Kiekkist
Menu
DE

Guides · 2026-10-31

Bought a theme, what now? From download to a finished website

What comes after buying a website design: export, content, choosing a CMS, EU hosting, domain, legal pages, checks, client handover and maintenance.

Bought a theme, what now?

You have downloaded a design. The ZIP holds pages, tokens, fonts, images and a guide. A few steps remain before it becomes a website that is online, belongs to the client and still runs in two years. Most are quick. A few decide how much work the site will cost you later.

Here they are in the order you need them.

1. Choose an export target: static or WordPress

This first decision shapes almost everything after it.

Static (Astro or plain HTML) means the site is built once and then only files sit on the server. No PHP, no database, no plugins asking for updates at night. For a service page, landing page or funnel with a form, this is almost always the better choice.

WordPress makes sense if the client already knows it, several people publish posts, or a specific plugin is genuinely needed. Then an update plan comes with it, see step 10.

Rule of thumb: if content changes less than once a month, go static. The export commands are in the package README.md.

2. Replace the content

Before you publish anything, replace all sample data: names, addresses, prices, opening hours, photos. Placeholders are marked. Read DESIGN.md first; it lists the building blocks and what they are for.

Three things people forget:

  • Alt text for every new image. One sentence describing what is shown. Purely decorative images get empty alt text.
  • Heading order. Don’t skip levels, one H1 per page.
  • Image rights. Only reuse photos from the client’s old site if you know where they came from. This is the most common trap in migrations.

A simple rule for content structure: five or six section types the client understands beat twenty one-offs nobody touches.

3. Does the client need a CMS?

Honestly: often not. Many small businesses never log in, even when they get an editor. They send an email with the change. You don’t need a CMS for that, only a reliable promise of how fast changes go live.

A CMS pays off when someone publishes regularly without you: blog, case studies, job ads, events. Then the question is which one.

Type Examples Where it runs For editors Ongoing effort Lock-in
No CMS Markdown in the repo nowhere extra n/a, agency edits very low none
Git-based Sveltia CMS, Decap CMS, Keystatic browser UI, content as files in the repo fields, not a page builder; good for text and images low, no database very low, files stay yours
Self-hosted with database Payload, Directus your own server with a database powerful, better for teams high: updates, backups, monitoring per instance medium to high
SaaS Storyblok, Contentful at the vendor very comfortable, visual editing low for you, but a licence medium, tied to an API

What to look out for:

  • Git host: According to its docs, Keystatic works online only with GitHub repositories. Decap supports GitHub, GitLab, Gitea, Forgejo, Bitbucket and Azure. Sveltia CMS positions itself as the successor to Netlify/Decap CMS and supports GitHub, GitLab and Gitea/Forgejo. If your repo lives on your own Gitea or Forgejo, Keystatic is out for online editing.
  • Licence and telemetry: Directus is free for organisations under USD 5M revenue and under 50 employees. According to its pricing page, the telemetry opt-out is an Enterprise feature. If you promise clients data minimisation, weigh that.
  • Framework: Payload is technically strong but built on Next.js. With Astro you work against the grain.
  • EU location: Storyblok is based in Austria. For any SaaS: sign a data processing agreement, check the region, and put the licence in the client’s name, not yours.
  • Accessibility: once the client edits, they can break it. Make alt text a required field and don’t let editors pick heading levels freely.

More in the guide Headless CMS for small websites.

4. Hosting in the EU

A static site needs little: web space with a TLS certificate, ideally with SFTP or Git deployment. Two German examples (list prices, checked 31 Oct 2026):

  • all-inkl Privat: EUR 4.95 per month incl. VAT, three domains included.
  • Hetzner Webhosting S: EUR 1.60 per month net, domain extra.

More important than price: the contract is in the client’s name. Then the site stays online even if you as the agency drop out, and there is no fight when they leave. You get access, the client stays the owner.

Your own server with Coolify or similar is worth it only once you run several sites in a standardised way and have backups, monitoring and updates firmly planned.

5. Domain and DNS

  • The domain belongs to the client, not the agency. If a former agency registered it, sort out the transfer (auth code) before the project starts.
  • A/AAAA record to the host; pick one main address and redirect www or the bare domain to it.
  • Don’t touch mail records (MX, SPF, DKIM) unless you know what they do. A wrong MX record takes the business mailbox down.
  • On a relaunch: list the old URLs and set up 301 redirects, or you lose search traffic.

6. Deployment

Static means: build locally or in CI, upload the dist/ folder. Aim for a path that works without you:

  • A Git repository with a build step that deploys automatically via SFTP/FTPS.
  • A documented fallback: build locally, upload the folder via FTPS.
  • Forms go to your own route or a small script on the client’s hosting, with a honeypot instead of a captcha service. Avoid third-country form services where you can.

