a sensible place to start, and each shows what the platform's makers cared about most.
- Speed. These platforms get a website online as quickly as possible, with ready-made themes, hosting already set up, and a short path from sign-up to a live site. They suit a team that needs something online this week.
- Flexibility. These platforms are built for developers. A technical team can build almost anything and connect the website to other systems. They suit websites with unusual needs, as long as there is a team to build and maintain them.
- Ease of use. These platforms are built for people who are not technical. Drag-and-drop editors let anyone change a page without writing code. They suit small teams who want to manage their own site without waiting on a developer.
All three focus on the first part of a website's life: getting it designed, built, and published. The questions that come after launch are often left for later. Is the site secure? Who may change it, and who checks those changes before they go live? What happens when ten times the usual number of visitors arrive in the same hour? How do you run twenty sites without twenty times the work?
When a platform isn't designed around these questions from the start, the answers get added afterwards. Security comes from plugins and outside services. Approvals happen over email or by informal agreement. More server capacity is bought when the site slows down, or after it has already gone down. Each new website is set up and maintained on its own. These fixes can work, but they cost money and effort and depend on people remembering to do them.
Visor started somewhere different. Instead of asking "how do we get a website online quickly?", it asked: "what does a website need to stay secure, reliable, and under control for as long as it is running?"
That question came from where the technology was first used: supporting Singapore Government websites. People depend on these sites. Residents turn to them when a new policy is announced, when a scheme opens for applications, or when urgent information must reach everyone at once. On those days, huge numbers of people visit at the same time. If the site goes down, or shows wrong or tampered information, the public feels it directly and loses trust in the organisation behind it.
Working in that setting made five requirements clear, and the platform was built around them from the beginning.
- Stay up during sudden spikes. Public demand doesn't build slowly. It arrives all at once, often with little warning, so a site must handle a spike without slowing down or failing.
- Check content before it's published. What appears on the site must be accurate. There must also be a clear record of who wrote it, who approved it, and when it went live.
- Hold every site to the same standards. An organisation with many sites needs all of them to follow the same rules for security, design, and publishing.
- Build security in, not on top. If one site is broken into, trust in all of them suffers. The platform itself must make break-ins hard, rather than relying on tools added later.
- Stay easy to run after launch. A website spends most of its life being updated and maintained, not being built. The platform must make that ongoing work simple, not just the first launch.
These requirements came from running websites where mistakes are public and there is little room for failure. Visor is built on those lessons.
The harder question: what happens after you build it?
AI has made creating a website much easier. But building a website quickly is only the first step. The harder part is everything that comes after:
- How do you keep it secure, when every new site is one more target for attackers?
- How do you control changes, when anyone can produce new content and layouts in minutes?
- How do you look after dozens or hundreds of websites without the work and cost growing with each one?
- How do you keep them running when visitor numbers suddenly jump?
- How do you keep improving them, when AI lets people make changes faster than your current processes can handle?
These are the questions Visor was built to answer. It takes what was learned running Singapore Government websites and applies it to a world where more and more websites are made with AI.
What Visor is
Visor is a single platform that covers the whole life of a website: creating it, managing it, and keeping it under control. It is made of two parts: a website platform and a CMS. The website platform hosts, deploys, and secures your websites, and keeps them online when visitor numbers jump. The CMS is where your team creates, edits, and approves content. An organisation can run many websites on Visor at once. Each website is kept separate, but all of them share the same platform, the same rules, and the same central controls.
The approach is simple. Your team designs and builds with the AI tools they prefer. The result is brought onto Visor, which provides what is needed to run it properly:
- Tools for managing many sites
- Reusable templates
- Approval steps
- Content editing
- Secure publishing
- A choice of where to host
- Central control over all of it
Each part of Visor deals with one part of the problem.
Build and change websites with AI, directly on the platform
Visor works with the AI tools teams already use, such as Claude Design, instead of forcing them into a design tool of its own. Teams can use AI to explore ideas, try different layouts, and refine a website quickly.
The difference is how that work reaches the platform. Visor offers DaaS (Data-as-a-Service), which lets outside tools, including AI tools, connect directly to the websites and content held on Visor. Any website, whether built with an AI tool or already live, can be brought onto the platform and into the CMS using AI. This makes onboarding quick and easy, with no need for developers to rebuild the site by hand.
The connection is not just for bringing websites in. Teams can also use AI to prepare:
- New websites, built from scratch and connected directly to the CMS, and new pages
- Edits to existing content
- Ongoing changes to sites already on the platform
By default, the DaaS connection is read-only. AI tools can see the websites and content on Visor, but they cannot change anything on their own. Anything AI prepares, whether a new website, a new page, or an edit, goes live only after a person reviews and approves it. Each organisation can have this set up differently, depending on how much it wants AI to do on its own.
