Eternal Beauty by B

What it is

A custom WordPress theme for a family-run Japanese head spa salon. No Elementor, no Divi, no off-the-shelf theme. Hand written PHP templates, semantic markup, and a performance budget that survives contact with a client who wants one more video on the homepage.

It is also the first site on wp-base, the WordPress framework I now maintain as a Composer package and run across the client sites.

Why a framework instead of a starter theme

The usual approach is to keep a good starter theme and copy it forward. That works until the second site, and then it quietly stops working.

Two earlier sites from a common starting point were left to evolve separately and drifted badly apart, which is the whole reason wp-base exists. The full account is in its own case study.

wp-base inverts the copy-forward habit. Shared behaviour lives upstream and ships as config-gated modules. The theme declares what it wants and bridges only what has to be computed late.

• Consent
• Seo
• Security
• Comments
• Assets
• Blocks

The version is pinned in composer.lock and checked against the framework's latest stable tag, so both live sites provably run the same release. A framework bug gets fixed upstream and the pin gets bumped; patching around it inside the site is how the drift happened last time.

Consent, done properly rather than visibly

Cookie consent is default deny with a real reject, not a dismiss button that records acceptance. It runs Google Consent Mode v2, so tags load in a denied state and update only on an explicit choice.

Getting it right was less about the banner than about verifying it. The consent behaviour ships from the framework, so the failure worth reading about lives in that case study; the habit it produced here is that a consent change is checked on the served page, not in the test output.

Hardening

Both client sites had the standard WordPress author enumeration surface closed: the REST users endpoints, the ?author= redirect, the oEmbed author name, the RSD link, and XML-RPC pingback.

One detail generalises. Four of the five closed cleanly on the first attempt and the fifth kept leaking, because the block was hooked at the same priority WordPress core uses for its own canonical redirect, and core registered first. Moving one number fixed it. A partial success is the most convincing false pass available, because the evidence that it works is real, just not about the part that is broken.

Performance and access

WebP imagery, a video hero with a poster fallback that carries the first paint, non critical assets deferred. Real headings, keyboard traversable navigation, contrast checked rather than assumed.

No page builder means every block on the page is one I wrote, so there is no unused stylesheet, no surprise query, and no plugin compatibility roulette on the next WordPress release. A small business with one core service gets more from a tight purpose built theme than from a kitchen sink theme shipping 200kb of CSS it will never use.