Lawyers: A Friendly Guide to Your DIY Website

Most lawyers are going to build their own website, and that is genuinely fine. You know your practice, you know your clients, and you are more than capable of putting something together that works. What I have found, though, is that the things that trip people up are rarely about design or content. They are the foundational decisions made early on that are easy to get wrong because nobody told you about them upfront.

This site exists partly because I enjoy building free tools and writing guides for lawyers even when there is no transaction involved. If something here saves you a headache or a few hundred dollars, that is the whole point. The disclaimer generator is a good example of that philosophy, and so is this guide. Let's get into it.

1. Choose Managed WordPress Hosting

   The hosting decision is the most consequential early choice you will make, and it is also the one where the options that seem attractive upfront tend to cause the most problems later. Cheap shared hosting from companies like Bluehost or GoDaddy is inexpensive for a reason: your site shares server resources with thousands of other sites, security is minimal, and when something goes wrong, support is slow and often unhelpful. On the other end, a raw cloud server from DigitalOcean or Vultr gives you full control and excellent performance, but it requires ongoing server maintenance that is genuinely technical work.

   For a lawyer building and managing their own site, the sweet spot is managed WordPress hosting. The servers are taken care of for you, WordPress is pre-installed and kept updated, backups happen automatically, and security is handled at the infrastructure level. You pay more than shared hosting, but you get back the time and peace of mind that would otherwise go toward server problems. Here is how to evaluate your options:

   1. Start with Cloudways, Kinsta, or WP Engine. All three are legitimate managed WordPress hosts used by professionals. Cloudways tends to be the most affordable starting point. Kinsta and WP Engine offer more hand-holding and support at a higher price.
   2. Expect to pay somewhere between $15 and $35 per month for a single site on a starter plan. That is the realistic range for managed hosting that is actually managed.
   3. Confirm the plan includes: automatic daily backups with one-click restore, a free SSL certificate, and a staging environment (a private copy of your site where you can test changes before they go live).
   4. Avoid any host that does not clearly state where your data is stored or that routes your traffic through servers in countries with weak data protection laws. For a lawyer, data residency matters.

   If you are already on shared hosting and things are working fine, you do not necessarily need to move immediately. But if you are starting fresh, start on managed hosting. Migrating later is doable but adds unnecessary work.

2. Get a Professional Email Address on Your Own Domain

   Using a free Gmail or Outlook address for your law practice looks unprofessional, and in some states it creates bar questions about firm identity and trade names. More practically, free consumer email accounts come with terms of service that allow those companies to scan, analyze, and use your data in ways that are difficult to fully opt out of. Your clients deserve better, and so does your practice.

   The fix is straightforward: get a paid email account tied to your own domain. You get an address like [email protected] and the email itself is hosted on infrastructure with meaningful contractual protections rather than advertising-driven ones. Here is how to set it up:

   1. If you already have a domain, go to either Google Workspace or Microsoft 365 and start a trial. Both offer plans starting around $6 to $8 per user per month that include professional email on your domain.
   2. During setup, you will be asked to verify that you own your domain. This involves adding a short TXT record to your domain's DNS settings. Your domain registrar's help documentation will show you exactly where to do this. It sounds technical but takes about five minutes once you find the right screen.
   3. After verification, follow the provider's instructions to set up MX records so that email sent to your domain is routed to your new inbox. Your registrar's DNS panel is where this happens as well.
   4. Enable two-factor authentication on your new email account before using it for anything client-related. This single step prevents the vast majority of email account compromises.
   5. If your practice involves particularly sensitive matters and you want stronger protection than a contractual promise from Google or Microsoft, Proton Mail is worth considering. Unlike the major providers, Proton uses end-to-end encryption, meaning even Proton cannot read your emails. It is not for everyone, but it is the right choice for some practices.

   Whatever you choose, the key is getting off free consumer email. The domain-tied paid plans from Google and Microsoft are a reasonable baseline. The main practical difference between them for a solo lawyer is that Microsoft 365 includes the desktop Office apps, which matters if you rely on Word and Excel.

