Web & digital · Build and maintain
Websites, back ends and migrations, built by people who have to defend them afterwards.
A lot of the risk we find in small businesses is not exotic. It is an unpatched site, a domain nobody can log in to, a migration that left the old host running, an email domain anyone can spoof. We build and look after that layer properly, because we are usually the ones who get called when it goes wrong.
Website design and build
Sites for businesses that need to look credible and be found, without a six month project or a page builder subscription nobody understands. We start by putting a working draft in front of you rather than a slide deck, so you are reacting to something real from the first week.
Included
- Design and build, responsive from the start
- A working draft early, so feedback is concrete
- Content structure and copy support if you need it
- Analytics and Search Console configured properly
- Accessibility and performance built in, not bolted on
- Handover documentation, so you are not dependent on us
Suited to
- Trades and service businesses that need to be findable
- Professional practices replacing something dated
- Businesses whose site was built by someone unreachable
Technical SEO
The engineering half of search: making sure the site can be crawled, understood, and served fast enough to rank. We do not sell content packages or promise positions. We fix the technical reasons a site underperforms, and we show you the before and after in Search Console.
What we work on
- Crawlability, indexation and canonical correctness
- Sitemaps, robots and redirect hygiene
- Structured data and rich result eligibility
- Core Web Vitals and real page performance
- Per page titles and metadata that actually differ
- Search Console and analytics instrumentation
How we report
- Measured against your own Search Console data
- Findings ranked by likely impact, not by count
- Plain explanations of what each fix is meant to change
Back end development and integrations
When the website is not the whole job. Internal tools, customer portals, scheduled jobs, and the integrations that connect what you already run. We build these the way we would want to inherit them: documented, with credentials handled properly and a way to see what happened when something fails.
Typical work
- Internal tools and customer facing portals
- API integrations between systems you already pay for
- Automation of manual processes and scheduled jobs
- Databases, reporting and data cleanup
- Authentication done properly, including single sign on
How we leave it
- Documented, with the runbook written as we go
- Secrets in a secret store, never in the codebase
- Logging and alerting, so failures are visible
- Backups configured and restore tested, not assumed
Platform and hosting migrations
Moving a site, a mailbox estate or an application between platforms, without the outage and the six months of loose ends afterwards. Migrations are where security debt is created, so we treat the cutover and the decommission as part of the job rather than as somebody else's problem.
We handle
- CMS migrations, including content and URL structure
- Hosting and cloud moves, with DNS cutover planned
- Email and tenancy migrations
- Redirect mapping, so search rankings survive the move
- Decommissioning what is left behind
Before we cut over
- A written change plan with an agreed window
- A rollback position, tested rather than described
- A confirmed restorable backup, verified first
- Post migration verification against a checklist you see
Domains, DNS and ongoing care
The plumbing that quietly decides whether your email arrives and your site stays up. We take ownership of it, keep it current, and monitor it with the same tooling we use for managed security clients. This is where the two halves of what we do meet.
Setup and ownership
- Domain registration and lifecycle, in your name not ours
- DNS configuration and email authentication
- TLS certificates and HTTPS done correctly
- Sender identity, link previews and technical brand setup
Ongoing
- Updates, patching and dependency upkeep
- Backups with tested recovery
- Uptime, certificate and DNS change monitoring
- Maintenance retainers, or break and fix support
Why a security practice builds websites
Because this is where most of it starts.
It is a fair question. The answer is that the web layer is the part of a small business an attacker can see from the outside, and it is almost always the part nobody owns. The site was built by a contractor who moved on. The domain is registered to a former employee. Nobody knows what the DNS records do.
We would rather build and hold that layer than keep being called in after somebody spoofs an invoice. If you already have a web team, we are happy to just review their work.