EasyGrill

EasyGrill came to us on an ageing framework that the site no longer needed. Every page view was booting an application stack to render content that had not changed in months. The brief was to keep the design, the imagery and the animations exactly as they were, and change everything underneath.

We rebuilt the site to serve plain pages, with language and device variants selected at the edge rather than at runtime. The visual result is identical. What changed is that a page request no longer executes application code, which removes both the latency and the most common class of attack surface in one decision. The only server-side code left is the enquiry handler, and it sits outside the public directory.

The enquiry form was the part that mattered commercially, so it got the most attention: bot challenge, rate limiting, a hidden trap field, server-side validation, and a success message that appears only after delivery is confirmed rather than when the request is sent. Messages are passed as plain text, so nothing a sender writes can be interpreted as formatting or markup downstream.

On top of that we built the layer that makes the site legible to machines as well as people: canonical and hreflang across both languages, structured data, a sitemap, social previews, and a machine-readable product catalogue. That last part is increasingly how a product gets found at all, and almost nobody outside enterprise is doing it yet.

One finding worth naming, because it affects any site behind a CDN. The application was seeing the proxy's address rather than the visitor's, which meant unrelated users were sharing a single rate limit. Until that is corrected, your abuse protection is also your availability problem.