Fast, secure and safe, and you can check all three
Every site we build is engineered around what your business does, and held to three measures you can check yourself: fast, secure and safe.
Whether it is a colour library, a trade shop, a product finder or a calculator, the job is the same: to let the right buyer find you, trust you and get in touch. Each of the three words is defined below, with a way to check it on your own mobile phone.
Fast
On a mobile phone, for three visitors in four, the main content is on screen in under two seconds. Google's threshold is 2.5 seconds; ours is stricter. We use Google's real-visitor data where it exists and the median of several lab runs where it does not, and say which. Check it: enter your address at pagespeed.web.dev, choose Mobile, and read the Largest Contentful Paint figure.
Secure
As little as possible to attack, what remains patched faster than attackers move, and a tested way back. No application or database on the public server; the editor is protected by two-factor sign-in; anything high or critical in what the site is built from is updated within 14 days, or 48 hours where a public exploit exists. Check it: scan your address at Mozilla's HTTP Observatory. On WordPress, try adding /wp-login.php to your address.
Safe
The site collects nothing it does not need, can be used by anyone, and does what it says. Analytics load only after a visitor says yes, and a refusal is final. Built to WCAG 2.2 AA with a dated statement of what was tested. Check it: press Tab through your site and watch where the outline goes.
Engineered around the business
For a powder coating manufacturer, a finder across 374 products, each with its data sheet, and search from any page. For a coatings shop, approved trade accounts, six price tiers and a coverage calculator. For a reference site, more than 9,500 films on about 34,000 pages, built from open data and rebuilt every week. We ask what your buyers come to do, and build that first.
Static or dynamic
A static site builds every page in advance and serves it as a file. A dynamic site builds each page when a visitor asks, from a database. Dynamic is the more capable choice, not the better one: most business sites change a few times a month and show every visitor the same page, so a live application and database add something to patch and nothing the visitor uses. Where a site does need live behaviour, such as sign-in or a checkout, we build that part as a small separate service, as we did for the OpenThrottle shop.
How it is built
Pages are made in advance and served from a global network. Your team edits in a simple editor, and the code, domain and hosting are in accounts in your name, or handed over to you on request.
How we price it
We quote every site after a short scoping conversation, and the price is fixed from then. Product libraries, shops and finders are quoted after an audit.
The three words, defined
Fast: On a mobile phone, for three visitors in four, the main content is on screen in under two seconds.
- Google measures three things from real visits, and calls a page good when the slowest quarter of visitors still get a good result.
- Our target is stricter than Google's on the one that matters most, the time until the main content appears.
- Where a site has enough visitors, Google's field data is the measure. Where it does not, we run the lab test in Google's PageSpeed Insights several times on its standard mobile setting and quote the median, and we say which it is.
- A fast page is usually a light one. Weight is where the trouble starts, and nothing downstream of the page can fix it.
| What | Threshold | How to check it yourself |
|---|---|---|
| Largest Contentful Paint (time until the biggest thing on screen appears) | Google: 2.5 s or under is good. Ours: under 2.0 s. | Enter your address at pagespeed.web.dev, Mobile tab, and read the figure in the top section. Source |
| Interaction to Next Paint (how long the page takes to respond to a tap) | 200 ms or under is good; over 500 ms is poor. | Same page. Only available from real visitor data; a lab test cannot measure it. Source |
| Cumulative Layout Shift (how much the page jumps while loading) | 0.1 or under is good; over 0.25 is poor. | Same page. Source |
| All three, for the slowest quarter of visitors | Pass: all three good at the 75th percentile, measured on mobile phones. | Google Search Console, Core Web Vitals report, lists every page as good, needs improvement or poor. Source |
Last reviewed 28 October 2026.
Secure: There is as little as possible to attack, what remains is patched faster than attackers move, and there is a tested way back if it fails.
- Nearly all successful attacks go through a site's back door, the application and the database behind the admin login. A static site has neither on the public server; its editor signs in with two-factor authentication, and the sign-in page runs no code.
- What remains, the hosting account, the domain, the build tools and any third-party script, is a short list, and we treat it as part of the job rather than someone else's problem.
- Attacks now come within hours of a flaw being published, so the number of things needing patches matters more than how diligently they are patched.
- A backup nobody has restored is a hope. Every site we build lives in version control, in the client's name or transferable on request, and a restore has been tested.
| What | Threshold | How to check it yourself |
|---|---|---|
| An application on the public server that checks passwords | None. Sign-in handled by a separate provider with two-factor authentication. | On WordPress, add /wp-login.php to your address and see what appears. Ask where the editor's sign-in is actually processed. Source |
| Encryption and security headers | Grade A on Mozilla's HTTP Observatory. | Scan your address at developer.mozilla.org/en-US/observatory. Source |
| Patch window for anything rated high or critical | 14 days at most (Cyber Essentials); 48 hours where a public exploit exists. | Ask whoever looks after the site how many days, and how they would know a flaw had been announced. Source |
| A tested restore | Restored at least once, off the host it backs up, with the date known. | Ask when the last restore was done and how long it took. Source |
Last reviewed 28 October 2026.
Safe: The site collects nothing from a visitor it does not need, can be used by anyone, and does what it says.
- In the UK and the EU, storing or reading anything on a visitor's device needs consent unless an exception applies, and since February 2026 the UK rule covers cookieless analytics too. A site may measure its own use without a banner only if it says so plainly and offers a free way to object. US state laws and Australia's Privacy Act require clear notice of what is collected and why.
- UK, EU, US and Australian law each put a duty on businesses not to shut disabled people out of their services, and in each a website can be one of those services. Not every law names a standard, and US law names none for businesses; the one they point to is WCAG at level AA, and 2.2 is its current version.
- The form sends, the number rings, the price is the price, and the company behind the site can be identified.
- A statement that claims full compliance with no list of exceptions is a statement nobody tested.
| What | Threshold | How to check it yourself |
|---|---|---|
| Consent | No banner unless something that needs consent is loaded, and then a real choice before it loads. | Open the site in a private window. If a banner appears before you have done anything, ask what is being set. Source |
| Keyboard use | Every link, button and field reachable with Tab, in order, with a visible outline that never hides behind a header. | Press Tab repeatedly and watch. Source |
| Zoom and small screens | Works at 200% zoom and 320 pixels wide with no sideways scrolling. | Zoom the browser to 200% and narrow the window. Source |
| Company details | The legal name of the business, and in the UK its registered number and office, on the site. | Look in the footer. Source |
| The form | Delivers the message and confirms it. | Send yourself one and time it. Source |
Last reviewed 6 November 2026.
Questions people ask
Can our people still edit it?
Yes, in an editor with one form per kind of thing on your site. Every change is saved with a history and can be undone. It is not a page builder, and we say so. The editor
Do we need a cookie banner?
In the UK and EU, not if the site sets nothing that needs consent: Google Analytics, a marketing pixel or a chat widget does need it, and the banner must ask before anything loads. In the US there is no national rule; California lets businesses track first, but larger ones must offer a "Do Not Sell or Share" link and honour the browser's privacy signal. We build to the UK rule and add California's link and signal for US clients; our own site is an example. Privacy
Last reviewed 28 October 2026.
Tell us what your buyers need to do on your site.
An engineer will reply within one working day with what it would take.
Talk to an engineer about your site