This makes AI part of how websites are built and maintained every day, not something used once at the start of a project. And people stay in control of what actually gets published. (More in Using AI to build and change websites on Visor.)
Secure, and able to handle sudden surges in visitors
When a website comes onto Visor, the platform turns it into static pages. A static page is prepared in advance and stored as a finished file, instead of being built from a database each time someone visits.
This matters for security. With static pages, visitors have no database to reach, and no plugin code runs when a page loads. The system staff use to edit content is kept apart from the pages the public sees. Many of the weak spots that make other platforms hard to protect simply are not there, so far less needs constant patching.
It also matters when traffic surges. Because pages are ready in advance, they are easy to copy and serve to very large numbers of people at once. A big announcement, a campaign that takes off, or a deadline that draws a rush of visitors does not overload a server. The website stays up when people need it most. (More in Why pages built in advance are safer and stay up.)
A CMS built for large organisations
Static pages handle how a website reaches visitors. The CMS handles how it is managed day to day. Visor includes a full CMS built for large organisations:
- Approval steps (workflows). Content is drafted, reviewed, and approved before it is published. Every change has a clear owner, and nothing goes live without the right sign-off.
- Widgets. Ready-made page building blocks that editors can add and arrange themselves, without asking a developer.
- Data functions. Tools for managing structured information and showing it on pages, so a website can do more than display fixed text.
Editors can work quickly on their own while the organisation stays in control. The rules are built into the platform instead of depending on people remembering them. (More in Inside the Visor CMS: approvals, building blocks, and data.)
Many websites on one platform
Most organisations run more than one website: a main site, sites for campaigns, sites for departments or agencies, and portals for particular audiences. On traditional platforms, each new site means more infrastructure, more cost, and more upkeep.
Visor is built so that many websites run on the same platform. Each website can be run by its own team, while the rules for security, branding, and publishing are set once and applied to all of them from one place.
Templates make this practical. You build a website template once, set it for your group, and use it to create new websites. Each new site starts with the right structure, design, and rules already in place. Consistency happens by default instead of through checks afterwards, and setting up the fiftieth website takes no more effort than the fifth. (More in Running fifty websites like one.)
Hosted in the cloud or inside your own network
Not every website is meant for the public. Many organisations need staff portals, internal knowledge bases, or sites that must stay within a private network for security or regulatory reasons.
Visor can be hosted in the cloud or inside your organisation's own private network (intranet). Internal websites get the same platform, the same controls, and the same way of working as public ones. Teams don't need a separate system for internal sites, and organisations with strict rules about data and networks don't have to compromise.
Websites that keep improving
With AI, websites no longer need to wait years for a redesign. They can be improved continuously.
Every Visor website has built-in ways for visitors to give feedback, showing what works for them and what doesn't. AI can help teams work out what to change based on that feedback. Through DaaS, AI can read the website's content, suggest improvements, and prepare the changes, which a person then reviews and approves before they go live. Organisations don't have to guess at improvements. Each website gets better the more it is used, and every change still passes through the same approval steps. (More in Websites that keep getting better.)
Lower running costs
Visor was built from scratch with a modern, efficient design, so it avoids much of the cost of older platforms:
- Static pages need far fewer servers to run.
- New websites join the existing platform, so they don't need their own separate setup.
- Security is part of how the platform works, which removes much of the updating and extra tooling that make "free" platforms expensive over time.
The result is what large organisations need at a competitive price, with running costs that stay manageable as the number of websites grows. The hidden costs of both traditional options are dealt with at their source.
Engineers who work with your team
Some organisations want extra hands, especially for their first projects. Visor offers Forward Deployed Engineers from Xtremax's central professional services team.
These engineers work alongside your team to build your websites on Visor. They know the platform well and have experience with demanding projects. They can help you launch your first site, set up templates for your organisation, or deliver a large set of websites faster. Your team doesn't have to build all that know-how first.
Tested on Singapore Government websites
Many platforms say they are secure and reliable. Visor's technology has been used to run Singapore Government websites. There, people depend on the information being available, correct, and safe, and visitor numbers can jump without warning. It was shaped by real traffic surges and real requirements for control and accountability, not by guesses about how websites might be used.
That experience comes with Visor to every organisation that uses it.
Fast to build, safe to run
AI has made building websites much faster, and teams that use it well will move faster than ever. But building quickly without security, control, and reliability just means problems arrive faster too.
Visor brings the two together. Use AI to create and change your websites. Run them on a platform already tested in one of the most demanding settings there is.
AI makes it faster to build a website. Visor makes sure what you build can be run safely and reliably, whether you have one website or hundreds.
