How a project runs
Five checkpoints, each one written down. On a circuit board, a test point is where you probe to confirm things work before moving on. Same idea here.
-
Brief
You tell me what you need in a short written form. No call, no sales pitch.
- You
- Fill out the project brief. It takes about five minutes.
- Me
- Read it and reply within two business days, with questions or an honest answer on fit.
- You get
- A clear yes, a clarifying question, or a pointer to someone better suited.
-
Proposal
If it’s a fit, I write up exactly what I’ll build. Nothing starts until you’ve agreed to it.
- You
- Read it, ask anything, and approve it when it’s right.
- Me
- Define scope, timeline with dates, price, and what’s out of scope.
- You get
- A written plan you can hold me to.
-
Build
I build in the open. You can watch progress on a private preview link at any time.
- You
- Send content and answer questions as they come up.
- Me
- Build, and send a written update every week: what’s done, what’s next, what I need.
- You get
- A preview link that updates as the work moves.
-
Review
You try to break it. Seriously: test it on your own phone, laptop, and browser.
- You
- Test, and list anything that looks or works wrong.
- Me
- Fix what you find, then run the launch checklist below.
- You get
- A site that has passed your checks and mine.
-
Launch and handoff
The site goes live, and everything is handed over in your name.
- You
- Approve the launch.
- Me
- Go live, verify the hardening, and walk you through the handoff notes.
- You get
- Your accounts, your code, and documentation for all of it.
The launch checklist
Every site passes these before it goes live. The first four are what the self-test on my homepage checks; the rest are things a browser can’t see.
- HTTPS everywhere, with HSTS, so browsers refuse to load the site over an unencrypted connection.
- A Content Security Policy that allows only the scripts and styles the site actually uses, which blunts injected code.
- Clickjacking protection, so other sites can’t load your pages in a hidden frame and trick visitors into clicking.
- No tracking cookies or third-party scripts unless you ask for them and understand the trade.
- Unique admin passwords and multi-factor sign-in, with old and shared accounts removed.
- Least-privilege access: every account and service can reach only what it needs.
- Current software, with unused plugins, themes, and packages removed.
- Automatic backups, and a restore that has actually been tested.
- Uptime and certificate monitoring, so problems are caught before your visitors find them.
Why everything is in writing
Decisions don’t get lost
Every agreement, change, and answer lives in one email thread or shared document you can search later.
You can reply when it suits you
No scheduling around each other. Read updates on your time, answer when you’re ready.
Calls when they’re genuinely useful
If something needs a conversation, we schedule one ahead and write down what we decided.
Have a project a page builder can’t handle?
Send a brief. It takes about five minutes, and you’ll get a written reply within two business days.