William Stewart

Freelance software developer

PHP · .NET · React · Windows and Linux servers

14 years · London, UK

Available

Taking on work now

Two days a week free

07891 492388
GMT/BST · A couple of lines is enough to start

New builds, inherited systems, and AI prototypes that need to become production software.

Agencies bring me in under their own name, so as far as your client is concerned the work is yours and I was never there. In practice that means one proper briefing, updates whenever you want them, and not much else for you to manage.

01

Working with agencies

Most of my work comes from agencies who have won more than they can staff that month. Sometimes that's a whole site to build, and sometimes it's a job that has gone sideways and needs taking off someone's hands before it eats the week. A few of these arrangements have been running for years.

  • Spitfire MarketingSince 2019 They handle everything on these sites and pass the development to me. Mostly new features and fixes on sites already running, plus the occasional build from scratch.
  • RemapSince 2024 Internal applications taken from prototype to production, deployment work, their own website, and ongoing consultancy and server administration. ASP.NET, SQL Server, React, Windows Server and IIS.
  • Mercer DesignSince 2016 Build work across their client sites and their own. When the agency stopped taking on web work it asked me to take over its client sites, and all of them are still with me now. These days it's the occasional job on their own site.

Direct clients

Some of the businesses I work with directly. Several came over from Mercer Design when it stopped doing web work, and haven't gone anywhere since.

  • Interrupted Art Took the site on in 2024, got it stable, and have been adding features since.
  • Clancy Business Finance Built the site in 2022 and have looked after it ever since — monthly WordPress and PHP maintenance, plus new features as they come up.
  • Pure Essence Yoga Hosting, maintenance and changes as they are needed, since 2023.
  • Condor PC WordPress maintenance since 2024, with fixes and changes as they come up.
  • Hogarth Trust Content changes as they need them, since the end of 2024.

White-label

Everything goes out under your name, so your client never needs to know I was involved, and I won't contact them directly either while the job's running or after it has finished.

Inherited code

Most of what I do is pick up code somebody else wrote. You don't need to tidy it up first, or find the person who remembers how it works. No documentation and no tests is the normal starting point rather than a problem.

Keeping you posted

Tell me how you want to be kept up to date and I'll work to that, whether that's a weekly note or nothing at all until it's done. The one thing that doesn't vary: if something slips or goes wrong, you hear it from me before it reaches your client.

Pricing

Where a job has a clear shape I price it as a fixed cost, so you know the number before anything starts and can quote your own client with a margin that holds. For investigation work, or anything still taking shape, hourly or a day rate is simpler for both of us. Either way there's nothing to commit to up front.

Hosting and maintenance

If you would rather not keep a site on your books once it's live, I can take it over: hosting, updates, and the small changes that turn up months after everyone has moved on. If one gets hacked while it's with me, that's mine to deal with, and you get a write-up you can pass straight to your client. Several have been on that footing for years.

Admin

UK sole trader, invoiced monthly, and NDAs are no problem. Professional indemnity cover is in place, and I can send the certificate over if your paperwork needs it.

What I need to start

  1. Repo access, or FTP if that's all there is
  2. Somewhere safe to work: a staging site, or permission for me to set one up
  3. One person I can put questions to, so nothing sits waiting on a committee
02

Selected work

Five jobs that give a fair sense of what I get called in for. Some are builds, some are rescues, and a couple are the infrastructure underneath somebody else's code. None of them were emergencies by the time I finished.

Rescue and build on Interrupted Art
What I did

Got it stable first, then started building on it properly. The largest addition since was an online inventory system that lets a customer choose their next piece from a collection.

Outcome

Far fewer support messages about things not working, which gave them their time back to spend on the business rather than on the website. With me since early 2024.

WordPressPHPMySQL Read in full →
Build and run Clancy Business Finance
What I did

Built it out from Mercer Design's redesign. When Mercer stopped taking on web work I took the client on directly, and have run it since: monthly maintenance on WordPress and PHP, ongoing SEO, and new sections when they need them. The most recent was a case studies area, built to give them something to rank for and something to post.

Outcome

A better web presence and a steady stream of new content for search. They came across when the agency wound down its web work and have been with me since 2024.

WordPressPHPSEO Read in full →
Application Remap
What I did

Rebuilt and redesigned the original system first. After that it has come in phases: an importer that maps spreadsheet columns onto the platform's own fields and validates before anything is committed, a custom-field system with global and per-sector scoping so teams can add what they need without every project inventing its own version of the same column, and the summary screens rebuilt as an editable data grid. The brief has moved throughout, which is normal for something people are still learning how to use.

