Our websites have nothing running behind them for attackers to break into, keep no client information, and live in accounts in your practice's name. That's also why there's no monthly fee.
12 protections, built into every Rebuild and Refresh.
Most practice websites are built while you wait: software on a computer builds each page when someone visits. That software is what attackers go after, and what needs updating. Ours are built once, ahead of time.
You pay every month for that computer, and someone has to keep patching it.
Nothing to break into, nothing to patch, nothing to pay for each month.
In October 2026, emergency fixes for two serious flaws in PHP, the software behind WordPress, reminded everyone why this matters. Read what it means for your practice.
Built into every Rebuild and every Refresh. No add-ons, no upgrades, nothing to switch on.
Most attacks go after the software a website runs. Ours run none.
Every page is prepared ahead of time and sent as a finished file. There's no software running behind your website for anyone to break into.
When a flaw like October 2026's "PHP2Shell" hits, there's nothing on your site that needs an emergency update at 2am.
The parts visitors and browsers see are set up to be strict by default.
Every page loads over a secure connection. The certificate renews itself, and browsers are told never to use an unsafe one.
Your site can't be shown inside a fake copy, won't run code from strangers, and never asks a visitor for their camera, microphone or location.
It soaks up attacks and sudden floods of traffic, so your website stays up when it matters.
Your clients trust you with sensitive things. Your website shouldn't be where they're kept, or where they're asked for.
Bookings, intake forms and client records stay in your booking or records system. Your website never holds them.
If you want one, it asks only for a name, an email and a short message, with a gentle note not to include health details. It sends straight to your inbox, keeps nothing on the website, and filters spam without making people solve puzzles.
Visitors aren't followed around the internet because they looked at a therapist's website. We don't sell or share anything.
Owning your website means holding the keys. We make sure they are good ones.
We set everything up, hand you the keys, and remove our own access unless you ask us to stay.
No one can quietly move your web address away from you, and it's much harder for scammers to send email pretending to be your practice.
If anything ever looks wrong, getting back is quick and calm.
There are no backups to remember. The last good version of your website comes straight back.
You get a plain-language security checklist with every item checked off. On the optional care plan, we keep watching.
It's the same reason it's safer. Most websites rent a computer that runs software all day, and you pay for it every month. Ours are finished pages. Storing and sending finished pages costs a hosting network so little that the big ones offer it free for a website the size of a practice's.
The only ongoing cost is your web address, about $20–30 a year, which you likely already pay. And because the website is yours, if a free plan ever changes, finished pages can move to almost any host. We'll help.
Before your new website goes live, we check every protection and give you a plain-language checklist with each item checked off. It's yours to keep, and to show anyone who asks how your website keeps clients safe.
How a typical practice website compares with one we build, on the things that keep clients safe.
| What to look for | A typical website | A Stepflow website |
|---|---|---|
| Software running all day that can be broken into | Yes | None |
| Plugins and updates to keep up with | Often many | None |
| Affected by the October 2026 PHP flaws | Yes, if on WordPress, Drupal or Joomla | No |
| Client information stored on the website | Sometimes, in form plugins | Never. It stays in your booking or records system |
| Contact form that asks people to describe what they're going through | Common | Never. Name, email and a short message |
| Tracking cookies and ad tools | Common | None |
| Who holds the keys | The platform or the web person | You, with two-step sign-in |
| Getting back to a good version | Depends on backups | One click, any version |
| Monthly fee for the computer it runs on | Yes | None |
No website can promise it will never have a problem. What we can promise is that there's very little to attack, nothing of your clients' stored on it, and a quick way back if anything goes wrong.
Your website: how it's built, the 12 protections, and handing you the keys with good locks on them.
Your bookings, intake forms and client records, in SimplePractice, TherapyNotes, Jane or whatever you use. We never sign in to it or touch your schedule; your website simply links to it.
Keep two-step sign-in switched on, use a password manager, and tell us if a staff member who had access leaves. We'll show you how.
Something else on your mind? Email hello@stepflowstudios.com, or see all questions.
No website can promise it will never have a problem. What we can promise is that there's very little to attack, nothing of your clients' stored on it, and a quick way back if anything goes wrong.
Most websites run software on a computer all day, building each page when someone visits. That computer and its software are what you pay for every month, and what has to be patched. Ours are finished pages. Storing and sending finished pages costs a hosting network so little that the big ones offer it free for a website the size of a practice's. Nothing running means nothing to pay for and nothing to break into.
The website is yours. Finished pages can be moved to almost any host, and we'll help you do it.
No. Bookings, intake forms and client records stay in your booking or records system. Your website only shows information about your practice, and the contact form sends messages straight to your inbox without keeping a copy on the website.
Your website should never hold private health information in the first place. Ours don't: no client records, no intake, and no contact form that asks for health details. We don't give legal advice, so check your overall compliance with your advisor.
It can. Many therapist websites use a generic form tool with a box like "Tell us what brings you in." When someone answers, their health information goes through and sits in that tool, often one that hasn't agreed to protect health information the way HIPAA expects. That can raise HIPAA concerns, so it's worth checking with your compliance advisor. Our forms avoid the question entirely.
You. The accounts are in your practice's name with two-step sign-in. We remove our own access at handoff unless you ask us to stay, for example on the care plan.
Every change is recorded, so any earlier version can be brought back in one click. If you're on the care plan, we're watching that the site is up and the padlock is valid, and we'll get in touch if anything looks off.
Yes. It's how we meet practices. We'd rather show you than sell to you, and you owe nothing unless you choose to go ahead.
No. Your booking or records system (SimplePractice, TherapyNotes, Jane or whatever you use) looks after the security of your bookings, intake and client records. We never sign in to it or touch your schedule; your website simply links to it.
Article
A therapist website with no health information on it isn't the problem. Forms, trackers and tools that collect health details are. How to check yours.
Read itArticle
Many therapist contact forms ask people to describe what they're going through. Why that can raise HIPAA concerns, and what to ask instead.
Read itArticle
PHP released emergency fixes for the PHP2Shell flaws on October 21, 2026. How to tell if your practice's website is affected, and what to ask.
Read itOur free check tells you how your website is built, whether it's on WordPress, and how safe it looks from the outside. You owe nothing.