I build websites that bring enquiries

The first thing I found was a server compromised through a known hole in the site engine. I updated the engine to the version that closes it and moved the build onto a supported runtime — the old one had stopped receiving security updates. I also removed a line that printed the database password into the server log: anyone with access to the logs had access to the database.

The server sits in Russia and cannot reach Telegram directly. Any hiccup used to mean the enquiry simply stayed in the database and nobody found out. Now there is a queue: the site files a job, the bot collects it itself and confirms delivery. If the bot dies halfway, the job returns to the queue after a minute — eight attempts in all, with growing pauses. And if no manager is active at all, the enquiry goes to a backup chat instead of evaporating.

There are around a hundred thousand cars, and the page address could be crafted so the server tried to assemble all of them at once — one request took the site down. Now no more than sixty cards are served at a time, and any malformed value in the address returns an ordinary list instead of an error. Checked by hand: a request for 99,999 cars returns 60, and an attempt to slip a database command through returns a normal listing.

The source platform serves the same car twice — once under the listing number, once under the vehicle's internal number — and the old importer dutifully created two cards. Every fourth car in the catalogue was duplicated. I removed 38,459 surplus cards, keeping a copy of them first, and closed the cause itself with three checks on write. The catalogue now holds 94,647 cars and 3 duplicates.

A car sold — and its card hung on the site forever: the sync only reached new listings and never came back to published ones. Customers called about cars that no longer existed, and the conversation opened with an apology. Now every listing is re-checked against the source at least once every three days, and sold stock disappears without anyone touching it.

YouTube videos were embedded directly: the player loaded with the page and told YouTube about the visit even if nobody intended to watch anything. I replaced them with a still frame and a play button — the player connects only on click. Requests to YouTube before a click went from two to zero, and not a single third-party cookie is set until the video starts. For a site that has to declare in its privacy policy what it collects, that is not a detail.

Blocks appeared as you scrolled — a nice touch, but it rested on a browser mechanism that sometimes simply never fires. I checked and saw it: in that situation not one of the six blocks ever appeared, and everything below the first screen stayed blank forever. I added an independent check on a one-second timer and a separate rule for when scripts are off. Blocks now appear even where the browser sends no signal at all.

It travels two ways in turn: first to a service bot, and if that doesn't answer within four seconds, straight to Telegram. If neither path works, the visitor sees an honest «it didn't send, please call» rather than a fake «thank you» — and the full text is written to a service log on the server, where it can be recovered by hand. I deliberately tested the broken path: the site returned an error and kept the enquiry instead of pretending all was well.

There's an invisible trap field: people never see or touch it, automated scrapers fill in everything and give themselves away. Separately, the server re-checks the name, phone and consent itself — it doesn't take the browser's word. And one address gets no more than five submissions per ten minutes. Verified live: a normal enquiry passes, a bot's is rejected, the sixth in a row is refused.

On a 375-point screen the home page occupied 542 — you could drag it sideways and part of the text ran off the edge. The culprit was a wide price table: in a narrow layout it pushed the whole page out instead of scrolling inside itself. The header with the name and phone number didn't fit either. Fixed and re-checked across seven pages at four widths, from a very narrow phone to a large monitor — no sideways shift anywhere.

There's a measurable standard for how far text must differ from its background to stay legible for people with weak sight and in sunlight. I calculated every colour pairing on the site and found four that failed it. The worst was yellow lettering on the call-to-action bar in dark mode: it differed from the background by three times less than the standard and all but vanished. Colours replaced; every pairing now clears the standard with room to spare.

Every page is built in advance and sits on the server as a ready file — a request costs it about two thousandths of a second and 55 MB of memory. Fonts, counters and images are never pulled from third-party sites: if something goes down at Google or an ad network, page speed is unaffected. There's a specific reason for that — on the client's previous site a build once failed for exactly one reason: Google's fonts couldn't be reached.

They used to go straight to Telegram. One enquiry containing text Telegram refused, and it vanished silently. Nine were lost that way. Now an enquiry is logged to disk first and sent second, and failed attempts retry on a schedule.

The hero video weighed 3 MB and carried a 256 kbps audio track — on a site where video is always muted. Re-encoded into two formats without audio: 1947 KB became 176 KB before the video loads.

The cache header arrived doubled: first «do not store», then «keep for a month». Browsers take the first. The site was re-downloaded on every visit, and the only way to notice was to read the response headers.

A price lived as text in four files — the price list and the service pages, in two languages. A mismatch between them costs more trust than a typo. Now they are numbers in one place, and roubles and dollars are derived from them.

A field no human can see, plus a timestamp: nobody fills a form in two seconds. Add rate limiting at the server. None of it is visible and none of it gets in the way — but enquiries don't drown in noise.