grocommunity.org ran on an outdated WordPress version with a stack of plugins nobody needed anymore, on regular shared hosting. Every page took around 800 ms before the first byte arrived, while the company paid for Google Ads clicks to reach it. Patients submitted personal and health details through those pages, and the data had to reach Zoho CRM in a structured, compliant way.
WordPress upgraded to the latest version and stripped back to the plugins that do real work. A patient intake and payment funnel that structures every submission and feeds Zoho CRM, built to HIPAA requirements. A new site, groclinicalservices.com, built to the same standards for the expansion. Both moved off their old hosting with Cloudflare in front.
Both sites live in under six weeks. Time to first byte dropped from about 800 ms to about 20 ms, roughly 40 times faster, so the clicks they pay for land on a page that is already there. Patient data flows from form to CRM in a structured way, and the attack surface is a fraction of what it was.
| Time to first byte before | ~800 ms | Outdated WordPress on regular shared hosting |
| Time to first byte after | ~20 ms | Behind the Cloudflare CDN |
| Speed increase | ~40x | On every page, for every visitor |
| Websites | 2 | grocommunity.org cleaned up, groclinicalservices.com built new |
| Rebuild to compliant launch | Under 6 weeks | Including the move to new hosting |
Time to first byte is the time from the request to the first byte of the response, measured on the live sites before and after the move to Cloudflare. GRO runs Google Ads for most of the year, which is why load speed was treated as a business number and not a technical one.
Below is the work in detail, organized around the questions we hear most from healthcare organizations whose website has become part of how patients reach them.
Why would a software company take on a WordPress website?
Because the hard part was not WordPress. GRO's website is a patient funnel: Google Ads bring people in, intake forms collect personal and health information, payments are processed on the site, and every submission has to arrive in Zoho CRM as structured data the team can act on. Doing that reliably and in a HIPAA compliant way is integration and data work, which is what we do. WordPress stayed because the team already knew how to edit their content in it.
How much faster did the website get?
Time to first byte went from about 800 milliseconds to about 20 milliseconds, roughly 40 times faster. That is the moment the visitor's browser starts receiving the page, so every other part of loading waits on it. We got there by moving both sites off their regular hosting, putting Cloudflare's CDN in front so pages are served from a location close to the visitor, and removing the plugins that were adding work to every request.
- Time to first byte: from ~800 ms to ~20 ms, about 40x faster
- Both sites moved off their old shared hosting
- Cloudflare CDN in front, serving pages from the edge close to the visitor
- Unused plugins removed, so each request does less work on the server
Does 800 ms really matter when you run Google Ads?
Yes. 800 ms on its own does not sound like much, but it is a wait before anything else can start, on every page, for every visitor. Each moment someone waits for a page to load they are more likely to leave, and when that visitor arrived through a paid ad the click is already paid for. GRO runs Google Ads for most of the year, so a slow first byte is a cost on every campaign. Landing page experience is also one of the factors Google weighs in ad quality, so a faster page helps the ads themselves.
Can a WordPress website handle patient data in a HIPAA compliant way?
It can, if it is treated as part of a system and not as a theme with forms on it. For GRO that meant knowing exactly which forms collect patient information, keeping the plugins that touch it to a minimum, encrypting all traffic in transit, and making sure each submission is structured and handed to Zoho CRM the right way. Most of the risk on an old WordPress site comes from software nobody maintains anymore, so removing it was part of the compliance work, not separate from it.
- Every form and every path patient data takes mapped before anything changed
- Only the plugins that do real work kept, all on current versions
- All traffic encrypted in transit, with Cloudflare in front of the server
- Patient submissions structured and passed to Zoho CRM in a compliant way
- Payments processed on the site as part of the same funnel
How do website forms get into Zoho CRM as structured data?
By deciding the structure first and building the forms around it, instead of sending whatever a form plugin produces. Each intake and inquiry submission is mapped field by field to the records and fields the team uses in Zoho CRM, so a new patient arrives as a usable record and not as an email someone has to retype. That keeps the funnel measurable from ad click to CRM record and removes manual copying of sensitive data.
Why build a second website for the expansion?
grocommunity.org is the website GRO came in with, for their Illinois organization. As they expanded into Ohio as GRO Clinical Services, they needed a site for clinical services that met all the required standards from day one. We built groclinicalservices.com on the same cleaned up foundation, with the same patient funnel, Zoho CRM connection, payment flow and Cloudflare setup, so both organizations run on one way of working.
How long did the rebuild take?
Under six weeks for everything: the audit, the WordPress upgrade and plugin cleanup, the compliant patient funnel with Zoho CRM and payments, the new groclinicalservices.com site, the move off the old hosting and the Cloudflare setup.
When does a healthcare website need more than a web designer?
When the website starts doing the work of a system: collecting patient information, taking payments, feeding a CRM, and being the place paid traffic lands. At that point speed, security and compliance matter more than the design, and the work looks a lot more like software than like a website.
- Patients submit personal or health information through the site
- Payments are processed on the website
- Form submissions have to reach a CRM such as Zoho, HubSpot or Salesforce
- You pay for traffic with Google Ads and the pages are slow
- The site runs an old WordPress version or plugins nobody maintains
Want us to build yours?
This is the kind of product we design, build and ship end to end: fixed scope, production-grade, live in weeks. Tell us what you're building and we'll say straight if it's a fit.