3. Use Secure Messaging for Sensitive Client Conversations

   Email is fine for a lot of things, but for sensitive client conversations, WhatsApp, regular SMS, and consumer video tools like Zoom's free tier are harder to justify. WhatsApp is owned by Meta, whose business model is built on data. Standard SMS is unencrypted. Zoom's free tier has had documented privacy issues and its terms have historically allowed broad data use. None of these are catastrophic if used carefully, but they are not the right tool for confidential client communications.

   The good news is that the alternatives are easy and free. Here is how to set up something better:

   1. Download Signal on your phone. It is free, open source, and end-to-end encrypted by default for both messages and calls. It works exactly like a regular messaging app. Ask clients who are comfortable with it to use it for sensitive back-and-forth.
   2. For clients who want to contact you directly through your website, the Lawyer Locker WordPress plugin adds an encrypted client messaging portal directly to your site. Messages stay on your server rather than passing through a third-party platform.
   3. For video calls, Signal supports encrypted video calls as well. If you need something more formal, Zoom's paid plans include a Business Associate Agreement option and improved privacy controls, which is a meaningful step up from the free tier.
   4. You do not need to overhaul everything at once. Start by using Signal for the conversations where confidentiality matters most. That alone is a significant improvement over WhatsApp or SMS.

   The standard you are working toward is not perfection, it is "reasonable efforts" under Rule 1.6. Signal on your phone for sensitive messages is reasonable. WhatsApp for case strategy is harder to defend.

4. Keep Your Plugins Minimal

   WordPress plugins are one of the things that make WordPress great, and one of the things that cause the most problems on lawyer websites. Every plugin you install is a piece of software that needs to be kept updated, can conflict with other plugins, and represents a potential security vulnerability. A site with 25 plugins is not more capable than one with 8, it is just more fragile.

   The goal is to install only what you actually use and nothing else. Here is a practical approach:

   1. Log in to your WordPress dashboard and go to Plugins. Look at the full list. For each one, ask: is this actively doing something visible on my site right now? If you are not sure what a plugin does, it probably should not be there.
   2. Deactivate anything you do not recognize or are not actively using. Deactivation is reversible, so it is safe to start there before deleting.
   3. A lean lawyer website generally needs: one SEO plugin (Yoast or All in One SEO), one security plugin (Dam Spam or Tiny 2FA), one caching plugin (Snappy or WP Rocket), one contact form plugin (Contact Form Zero or Contact Form 7), and a backup plugin if your host does not handle backups automatically. That is roughly five plugins. Everything else should have a specific justification.
   4. Delete plugins that are deactivated and that you have decided you do not need. Deactivated plugins still sit on your server and can still be exploited if they contain vulnerabilities.
   5. Make sure every remaining plugin is updated to its current version. Go to Dashboard, then Updates, and apply any available plugin updates.

   When you are evaluating a new plugin in the future, check two things before installing it: the date of the last update (anything not updated in over a year is a concern), and the number of active installs (more installs generally means more eyes on the code and faster security fixes).

5. Write Your Homepage for Your Client, Not Yourself

   This is the most common mistake on lawyer websites, and it is an easy one to make because your instinct is to establish credibility by leading with your background. The problem is that someone who just found your site after searching "divorce attorney near me" does not start by caring about your credentials. They start by caring about their problem. If your homepage opens with your biography, your law school, and your years of experience, you are answering a question they have not asked yet.

   Reorienting your homepage around the client's perspective is one of the highest-return changes you can make. Here is how to approach it:

   1. Read your current homepage as if you are a stranger who just arrived from a Google search. What is the first sentence? Does it speak to a problem this person has, or does it speak to your resume?
   2. Rewrite your opening line to address the client's situation directly. Something like "Going through a divorce is one of the most stressful things a person can face. I help people in [City] navigate it with clarity and as little conflict as possible." That is specific, human, and about them.
   3. Move your bio lower on the page, below the section that explains what you do and who you help. Your credentials matter, but they work better as supporting evidence after the client already feels like you understand their situation.
   4. Make sure your homepage answers three questions clearly within the first screen of content: What do you do? Who do you help? What should someone do right now to take the next step? The answer to that last one should be a visible phone number or contact link, not something buried at the bottom.
   5. Read the page out loud. If it sounds like a resume, revise it. If it sounds like a conversation with someone who needs help, you are in good shape.