German-language designs include scaffolds for imprint, privacy policy and accessibility statement. They are templates with the usual required fields, not legal advice.

  • Imprint (Germany: § 5 DDG).
  • Privacy policy: host, form, analytics, fonts. With zero third-party requests out of the box, the list is short. Every embedded map, video or chat widget makes it longer.
  • Cookie banner: under § 25 TDDDG (Germany, based on the ePrivacy Directive) consent is only needed for device access that is not strictly necessary. Without tracking cookies and external embeds, you need no banner.
  • The operator is responsible for these texts. Have them written or checked by a legal-text service or a lawyer.

8. Accessibility statement

The European Accessibility Act has applied since 28 June 2025 to certain consumer services, mainly shops and online booking. In Germany (BFSG), microenterprises (fewer than 10 employees and at most EUR 2M turnover or balance sheet) are exempt for services. A plain information site for a local trade business usually falls outside it.

You can still use the template in the package. Say honestly what was tested, how, and where people can report barriers. Don’t write “guaranteed compliant”. Whether the site stays accessible also depends on what the client adds later.

9. Check before going live

The design was checked before sale. Your content wasn’t. So after filling it in:

  • Accessibility: an automated test (axe or WAVE), plus by hand: tab through every page, visible focus, zoom to 200 %, form fields with proper labels.
  • Performance: PageSpeed Insights or Lighthouse, mobile. Google’s thresholds: LCP at most 2.5 seconds, INP at most 200 milliseconds, CLS at most 0.1. Only about half of all websites pass on mobile, so it’s worth a look. The most common reason for bad scores after filling in content: oversized photos.
  • Links and form: click every link once, submit the form for real once.
  • Third-party requests: check the browser’s network tab for anything loaded from foreign servers. Out of the box it should be zero.

For context: automated tests find accessibility errors on 95.9 % of the top one million home pages (WebAIM Million 2026). A checked design puts you far ahead, but one image without alt text throws the lead away.

10. Handover to the client

The package has a template for the end client under UEBERGABE/, without any mention of the design vendor. Fill in the placeholders. It should cover:

  • Address, page list, where the source code is.
  • How to edit text and images, matching the chosen technology.
  • Hosting, domain, mailboxes: provider and contract holder.
  • Where credentials are kept (password manager, never in the same document and never by email).
  • Backups: how often, where, when a restore was last tested.
  • What to do in an outage and who can be reached.

11. Maintenance plan

A website isn’t finished at launch. Decide who does what and write it into the handover:

How often What
on security advisories Check whether your stack is affected (PHP version at the host, Node version in the build, CMS). For WordPress: update core, theme and plugins.
monthly Site reachable, TLS certificate valid, form arrives, backup present
quarterly Review content: opening hours, prices, contacts. Update build dependencies and rebuild.
yearly Re-measure accessibility and speed, check domain renewal, try one restore from backup

For a static site this is little work. For WordPress or a CMS with its own database it’s more, and it belongs in the quote rather than happening on the side. Why this matters more now: Operations matter more than design.

If you would rather not do these steps yourself: Heidrich Digital, the web agency behind Kiekkist, sets up a purchased design and runs the site afterwards, at a fixed price after a short call. What is and is not included is on Setup and operation.

Sources

Sources

  1. WebAIM Million 2026
  2. HTTP Archive, Web Almanac 2025, Performance
  3. web.dev: Web Vitals
  4. German Accessibility Strengthening Act (BFSG), § 2
  5. German Digital Services Act (DDG), § 5 (imprint)
  6. TDDDG § 25 (consent for device access)
  7. Keystatic Docs: GitHub mode
  8. Decap CMS Docs: Backends overview
  9. Sveltia CMS Docs: Backends
  10. Directus Pricing
  11. Payload CMS
  12. Storyblok
  13. Contentful Pricing
  14. all-inkl.com web hosting
  15. Hetzner Webhosting

Questions

Do I need a CMS after buying a theme?

No. If content rarely changes or the agency maintains it, a static site without a CMS is enough. A CMS pays off once someone publishes regularly without a developer.

Astro/HTML or WordPress: which export target is better?

For brochure, service and landing pages usually static (Astro or HTML), because there is less to maintain. WordPress fits if the client already knows it and someone takes on updates reliably.

Where can I host a static website in the EU?

With any EU web host that offers TLS, for example all-inkl or Hetzner Webhosting in Germany, or on your own server. The smallest plan is enough for a static site.

Do I need an accessibility statement?

In the EU it is required where the European Accessibility Act applies to the service, typically shops and online booking for consumers. Microenterprises providing services are exempt in Germany. A voluntary statement never hurts.

What belongs in the handover to the client?

Where the site lives, who owns domain and hosting, how to edit content, who does updates and backups, and who to call in an emergency. Credentials separately, in a password manager.

See the galleryAll guides