Written by Eric Gockel
Last year we published the exact software stack behind Cre8. A year later, roughly a third of it has changed.
Most of the changes weren’t about finding better features. They were about removing tools we weren’t using, closing security gaps, and eliminating work that shouldn’t require someone to remember to do it.
Same rules as last year: no sponsorships, no affiliate links, and nothing we don’t actually use. The tools we dropped, and why, are at the end.
Lead Management → Zoho CRM
Still Zoho. The Deals module is the pipeline: proposals, closed-won, closed-lost, dollar amounts. Follow-up tasks live there only for dormant accounts; once a deal is active, the work moves to Asana and Zoho stops being the record.
The website chat widget is gone. See the dropped list.
Project Management → Asana
List view with a custom Status field, unchanged. New: A script writes Actual Hours from Harvest to every task, and a formula field subtracts it from the estimate, so the remaining budget is visible on the task instead of in a report somebody has to run. Client communication runs in Asana comments wherever the client will work that way.
Time Tracking & Billing → Harvest + QuickBooks Online
The Harvest timer inside each Asana task is still how time gets logged, and it matters more than it looks: entries created that way carry the task ID the Actual Hours sync keys on. Time logged any other way doesn’t show up in the budget.
Harvest is the source of truth for invoicing. Invoices are drafted from tracked time there, copied into QuickBooks Online, and sent from QuickBooks. Invoicing a client is also how we close that client’s period; Harvest’s own timesheet lock is all-or-nothing across every client. Harvest changed owners and repriced this year. We cut from five seats to three and stayed, because rewriting the Asana sync would cost more than the increase. Contractor payments go out by ACH through Melio.
CMS & Dev Workflow
- Stack: WordPress leads. We also maintain Craft CMS and ExpressionEngine sites, one DotNetNuke install, and one WordPress site with a React app embedded in the theme.
- Repos: one private GitHub repo per client. A push to main deploys via git pull on the server through a GitHub Action. With the whole WordPress root in the repo, a diff on core after an incident shows exactly which files were touched.
- Minor core updates come from
WP_AUTO_UPDATE_COREset to minor in wp-config. The catch on repo-deployed sites: WordPress skips auto-updates when it finds a .git folder in or above the docroot, and logs nothing, so those sites also need a one-line override for that check. - Update policy: core minors automatic, majors by hand at the first point release, plugin auto-updates off and applied manually on security releases.
Hosting & Edge → Plesk + Cloudflare
Sites we manage go on Plesk, on Liquid Web, and migrations go Plesk to Plesk. Plesk’s migration tool carries crons, deploy keys, and subscription settings across; a move to a managed-WordPress tier does not, and the audit afterward is the hidden cost. We stopped putting new sites on managed tiers after a run of problems, the last being renewed certificates deployed without the intermediate chain.
Cloudflare runs in front of every site where we keep DNS. The standard login rule: five login POSTs per minute per IP, then a ten-minute ban, with a skip rule for the client’s office IP. The first version used a one-hour ban and no exemption, and a client whose whole office shares one IP locked itself out before lunch. The rule was right; the ban length and exemption were not. Turnstile replaced reCAPTCHA on forms. Pingdom monitors uptime on every site we touch, regardless of support tier.
Security → 1Password + a plugin tracker we wrote
1Password handles credential management, with shared vaults and access controls.
With plugin auto-updates off, something has to watch for security releases between passes. We wrote a script that matches each site’s plugin list against the Wordfence vulnerability feed, free for commercial use, every Thursday morning. It also watches the ExpressionEngine, Craft, and DotNetNuke release feeds and checks front-end libraries against retire.js. The first live run found an unauthenticated file-write hole in a forms plugin on a client site. No agent plugins on client sites; no dashboard subscription.
Site Email → Resend + WP Mail SMTP
Form notifications and transactional mail from client sites go through Resend, one account per client, free tier. WP Mail SMTP on the WordPress side; the ExpressionEngine sites talk SMTP to Resend directly.
QA & Testing
Unchanged: releases are checked on real browsers and devices, not a screenshot farm. Update passes run on a staging copy first, and the site repo records what was applied, so a regression has a diff to point at.
Analytics & Tagging → GA4 + Clarity + GTM
Same three tools; the plumbing is new. A service account pulls weekly source and medium data from the GA4 Data API into a CSV; a second script pulls Search Console, and both feed a monthly search sweep per property. CookieYes handles consent where the site’s tracking and applicable requirements call for it. We don’t add banners by default, and we don’t deploy consent notices that promise controls the site doesn’t actually enforce.
Communication
Asana comments carry most client communication, so the decision sits next to the task it changed. Google Meet for calls. Mailchimp still sends the newsletter.
File Backups → Dropbox
Nightly database and file dumps still land in a dedicated Dropbox account. Retention was the setting nobody made: dumps piled up until the quota filled. We wrote Dropbox Cleaner, a Bash utility that prunes old backups at the destination while keeping a minimum number of recent files.
What didn’t earn its place?
- SendGrid → Resend. The price went up, and the interface got worse.
- Zoho SalesIQ, the website chat. Retired in December after months with no real conversations.
- Semrush and Ahrefs. We paid for both and no recurring deliverable pulled from them. Search Console covers our own sites.
- Managed-WordPress tiers for new sites. Auto-updates still needed nudging, assisted migrations broke URLs on four sites out of four, and the certificate chain issue was the last straw.
- The shared credential spreadsheet → 1Password.
- Melio’s QuickBooks sync moved behind a paid plan in September. We stayed free and categorized from the bank feed.
The tools are only half the stack
The other half is knowing which system owns what, what gets checked automatically, and who is responsible when something breaks.
That’s what makes a collection of tools into a workflow you can rely on.
If you’re planning a new build or trying to make sense of an existing platform, get in touch. We’ll help identify what to keep, what to replace, and what to stop paying for.