   You do not need a copywriter for this. You just need to write the way you would talk to a potential client who called you on the phone for the first time.

6. Add the Required Disclaimers for Your State

   A website disclaimer is not optional for lawyers. Without one, you risk implying an attorney-client relationship with people who contacted you through your site, and depending on your state, you may be out of compliance with your bar's advertising rules. The requirements vary significantly: New York requires "Attorney Advertising" on your homepage, Missouri mandates specific verbatim language attributed to the Missouri Supreme Court, and Iowa specifies a minimum font size. A generic disclaimer copied from another firm's footer may not satisfy your state's rules at all.

   Here is how to get yours sorted:

   1. Use the disclaimer generator on this site. Enter your name, state, and practice area and it will produce a disclaimer that incorporates your state's specific required language, including any verbatim phrases your bar mandates.
   2. Create a dedicated page on your site at a URL like /disclaimer or /legal and paste in the generated disclaimer. Publish it.
   3. Add a link to that page in your site's footer so it appears on every page.
   4. If your state requires specific language to appear on the homepage itself (New York, Iowa, Missouri, and others), add that language directly to your homepage. A footer link to a disclaimer page is not sufficient for homepage-specific requirements.
   5. Add a short notice directly above the submit button on any contact form on your site. Something like: "Submitting this form does not create an attorney-client relationship. Information you send before we confirm representation is not confidential and is not protected by attorney-client privilege."

   Bar advertising rules change, so it is worth a quick review of your state bar's current guidelines every year or two. The disclaimer generator is a solid starting point, not a substitute for staying current.

7. Set Up Automatic Backups

   Websites break. Plugins conflict, updates go wrong, hosting problems happen, and occasionally sites get hacked. When that happens to a site with no recent backup, recovery ranges from painful to impossible. When it happens to a site with a backup from yesterday, recovery is usually a few clicks and thirty minutes. This is one of those things that feels unnecessary right up until the moment it is not.

   Here is how to make sure you are covered:

   1. Check whether your hosting provider includes automatic backups. Most managed WordPress hosts (Cloudways, Kinsta, WP Engine) do daily backups by default. Log in to your hosting dashboard and confirm backups are enabled and look at the most recent backup date to verify they are actually running.
   2. If your host does not include backups or you want a second copy stored somewhere independent, install the UpdraftPlus plugin. The free version supports scheduled automatic backups and lets you store copies to Google Drive, Dropbox, or another remote location.
   3. Configure UpdraftPlus to run daily backups and to keep at least 7 days of history. Go to Settings, then UpdraftPlus Backups, then the Settings tab. Set the backup schedule for files and database both to Daily, and set the number of copies to retain to 7.
   4. Connect it to a remote storage location. Under the remote storage options in the Settings tab, choose Google Drive or Dropbox, authorize the connection, and save. This ensures your backup exists somewhere other than the server that just had a problem.
   5. Run a manual backup right now and confirm it completes successfully. Go to the UpdraftPlus dashboard tab and click "Backup Now." Watch it run through to completion and verify the backup appears in the Existing Backups list.

   Once this is set up you never need to think about it again. The cost of five minutes of configuration is unlimited peace of mind on this particular front.

8. Check Your Page Speed and Fix the Easy Things

   Page speed affects whether people stay on your site and, through Google's Core Web Vitals, it affects your search rankings directly. A slow site is not just a technical problem, it is a first impression problem. Most speed issues on lawyer websites come from the same handful of causes, and several of them are straightforward to address without touching code.

