A therapy practice needs to feel safe before anyone books.
The old site came from a template builder: generic, hard to change and paid for every month. The practice wanted something that felt quiet and trustworthy, a blog they could run themselves, and a contact form they could rely on.
- ×Template site on a monthly plan
- ×Blog posts needed outside help
- ×Contact messages only in email
- ×No control over the details
- →Custom design built for the practice
- →Private portal to write and publish
- →Messages saved and emailed
- →Every word on the site editable
What I built
Visitors see five calm pages. Behind them is a portal built for someone who isn't technical.
The website
- →Home, About, Services, Blog and Contact
- →Privacy Policy and Terms of Use
- →Crisis numbers in the footer on every page
- →Search engine and social sharing setup
The portal
- →Blog editor with autosave and preview
- →Edit any page text, with version history
- →Messages inbox with search and archive
- →Photo uploads, resized and cleaned
Behind it
- →Booking hands off to the practice's system
- →Separate admin address, hidden from search
- →Branded email template
- →Backups and a restore runbook
A contact form that never loses a message.
For a therapy practice, a lost enquiry is someone who reached out and never heard back. So the form saves first and emails second, and every failure has a plan.
Fields are validated on the server and bots are filtered out quietly.
The message is stored first, so the portal always has a copy.
It's sent to the practice with the visitor as the reply-to address.
If sending fails, the message is flagged and retried in the background.
Privacy and security
Locked-down portal
Sign-ins lock after five failed attempts, and sessions time out when idle.
Safe blog content
Posts are cleaned against an allow-list before they're published.
Clean photos
Uploads are verified, resized and stripped of location data.
Strict headers
Content Security Policy, HSTS and no-index on the admin side.
Quiet analytics
Privacy-friendly analytics, so no cookie banner on a therapy site.
Designed first
Every page and state was designed and approved before any code.
The practice now updates its own website, without waiting on a developer.
The site is live and moving to the practice's own domain. They write and publish their own posts, every enquiry is kept safe, and I stay on for hosting and improvements.