Background
GWMWater is a government-owned water corporation covering a quarter of Victoria. It supplies 71 towns, about 72,000 people and around 9,000 farms across the Grampians, Wimmera and Mallee.
Its website ran on Joomla and had reached the end of its useful life. Reservoir water levels, some of the most-visited content on the site, were held together by two custom Joomla components and a nightly server cron that pushed a spreadsheet into a local database table. There was no API, no feed and no second copy. A separate Joomla site shared the same data.
Content had sprawled into hundreds of thin child pages, and outage notices during an unplanned water interruption took longer to publish than the situation allowed.
The rebuild also had to satisfy an Information Security and Cyber Security Schedule written into the contract, with assurance reported to the GWMWater Board before go-live.
Solution
Webcoda ran discovery and wireframing first, then won the build tender.
The new site runs on Umbraco Cloud in the Australia East region, which settles the data sovereignty requirement, sitting behind Cloudflare with the web application firewall enabled and TLS in Full (Strict) mode. Umbraco Cloud provisions and renews the certificates, so nobody at GWMWater manages them.
The build covers 15 page templates and roughly 40 reusable content modules: an interactive outages map on GWMWater's own Google Maps keys, a report-a-fault form, a service availability checker, reservoir and water level pages, document listings, careers, and site search.
Umbraco Forms handles enquiries with reCAPTCHA on every form. The urban water main connection application is a stepped form with save-and-continue, so an applicant can leave a part-finished application and return to it later.
Impact
The site went live on 15 June 2026 with a DNS cutover to Umbraco Cloud and no downtime.
Lighthouse returns a Performance score of 94 on desktop, with 100 for both Accessibility and Best Practices, and securityheaders.com rates the site A. Webcoda provided written assurance against OWASP Top 10, the Essential Eight maturity baseline, Australian hosting and the logging, access control and vulnerability management obligations in the contract, which GWMWater took to its Board as part of go-live assurance.
Day to day, the change is in publishing. Outage notices go up from a saved template while the operations team is still on site, rather than waiting on a developer.
GWMWater is now on a support retainer covering CMS patching, monitoring, backup and disaster recovery checks. When Umbraco published its Forms security advisory in July 2026, the patch was applied within days.
94
Performance score on Lighthouse
100
Accessibility score on Lighthouse
100
Best Practices score on Lighthouse
