Keys left in the browser
Database or payment keys bundled into the front end, where anyone can copy them.
Modern tools, built properly and kept safe
I build with PHP and JavaScript, the languages most of the web runs on, and the modern frameworks on top of them. Here's what I use, why, and how I keep your site and your customers' data safe.
What I build with
Proven, well-supported tools with big communities behind them, so your site isn't stuck with one developer or one fashionable framework. Each one links to its own site if you'd like to read more.
PHP
Runs most of the web, and still the right choice for a lot of it
- PHP
The language behind WordPress, Laravel and a huge share of the web. Modern PHP is fast and typed, and there are developers everywhere who can pick up the code after me.
- WordPress
Still the easiest CMS to hand over to a team. I build custom themes and plugins rather than stacking page builders, so sites stay quick and editors change only what they should. Around 30 sites so far, from five-page business sites to a family of recruitment-agency sites.
- WooCommerce
Selling from the WordPress site you already have: products, stock and payments in the same admin your team already knows.
- Composer and Bedrock
WordPress set up like a proper application: core and plugins pinned in code, settings per environment and repeatable deploys, so an update never surprises you on the live site.
- Laravel
My choice for custom web apps and APIs: bookings, payments, admin areas and the rules behind them. Queues, scheduling, email and logins come built in and done well, which is why the Morzine Transfers booking platform runs on it.
- Livewire
Interactive admin screens and dashboards inside a Laravel app, without a separate JavaScript front end to build and maintain.
JavaScript and TypeScript
Typed, tested code for fast sites and apps
- TypeScript
JavaScript with types. Mistakes show up in my editor rather than in front of your customers, and the code explains itself to whoever works on it next.
- React and Next.js
React for the interface, Next.js for everything around it: pages rendered on the server so they load fast and rank well, plus the routing, API and image handling a real site needs.
- Vue and Nuxt
A lighter alternative to React that I use for web apps and installable mobile web apps.
- Astro
Content sites that ship almost no JavaScript, so they load instantly even on a weak mountain signal. A great match for Sanity. This site runs on it.
- React Native and Expo
One codebase for iPhone and Android apps. Expo handles the builds and over-the-air updates, so a fix doesn't have to wait for app store review.
- Tailwind CSS
Styling written right next to the markup, so designs stay consistent and the stylesheet never grows out of control.
Content and commerce
So your team can run the site themselves
- Payload CMS
An open-source CMS that lives inside the Next.js app, in your own code and your own database. Editors get a clean admin shaped around their content, with drafts and previews, and there are no per-seat fees.
- Sanity
Hosted content editing with real-time collaboration. A good fit for fast static sites, where the content lives in Sanity and the pages are built ahead of time.
- Shopify
For shops that want selling to just work. I build custom Liquid themes with sections your team can rearrange in the theme editor.
- Stripe
Card payments, deposits and refunds without card details ever touching your server. I use it for bookings as well as shops.
Hosting and data
Boring, reliable infrastructure, on purpose
- PostgreSQL
The database I reach for first: reliable, fast and free, with every structural change versioned alongside the code.
- SQLite and Turso
Small, fast databases for lighter sites and apps, with Turso hosting them close to your visitors.
- Cloudflare
DNS, hosting for static sites, caching and bot protection in front of everything, including the spam check on contact forms.
- Managed servers
Patched, monitored servers, set up and deployed through Ploi, for sites and apps that need a server of their own.
- Postmark
Email that actually arrives: booking confirmations, contact form messages and password resets, kept separate from your marketing email.
How it fits together
Most projects use a handful of these together. These are the combinations I reach for most, what each one is good at, and where you can see it working.
Payload CMSNext.jsPostgreSQLTailwind CSSCloudflare
A site your team runs day to day
Payload runs inside the Next.js app, so the website, the admin and the API are one codebase on one server. Content sits in a PostgreSQL database you own, pages are pre-rendered so they load fast and rank well, and Cloudflare sits in front for caching and bot protection.
Used for Bosanquet Ives and Rose Energies.
Booking platforms and web apps
Laravel handles the hard part: availability, pricing rules, approvals and the admin your staff use every day. Stripe takes the payments. The marketing site is a separate Astro site edited in Sanity, so it stays fast and easy to change without touching the booking engine.
