Ilija Tošković

Services

I build WordPress sites and web applications, keep them healthy once they are live, and take over the ones that have gone wrong. Much of my work sits in the places other developers hand off: the server, the mail that stops arriving, the plugin nobody wants to write, the site that was hacked last night.

I work with small businesses that need a site that simply works, with agencies that need senior capacity for a stretch, and with in-house teams that need someone to own the WordPress and server side.

Ways we can work together

Full-time

Available for a full-time role, on-site in Belgrade or remote, as a WordPress or fullstack developer.

Part-time

A fixed number of days a week. This suits agencies that need senior capacity without adding a full headcount.

Per project

A defined scope, a fixed quote and an agreed deadline. The usual choice for a new site, a redesign or a single integration.

Maintenance plans

A monthly fee that keeps an existing site updated, backed up, monitored and secure, so nobody has to remember to do it.

Stand-by support

A retainer for when something breaks. You get a named person who already knows your stack, rather than starting from scratch with whoever is free.

What I do

Websites and web applications

Building the thing itself, at whichever level of craft the budget and the design call for.

Custom WordPress themes

Hand-built themes using Sage with Blade, or Timber with Twig, and Advanced Custom Fields where the content team needs to edit. The site loads only the CSS and JavaScript it actually uses, the templates are readable, and the whole thing is in version control. This is the right choice when there is a real design to implement and the site is expected to last.

Page-builder websites

Elementor, Divi or WPBakery, usually on top of a quality template. Faster and cheaper than a custom build, and the sensible trade-off when the timeline or budget does not justify custom code, or when your own team needs to edit layouts without calling a developer.

Web applications

When a project outgrows WordPress: React and TypeScript on the front end, Node or Laravel behind it, with MySQL, PostgreSQL or MongoDB. Marketplaces, dashboards, client portals and internal tools.

WooCommerce and online stores

Product catalogues, checkout, payment gateways and the filtering and search that shops actually need, built to stay fast as the catalogue grows.

Care plans and retainers

Recurring work that keeps a live site healthy, on a predictable monthly fee instead of an invoice for every incident.

Maintenance plans

Three tiers. Basic covers core, theme and plugin updates, off-site backups and uptime monitoring. Standard adds security patching, performance checks and a short monthly report. Premium adds a block of development time and priority response when something urgent comes up.

Hours per month

You buy a block of my time each month and spend it on whatever needs doing: content changes, small features, bug fixes or a second opinion. No quoting and scoping every twenty-minute task.

Security monitoring and hardening

Ongoing protection rather than a one-off cleanup: firewall rules, login limiting and two-factor, XML-RPC disabled, sane file permissions, SSH keys, certificate renewal and alerts when something on the site changes unexpectedly.

Servers, hosting and email

The layer underneath the site, where the hard-to-diagnose problems usually live.

Server setup and configuration

Linux servers built from scratch on AWS, DigitalOcean, Hetzner or wherever you already are: Nginx or Apache, PHP-FPM, the database, firewall, scheduled backups and monitoring, configured for the site that will actually run on it.

Site and server migrations

Moving a site to a new host, or a whole server to new hardware, without downtime: everything rehearsed on a copy first, DNS cut over last, and the old environment kept until the new one is proven.

SSL/TLS and DNS

Certificates that renew themselves, redirects that do not loop, and DNS records that are correct the first time, including the ones for mail.

Email deliverability

When contact forms stop arriving or land in spam, it costs real money and often goes unnoticed for months. I set up SPF, DKIM and DMARC, route mail through a proper sending service, and debug SMTP until messages reach the inbox. I have fixed exactly this at 411 Locals and Multilogin.

Staging environments

A staging copy that genuinely resembles production, refreshed from live on a schedule, scrubbed of personal data and locked away from search engines, so updates can be tested somewhere other than your live site.

Audits and optimisation

Short, well-defined engagements. Each one ends with a written report: what is wrong, what it costs you, and what I would fix first. You can take the report elsewhere or have me do the work.

Performance and Core Web Vitals

Measured on real field data rather than a lab score, then fixed: render-blocking assets, oversized images, layout shift, caching and the server response time underneath it all.

Security audit

A review of an existing WordPress site: user accounts and roles, plugin and theme provenance, known vulnerabilities, file permissions, exposed endpoints and what would happen if it were compromised tomorrow.

Technical SEO audit

The parts that are code rather than copy: semantic markup and heading structure, structured data, canonical URLs, hreflang for multilingual sites, sitemaps, crawlability and index bloat.

Accessibility and WCAG

Keyboard navigation, colour contrast, focus states, form labelling and screen-reader behaviour, checked against WCAG. I have built barrier-free sites for EU clients where this is a legal requirement, not a nice-to-have.

GDPR compliance

Consent handled properly rather than with a banner that blocks nothing, third-party scripts audited, data retention and contact form storage reviewed, and the cookie notice made to not wreck your mobile performance.

Custom development and integrations

The work most WordPress freelancers hand off to somebody else.

Custom plugin development

Purpose-built plugins rather than bending five existing ones into shape: custom API routes and shortcodes, Ajax forms, admin screens and access control. I have built authentication gating with DocCheck and SwissRX so medical content stays behind a verified login, among others.

Third-party API integrations

Connecting your site to the systems your business already runs on: Salesforce, Stripe, Zapier and webhooks, CRMs, booking systems, or an internal API nobody has integrated with before.

AI chatbot integration

A chatbot trained on your own content rather than a generic widget, answering from your products and documentation. I have shipped one trained on site-specific product data.

Rescue work

For sites that are hacked, broken, or inherited from a developer who has gone quiet.

Hacked site cleanup

Finding how they got in, removing the injected code and backdoors, cleaning the database, getting you out of Google's blocklist, and then closing the hole so it does not happen again a week later.

Broken site recovery

White screens, fatal errors after an update, a checkout that stopped working. Getting the site back up first, then finding out what actually went wrong.

Abandoned projects

Taking over a site with no documentation, no handover and no access, working out how it was built, getting it into version control and making it maintainable again.

Not sure which of these you need?

Describe the problem and I will tell you what it would take to fix it, even if that turns out not to be me.

Contact me

Home About Services Projects Blog Contact