How we build

Every site we ship is plain HTML, CSS and JavaScript. No framework, no page builder, no plugin stack, no database behind a brochure page. This page says what that means in practice, for anyone who wants to check.

What a page is made of

One HTML file per page, with the styles it needs in the head and the scripts it needs at the end. Fonts are self-hosted and subset to the characters the site uses. Images are converted to WebP at the sizes the layout draws them, with width and height set so nothing jumps while loading. The homepage of a typical build is around ten requests and a few hundred kilobytes, and Google's phone test puts its first paint at about a second.

The copy lives in markdown files, one per page, with the facts in front matter: title, description, dates, the town or the service. A generator turns those into the finished pages, the sitemap, the robots file and a plain-text copy of the whole site for AI assistants. Change a sentence in one file, rebuild, and every page that shares it updates together.

What gets checked before anything goes live

A test harness runs against every page at a phone width and a desktop width. On a twenty-page site that is a few hundred to a few thousand assertions: no horizontal overflow, every image has a description, every link resolves, headings in order, one H1 per page, the privacy notice reachable without JavaScript. A page that fails does not deploy.

Then Google's own PageSpeed test on the live address, all four categories. The standard is 95 or better on performance and 100 on accessibility, best practices and search. The scores on the homepage of this site are the real ones, pulled from Google's API when the site is rebuilt, with the date they were measured.

How it gets deployed

File by file, from an explicit list. There is no command that syncs a folder, and no command that deletes. After every deploy each file is fetched back from the live address and compared byte for byte with the file that was sent. Backup copies never sit inside the web root, and the server refuses to serve anything that looks like one.

What ships with every site

Security headers on every response: a content security policy, HSTS, no-sniff, a referrer policy, and a permissions policy that switches off the camera, microphone and location. The contact form has a honeypot and a time check. Cookieless analytics from Cloudflare, so there is no consent banner to click through unless a site actually sets a cookie. A privacy policy written for the site it sits on, naming every processor that touches a visitor's details. A branded 404. A domain registered in the client's name.

What we leave out

Third-party scripts, unless the client asks for one and it earns its place. Tracking pixels. Chat widgets from a third-party service. Font services. Anything that loads from someone else's server before the page can draw.

The tools

The tools on the site, photo quotes, e-signing, the schedule editor, run on Cloudflare Workers with a KV store or a small database behind them. Each client's tool is its own worker with its own store, so nothing is shared between businesses. Uploads go to storage with an expiry on them. Nothing is priced by an algorithm; a photo quote goes to the tradesperson to price, and that is the whole design.

If you are a developer

You can check every claim on this page from the outside. Open the source of any site linked from our work page, run it through PageSpeed, read the response headers, look at the request count. That is the point of building this way. It holds up when somebody looks.