Bringing a manufacturer trusted since 1978 to laboratories around the world.

A CMS-driven site that must never render empty

Why it’s hard

Every section of the homepage is CMS-driven, which means every section can also be missing — an unseeded dataset, a deleted document, a client mid-edit. The usual outcomes are a blank band where a section should be, or a page that throws. Both undermine a site whose purpose is to present a manufacturer at its best.

Resolution

The homepage configuration, the inner page content and the export region data each have a typed static fallback compiled into the build, and the fallback resolves field by field rather than per document. A field the client has never filled takes its default, so one unfinished field cannot blank a whole section; a field the client deliberately empties stays empty, so hiding a section from the Studio still works.

Public form endpoints with no database and no accounts

Why it’s hard

Two endpoints that send email are exactly what bots find first, and there is no user table, no session and no persistence layer to defend them with. Leaving them open means an inbox full of spam and damage to the sending reputation of a newly launched domain.

Resolution

Both routes run through a single shared request guard before any work happens: POST only, JSON content type required, a 20,000 byte body cap enforced on the body actually read rather than on a header the client controls, an origin allowlist that treats the apex and www hosts as one, and a per-IP counter capped at 10 submissions per 15 minutes. An off-screen honeypot field catches form bots, which are answered exactly as a real buyer would be so they stop probing.

Email delivery that cannot fail silently

Why it’s hard

Resend's SDK reports a rejected send by resolving with an error object rather than throwing, so the obvious integration — await the call, show success — confirms enquiries that never left. On a site whose only conversion is the enquiry, that is the worst failure available, and nothing about it would be visible to either side: the buyer believes it arrived, the factory never sees it.

Resolution

Both public routes delegate to one handler that inspects the provider's response rather than trusting the call, logs any failure with enough context to trace it, and shows the buyer a phone number, WhatsApp and email address instead of a false confirmation. The reference number is issued by the server, so the one the buyer sees is also on the factory's copy of the email. Every guard path — method, content type, origin, body size, rate limit, honeypot — was exercised before relying on it.

Motion-heavy design against a mobile performance budget

Why it’s hard

The design leans on parallax, scroll reveals, an animated world map and four typefaces to carry the credibility argument — and the buyers it is arguing to are frequently on mobile. Every element doing the persuading is also a cost against the thing that determines whether the page is seen at all.

Resolution

Image delivery was tightened rather than the design cut back — AVIF and WebP output, a constrained quality ladder, long-lived cache headers, and a single preloaded image per page so nothing competes with the hero for early bandwidth. The animated world map draws from a 344 KB geometry library that never reaches the browser: the map is rendered once at build time into a 24 KB cached SVG, with only the route animation running client-side. The navigation fetches just the product names it displays rather than the catalogue behind them, and the homepage ships at around 320 KB of HTML.

Building search visibility for a new domain

Why it’s hard

A newly launched domain has no search history or inbound links yet, so every signal it sends has to be clean. A duplicate URL, a missing canonical or an outdated sitemap each dilute the limited attention a crawler gives a new site.

Resolution

Page metadata is generated through a single factory that merges CMS-authored SEO fields over per-page fallbacks and always emits a canonical, so no page can ship without one. The sitemap is generated from live GROQ queries and leaves out categories with no products, which are also served noindex until they have stock. Every listing page carries an h1 naming the equipment rather than a generic label, product and category pages carry BreadcrumbList, and listings carry ItemList. Product markup is deliberately left out: its rich results require a price or genuine reviews, and a quote-based catalogue has neither, so the markup could only ever generate errors.

Deciding what the site should not have

Why it’s hard

Sections that have been designed and built feel like assets, which is exactly what makes them hard to cut. An industries section of thirteen pages covered 17 of the 40 products, missed the construction range entirely — a third of the catalogue — and repeated the same few items from page to page. A standalone catalogue page duplicated the product listing and competed with it for the same search terms.

Resolution

Both were removed, with permanent redirects so any ranking or shared link carried over to the product listing. The decision was taken on evidence rather than preference — catalogue coverage, overlap with the product listing, and what Search Console showed each section earning. It was also the right call for the client, who runs the CMS without a developer and now has one fewer content type to keep in step with a catalogue it did not match.

Security headers on a marketing site, unprompted

Why it’s hard

Security headers are rarely requested for a marketing site, and their absence goes unnoticed until it matters. This site represents a manufacturer to institutional buyers, and institutional buyers run security scans.

Resolution

HSTS with preload, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a strict-origin referrer policy, a Permissions-Policy denying camera, microphone, geolocation, payment and USB, and a Content Security Policy locking down base-uri, form-action, frame-ancestors and object-src. The X-Powered-By header is disabled. Structured data escapes angle brackets before it is written into the page, so a CMS value containing a closing script tag cannot break out of it.