NexusNimbus is not a template. The site runs on a custom WordPress theme built specifically for a security-research lab: a bespoke design system, custom post types for tools, projects and games, and a hand-rolled JavaScript engine that mounts each interactive tool.
The design goal throughout was speed and privacy — no page builders, no third-party trackers, no bloat. Tools load from a single minified bundle, content is structured as first-class post types, and everything is tuned to stay fast on ordinary shared hosting.
Why build rather than assemble
A security site assembled from plugins inherits every one of their dependencies, and each of those is code running on the same origin as everything else. Page builders add heavy client-side runtimes; analytics and comment plugins add third-party requests that undercut any claim about privacy. Building the theme directly removed that entire surface: what ships is what was written for this site.
It also made the tools possible. Twenty interactive tools as separate plugins would mean twenty payloads and twenty update paths. Instead they are one custom post type served by one engine.
Architecture
- Content model: three custom post types —
nn_tool,nn_projectandnn_game— each with its own archive and single templates, plus per-entry metadata such as status and demo links. - Tool engine: a single JavaScript module registers every tool and mounts the right interface based on the URL slug, so adding a tool means adding a module and publishing an entry, not touching the theme.
- Design system: a cyberpunk palette built on CSS custom properties, with Orbitron, Rajdhani and Share Tech Mono carrying the typographic hierarchy.
- Performance: minified bundles, cache-busted asset versioning and edge caching, with the tool bundle loaded only on pages that need it.
Privacy by construction
The platform sets no advertising or analytics cookies of its own and embeds no social widgets. Every tool computes in the visitor browser, so the server never receives the data people paste in. The single deliberate exception is the password breach lookup, which uses a k-anonymity model that transmits only a five-character hash prefix and never the password itself. That constraint shaped the whole build: a feature that could not be done client-side was simply not built.
See the result in the toolkit, or read how the individual components work in the research write-ups.