Projects that run.

Sector

Specialist e-shop

Period

since 2026

Service

E-shop migrations, security

11,654products in the catalogue

An e-shop that had been quietly sending spam for four months

The owner had one problem: product photos wouldn't upload. There was more than one cause. The shop ran on code from around 2007 and PHP 5.2, a 16.7 GB error log had filled the disk, and malware on the server had been sending spam from it for four months.

What we did

First aid. We freed 19.5 GB, removed the malware including the files that kept restoring it, and stopped what was flooding the error log. Then we converted the encoding to UTF-8 and built a new storefront in PHP 8.2 on the same database the existing admin uses, so orders, invoices and shipping work for the staff as before. More than 12,000 old product and category URLs have redirects to the new ones, so the shop keeps its search rankings.

Outcome

Photos upload again and the server no longer sends spam. The new storefront is finished; the catalogue has a sitemap and structured data for search engines on product pages.

• PHP 8.2
• MySQL
• PDO
• Proxmox

Sector

Debt collection agency

Period

2026

Service

Website management, security

22days from approved quote to launch

A company site from 2012 that quietly showed gambling links to search engines

The company had a site from another era: a CMS from 2012 on PHP 5.3 that nobody updated any more. Someone had got into the shared template and planted hidden spam linking to gambling sites. Visitors never saw it; search engines did. The brief: a new responsive site and security put in order.

What we did

We transcribed every page verbatim into an inventory and carried the content over 1:1, with only language fixes and without superlatives that could be legally challenged. The new site is static: templates compile to finished HTML, there is no database or CMS on the server to break into, just one PHP script for the form with invisible bot protection. Service pages, an FAQ, WCAG accessibility, and fonts and the map without third-party calls before consent. The site runs on the same shared hosting as before. We switched PHP from 5.3 to 8.4, turned on HTTPS with HSTS and a Content-Security-Policy without inline scripts, and every old URL redirects. DMARC protects the e-mail domain. The old compromised site was removed from the web root and archived.

Outcome

22 days from the approved quote to launch, two weeks ahead of the deadline. The client received the source code with instructions for edits and deployment, so anyone can maintain the site.

• Eleventy
• HTML/CSS
• PHP 8.4
• Apache
• PHPMailer

Sector

Kindergarten

Period

2026

Service

Custom software

9classes, each with its own parents' portal

A kindergarten website where children's photos stay behind a password

The school had an old WordPress site. It wanted a site the management can run on its own, and a closed section where parents see news and photos from their child's class only.

What we did

A new site in Laravel with a Filament admin. The management publishes news and documents; teachers upload photos and videos straight from their phones. The server converts iPhone photos from HEIC, resizes them, strips metadata including location and deletes the original. Children's names are never stored with photos. Class content sits behind a password, and automated tests make sure it never shows up at a public URL.

Outcome

The management runs the site on its own. The handover includes a user guide, configured roles and the contracts the school needs as a data controller, including a data processing agreement.

• Laravel
• Filament
• MariaDB
• libvips
• ffmpeg

Sector

Law firm

Period

since October 2025

Service

Website management

A law firm: website, campaigns and internal tools from one supplier

The firm had a WordPress site and a third-party cookie banner. It wanted a bilingual site and pages for specific types of cases that paid campaigns could point to.

What we did

We moved the site to Kirby, a CMS without a database, in two languages and with redirects from the old URLs. We added three landing pages for paid campaigns and local pages for searches by city. Cookiebot was replaced by our own consent banner. Sklik campaigns run on our own tool. Time tracking is a separate case study.

Outcome

The collaboration has been running since October 2025. The firm has its website, campaigns and internal tools with one supplier.

• Kirby 5
• PHP
• Google Tag Manager
• Sklik

Sector

Law firm

Period

2026

Service

Custom software

Time tracking for a law firm: off the public cloud, with client data under control

The firm logged its work in a third-party cloud service. Timesheets contain client names and descriptions of work, information covered by attorney-client privilege. The brief: time tracking outside the public cloud and the firm's performance on one screen.

What we did

We chose an open-source tool and deployed it on a dedicated server under our management: encrypted disk, off-site backups, sign-in with two-factor authentication. We adapted the terminology to legal practice (client, case, act) and set up roles so that everyone sees only what they need. We wrote a custom plugin, a performance dashboard: an overview of the firm's revenue and costs by day and for the whole period. The plugin does not touch the tool's core, so it survives updates. Finally we migrated the full history of timesheets from the original service, with totals matching to the last koruna.

Outcome

Client data sits on a server that only the firm and we can access, not the operator of a third-party cloud service. The attorney has timesheets and the performance overview in one tool.

• Docker
• Symfony
• MariaDB

Sector

Custom special-vehicle manufacturer

Period

2026

Service

Website management, security

A special-vehicle manufacturer: security first, then a new site aimed abroad

The company came with a brief to secure its website and e-mail. The site ran on an unpatched WordPress, next to it sat a forgotten empty e-shop, and the e-mail domain had typos in its DNS that left the protection against spoofed e-mail not working at all. Along the way it became clear the site presented the company differently from where it was heading, and a second project was added: a new website.

What we did

Security first. Security headers at server level, XML-RPC switched off, administrator accounts and the system version hidden, SPF and DMARC fixed. In the process we found that the map and the videos on the site were invisible to every visitor because of the hosting cache, and fixed that too. Then the new site: static HTML with no CMS, in Czech and English, built on completed builds with their photos and videos. The site got a new axis, expedition and motorhome specials for demanding international clients, and three landing pages by sector that catch search queries with buying intent. Launched on a new domain, the old domain redirects every previous URL, and the abandoned e-shop was taken offline.

Outcome

The company has a site that matches where it is heading, with nothing in it that needs updating. SPF and DMARC on the e-mail domain are valid.

• Static HTML
• Python
• PHP
• Apache

Sector

B2B industrial supplier

Period

2026

Service

Website management

24×faster server response

A WordPress company site: server response from 0.71 to 0.03 seconds

The site ran on WordPress with Elementor and PHP 7.4, which no longer gets security fixes. The brief: security and an SEO clean-up.

What we did

We moved PHP to 8.4, turned on compression and caching of static files, and after a trial on staging, full-page caching too. Every step was measured before and after with the same method. We also hand-wrote search descriptions for about 30 key pages.

Outcome

Server response dropped from 0.71 s to 0.03 s, largest contentful paint from about 1 s to 0.2 s, and text files now transfer 65 to 75% smaller. Measured from one location, median of repeated runs.

• WordPress
• PHP 8.4
• WP Super Cache
• Apache