   Here is how to diagnose and start improving yours:

   1. Go to PageSpeed Insights and enter your homepage URL. Run the test for both Mobile and Desktop. You will get a score from 0 to 100 and a list of specific issues.
   2. The most common issue on lawyer sites is oversized images. If PageSpeed flags this, go into your WordPress media library and replace large images with compressed versions. Squoosh is a free browser tool that compresses images without visible quality loss. Aim for images under 200KB for most uses, and under 100KB for anything that appears above the fold.
   3. Install a caching plugin if you do not have one. Caching stores a pre-built version of your pages so they load faster for every visitor. Snappy requires almost no configuration. Install it, activate it, and enable caching from its settings page.
   4. Check how many web fonts you are loading. Every custom font is an additional request that adds load time. If your theme loads four or five font variants, consider whether you actually need all of them. Most themes let you limit font weights in the customizer.
   5. If your score is still poor after addressing images and caching, look at the "Render-blocking resources" section of the PageSpeed report. This usually points to scripts or stylesheets loading in a way that delays your page. Your caching plugin may have options to address this, or you can look into a plugin like Autoptimize for further optimization.

   A score above 70 on mobile is a reasonable target for a lawyer website. Getting from 40 to 70 is often achievable with just the image compression and caching steps above.

9. Install a Security Plugin and Do a Basic Hardening Pass

   WordPress is the most popular website platform in the world, which makes it the most targeted. The attacks are almost never aimed at you specifically. They are automated bots scanning for known vulnerabilities across millions of sites simultaneously. A basic security setup stops the vast majority of these cold, and it takes less than an hour to put in place.

   Here is where to start:

   1. Make sure your WordPress admin account does not use the username "admin." Go to Users in your dashboard and check. If your account username is "admin," create a new administrator account with a different username, log in with the new account, and delete the old one.
   2. Change your WordPress login URL from the default /wp-admin to something less obvious. A small dedicated plugin like WPS Hide Login handles this with no configuration. The default login URL is the first thing bots try.
   3. Install Tiny 2FA and enable two-factor authentication for your admin account. This means that even if someone gets your password, they cannot log in without your phone. Go to Users, then your profile, and follow the setup instructions after the plugin is active.
   4. Install Dam Spam to block automated spam submissions to your contact forms and comment sections. It works without CAPTCHAs or any configuration, so there is nothing to set up beyond activating it.
   5. Go to Settings, then General, and make sure "Anyone can register" is unchecked unless you actually need open registration on your site. Most lawyer sites do not.

   These are proactive measures rather than reactive ones. You are removing the most common attack vectors before anything goes wrong, rather than waiting to clean up afterward. Revisit your WordPress dashboard every few weeks to apply any available updates to plugins and themes, as keeping software current is the single most effective ongoing security habit.

10. Write at Least One Piece of Genuinely Helpful Content

    Most lawyer websites have an "About" page, a "Practice Areas" page, and a "Contact" page, and that is about it. That is enough to exist, but it is not enough to be found. Search engines rank pages that answer questions people are actually searching for, and a site with nothing but static firm information gives them very little to work with. One substantive piece of content that genuinely helps someone understand something they were confused about does more for your visibility than a dozen keyword-stuffed service pages.

    Here is how to approach writing something worth reading:

    1. Think about the question you get asked most often by potential clients before they hire you. That is your topic. It is almost certainly something people are searching for, and you are more qualified to answer it than anyone.
    2. Write it as if you are explaining it to a smart friend who knows nothing about law. Skip the jargon. Use short paragraphs. Answer the question directly without hedging everything into meaninglessness.
    3. Aim for at least 600 to 800 words. That is enough depth to actually be useful and enough substance for Google to understand what the page is about. Do not pad it, but do not be artificially brief either.
    4. In WordPress, go to Posts, then Add New. Give it a title that matches what someone would actually type into Google (for example: "What Happens at a Custody Hearing in Texas?" rather than "Custody Hearing Information"). Write your content, add a featured image, and publish it.
    5. Link to this post from your homepage or your relevant practice area page. Internal links help Google discover and index new content faster, and they keep visitors on your site longer.

    You do not need to become a blogger. One solid, honest, helpful post that answers a real question your clients have is a meaningful asset. If you find you enjoy writing them, publish a second one. But one is enough to start, and it is worth doing.