Used for Morzine Transfers.
Fast content and portfolio sites
Astro builds every page ahead of time and Cloudflare serves it from close to each visitor, so pages appear almost instantly. Editors work in Sanity's hosted studio and publishing updates the site.
Used for Will Nangle's portfolio, moved across from Squarespace.
WordPressComposerPHPWooCommerce
WordPress, done properly
Bedrock and Composer keep WordPress and its plugins in version control, a custom theme keeps pages fast, and WooCommerce adds a shop when you need one. Your team gets the editor they already know, without the mess.
Used for a family of recruitment-agency sites and Agri-mate.
A shop with something extra
Shopify runs the shop on a custom theme. When the business also runs events or bookings, a separate Payload app handles those, so neither has to be bent into doing the other's job.
Used for Nonna's Pantry Store and Supper Club.
Mobile apps
React Native and Expo give one TypeScript codebase for iPhone and Android, sharing code with a web version where it makes sense.
Used for Aithlo, an app of my own.
Webflow and other no-code builders
I'm a developer, so for most projects I'd rather write the code: you own it outright, it loads faster, and you're never tied to one platform's pricing or limits. That's why I don't reach for Webflow, Framer or other no-code builders by default.
They're still built on the HTML, CSS and JavaScript I've worked with every day for over ten years, and I've built Webflow sites for clients who wanted one. If Webflow is what your team knows, or you've already settled on it, get in touch and we'll talk it through.
Talk to me about a Webflow siteSecure by default
Security isn't an add-on at the end. These are the habits behind every build.
- Secrets stay secret
- API keys and passwords live on the server, never in code a browser can read.
- Every request is checked
- Who can see or change what is enforced on the server, not just hidden in the interface.
- Payments handed to Stripe
- Card details go straight to Stripe, so they're never stored on your site.
- Forms that stop bots
- Cloudflare Turnstile and hidden honeypot fields on every form, with no annoying puzzles.
- Kept up to date
- Frameworks, plugins and packages updated regularly to keep the site secure, on a schedule set by your support package.
- Backups you can restore
- Backups every night at minimum, more often on higher support tiers, and database changes versioned so nothing is changed by hand on live.
The trouble with vibe-coded apps
AI tools can get an app looking finished in an afternoon. That's genuinely impressive. The trouble is everything you can't see: a demo that works isn't the same as an app that's safe to put real customers and real money through.
I use AI tools every day, and they make me faster. The difference is that I read, test and understand every line before it reaches your customers, and I know what to look for when it gets something wrong.
A database open to everyone
Access rules switched off, so any visitor can read or change other customers' records.
Checks only on screen
The button is hidden, but the action behind it still works for anyone who calls it directly.
Packages nobody checked
Outdated libraries with known holes, or ones that don't do what the AI assumed.
No backups, no tests
Fine until the day a change breaks bookings or deletes data, with no way back.
Code nobody understands
When it breaks at 9pm on a Friday, there's no one who knows how it works.
Quick check: is your app at risk?
Tick anything that's true. Nothing is sent anywhere.
Nothing ticked yet
Go through the list. Each one is a common gap in apps built quickly.
App review and rescue
A fixed-price look at an app you, an AI tool or another developer built.
- 1
I go through it
The code, the database rules, the hosting and the packages it depends on.
- 2
You get a plain-English report
What's risky, what's fine, and what to fix first, with no jargon and no scare tactics.
- 3
I fix it, if you want me to
Usually the riskiest parts first. A full rewrite is rarely needed.
Questions
Can you take over an app someone else built?
Yes, whether it was another developer, an agency or an AI tool. I'll review it first and tell you honestly what shape it's in.
Should I use PHP or JavaScript?
It depends on what you're building and who will look after it. I use both, so I'll recommend whichever fits, not whichever I prefer.
Is WordPress still secure?
Yes, when it's kept updated and built without piles of unvetted plugins. Most WordPress hacks come from neglect, not from WordPress itself.
Do you use AI to write code?
Yes, as a tool. Every change is reviewed and tested by me before it goes live, and I'm the one accountable for it.
Worried about an app you've launched?
Tell me what it does and how it was built. I'll reply within 24 hours, and there's no judgement about how it got there.