The value you cannot see

On delivery day, two websites can look identical. The same pages, the same photographs, the same menu. One is well built and the other is not, and neither of them says so.

The difference shows up later, and not at random: it shows up the day the first bot starts hammering the contact form, the day a client opens the site up in the valley on two bars of signal, the day somebody asks where the data they left actually goes. Those days always come. The only question is whether the site was built expecting them.

This article is about that part, the least visible one and the most expensive to add afterwards.

Security: the part you design for the uninvited

A public website receives visits that are not visits. Programs trying addresses, forms filled in a thousand times a minute, uploaded files that look like a document and are something else inside.

Building with them in mind changes the small decisions. A public form has a ceiling on the requests it accepts, and that ceiling counts not only who is calling but what is being called, because when a private address gets passed around the abuse arrives from a thousand different places against the same door. An uploaded file is opened and inspected in its first bytes, because the name and the type declared by the browser are information, not proof: it is the check that stops the executable renamed to PDF. Pages that deal with money calculate the amounts on the server, always, starting from what was saved: the browser may propose a figure, never decide it. And the keys that open services never live in the code, because code travels and keys must not.

None of this is visible. All of it is felt, on the day it is needed.

Performance: respect for whoever has a slow line

A fast website is not a technicality to please engineers. It is respect for the person opening it on a phone, on the move, on a connection that is nothing like the office where the site was designed.

It means not shipping programs to pages that have no use for them: somebody reading an article should not have to download the engine needed to compile a quote. It means keeping typefaces on your own servers instead of fetching them from elsewhere every time. It means declaring the dimensions of every image, so the page does not jump under the thumb of someone already reading, and loading photographs when they are needed rather than all at once. It means measuring visits without cookies, which is lighter and more respectful at the same time.

Each of these is a few lines of work. Taken together they add up to a site that opens straight away even where the signal is what it is. Left undone, they add up to a site that seems fine in town.

Compliance: the part that protects you, not us

Regulatory compliance gets told as a bureaucratic chore, and it is instead the part that answers the simplest question a client can ask: where does my data go, and who sees it?

Having a written answer, checked by someone whose trade is law rather than software, is worth more than any verbal reassurance. It means knowing which country holds the data you collect. It means the rules about who may read what are written into the database and not only into the program that queries it, because a program can be worked around and the database’s own rules cannot. It means a privacy notice that says what actually happens, and a document that declares itself not to be an invoice when it is not one.

It is also the part that ages: a privacy policy written well three years ago and never reread describes a website that no longer exists.

And now the uncomfortable part

Everything above can be declared. It is the easiest thing in the world: you write it on a presentation page, you put it in a comment in the code, you say it in a meeting. And once written, nobody checks it again. It becomes true out of habit.

We know from experience how treacherous that is: a defence that is written down and never verified is worse than no defence, because it takes away everyone’s urge to look. An image you believe is obscured, which has in fact covered only the landscape and left the words printed on top perfectly legible. A piece of structured data taken as present for months and never actually written. An error the program keeps to itself, which your client will therefore discover on your behalf.

That is why, in the workshop, care is not a list of intentions: it is a list of things that can be redone on command. You look at the built site and not at the source, because there is a compiler in between. You open the image and look at it, because no search tool can read inside a photograph. You measure instead of remembering. And when a check finds something, the first question is not how to fix it but whether the check itself was written properly, because a test that raises the wrong alarm is as harmful as one that stays silent.

What you can ask, of us and of anyone else

If you are weighing up a supplier, the useful question is not “will the site be secure and fast?”, because the answer is always yes. The useful question is: how do you prove it, and how often do you do it again?

Whoever has an answer will show you a method. Whoever does not will show you adjectives.

With us the answer sits in works, where the things we claim are listed one by one in verifiable form. If you want the same care on yours, tell us about the project.