Sites we designed and built for UK businesses, shown by trade rather than by name. We share the client names on request when we speak.
A booking-led treatment site where card details never touch the website: checkout is hosted by Stripe, and service names and payable amounts are resolved from a server-side catalogue instead of the browser. Checkout origins are restricted to an explicit allow-list.
A lead capture and survey booking site with an admin area for enquiries, statuses and appointment slots. Every request carries a freshly generated CSP nonce, the admin sits behind fail-closed Basic auth, enquiry input is schema-validated and rate-limited, API calls are origin-checked, and customer photo uploads are written outside the public directory.