Outcome

Fully deployed over the last couple of months and now being tested in earnest by their team.

ASP.NETSQL ServerAG GridWindows Server Read in full →
Deployment Remap
What I did

Set up and now manage the server and IIS. Reviewed the code, fixed a session cookie that would have failed silently once the app was embedded in another site, and flagged that the only thing standing between it and a CSRF hole was a cookie setting. Then a GitHub Actions pipeline running against a runner on the box itself: merge to main deploys the team environment automatically, while the client-facing one stays a deliberate manual step.

Outcome

They push code and it deploys. The client environment only changes when somebody decides it should. I also traced a database that kept dying mid-deploy to the box running out of memory.

Windows ServerIISGitHub ActionsNode.js Read in full →
Incident response Spitfire Marketing
What I did

Those 404s came from a deleted .htaccess, which was the last thing they did rather than the thing that was wrong. Working back through the logs, the way in was a vulnerability in WordPress core rather than a plugin, and it had been open for three weeks. I removed the shells they had planted, neutralised the accounts they had created, gated the endpoint they came in through, and restored the site from a backup I could prove predated all of it.

Outcome

Back up the same day, verified clean, and now updating itself. Automatic updates had been switched off in the configuration years before, which is why a hole disclosed three weeks earlier was still open.

WordPressLiteSpeedcPanelJetBackup Read in full →
Performance Spitfire Marketing
What I did

The caching plugin wasn't doing anything, because the server lacked the software it needed, so I replaced it and worked through the front end. While deploying I watched the server fall over as the cache cleared, which turned out to be the cause of the outages.

Outcome

PageSpeed went from 32 to around 90, and three times faster on throttled mobile.

WordPressWP RocketCloudflarePlesk Read in full →
03

AI in production

I build AI features into applications, and I take AI-built code and get it ready for real use. The two turn out to be much the same job. Calling the model is the easy part. The work is in everything around it: where the data lives, what happens when the model returns something you didn't expect, and what the whole thing runs on.

AI inside a product
My own product runs several AI features on Anthropic's API: image OCR that reads data off a photo and logs it without anyone typing it in, automated guide writing, and a chat assistant that answers questions and then acts on them. Ask it to raise an invoice and it'll work out what it still needs to know, ask you, and go and create it.
Remap — an internal tool
I inherited an internal React tool that had been put together quickly and was keeping all of its data in a JSON file. Once I'd been through the code and made the changes it needed, I built an ASP.NET API layer behind it, modelled a database to replace the JSON, and put the whole thing on Windows Server under IIS.
An AI-built application, put into production
Reviewed and secured, then deployed onto Windows infrastructure I set up and still run. Written up under Selected work.
Agents that can be trusted with actions
Letting an AI take actions inside a business is a different problem from letting it write text, and the difference is the control layer. I've built one: every action classified before it runs, and anything that can't be undone held until a person approves it. That's what separates an agent worth having from one that's a liability, and it's what most implementations skip.
Across providers
Anthropic and OpenAI where I need reliable, structured data back, ElevenLabs and Google for speech, Midjourney and Google for images. Different jobs suit different models, and if the code around them is written sensibly, swapping one out later isn't a big piece of work.
04

Capabilities

I work across two fairly different worlds, and while most jobs are PHP and WordPress, it's usually the Microsoft side that gets me a call when something turns out not to be a WordPress site at all.

Back end

  • PHP
  • WordPress
  • ASP.NET
  • Node.js
  • Windows authentication

Front end

  • Angular
  • React
  • JavaScript
  • Capacitor

Data and search

  • SQL Server
  • PostgreSQL
  • MySQL
  • Elasticsearch
  • Kibana

Servers

  • Windows Server
  • IIS
  • Linux
  • Apache
  • Nginx
  • DNS and SSL
  • MinIO

Deployment

  • Git
  • GitHub Actions
  • GitHub Runners
  • WebDeploy
  • CI/CD pipelines

Performance

  • Core Web Vitals
  • Page speed optimisation
  • Caching
  • Technical SEO

Security

  • Incident response
  • Root cause analysis
  • Malware and backdoor removal
  • Core and plugin checksums
  • Patching and hardening
  • Post-incident reports

AI

  • Anthropic API
  • OpenAI API
  • Tool use and structured output
  • Document extraction
  • Text to speech
  • Image generation
  • Claude Code
  • AI code review