New builds, inherited systems, and AI prototypes that need to become production software.
Agencies bring me in under their own name, so as far as your client is concerned the work is yours and I was never there. In practice that means one proper briefing, updates whenever you want them, and not much else for you to manage.
01
Working with agencies
Most of my work comes from agencies who have won more than they can staff that month. Sometimes that's a whole site to build, and sometimes it's a job that has gone sideways and needs taking off someone's hands before it eats the week. A few of these arrangements have been running for years.
-
Spitfire MarketingSince 2019
They handle everything on these sites and pass the development to me. Mostly new features and fixes on sites already running, plus the occasional build from scratch.
-
RemapSince 2024
Internal applications taken from prototype to production, deployment work, their own website, and ongoing consultancy and server administration. ASP.NET, SQL Server, React, Windows Server and IIS.
-
Mercer DesignSince 2016
Build work across their client sites and their own. When the agency stopped taking on web work it asked me to take over its client sites, and all of them are still with me now. These days it's the occasional job on their own site.
Direct clients
Some of the businesses I work with directly. Several came over from Mercer Design when it stopped doing web work, and haven't gone anywhere since.
-
Interrupted Art
Took the site on in 2024, got it stable, and have been adding features since.
-
Clancy Business Finance
Built the site in 2022 and have looked after it ever since — monthly WordPress and PHP maintenance, plus new features as they come up.
-
Pure Essence Yoga
Hosting, maintenance and changes as they are needed, since 2023.
-
Condor PC
WordPress maintenance since 2024, with fixes and changes as they come up.
-
Hogarth Trust
Content changes as they need them, since the end of 2024.
White-label
Everything goes out under your name, so your client never needs to know I was involved, and I won't contact them directly either while the job's running or after it has finished.
Inherited code
Most of what I do is pick up code somebody else wrote. You don't need to tidy it up first, or find the person who remembers how it works. No documentation and no tests is the normal starting point rather than a problem.
Keeping you posted
Tell me how you want to be kept up to date and I'll work to that, whether that's a weekly note or nothing at all until it's done. The one thing that doesn't vary: if something slips or goes wrong, you hear it from me before it reaches your client.
Pricing
Where a job has a clear shape I price it as a fixed cost, so you know the number before anything starts and can quote your own client with a margin that holds. For investigation work, or anything still taking shape, hourly or a day rate is simpler for both of us. Either way there's nothing to commit to up front.
Hosting and maintenance
If you would rather not keep a site on your books once it's live, I can take it over: hosting, updates, and the small changes that turn up months after everyone has moved on. If one gets hacked while it's with me, that's mine to deal with, and you get a write-up you can pass straight to your client. Several have been on that footing for years.
Admin
UK sole trader, invoiced monthly, and NDAs are no problem. Professional indemnity cover is in place, and I can send the certificate over if your paperwork needs it.
What I need to start
- Repo access, or FTP if that's all there is
- Somewhere safe to work: a staging site, or permission for me to set one up
- One person I can put questions to, so nothing sits waiting on a committee
02
Selected work
Five jobs that give a fair sense of what I get called in for. Some are builds, some are rescues, and a couple are the infrastructure underneath somebody else's code. None of them were emergencies by the time I finished.
Rescue and build on
Interrupted Art
What I did
Got it stable first, then started building on it properly. The largest addition since was an online inventory system that lets a customer choose their next piece from a collection.
Outcome
Far fewer support messages about things not working, which gave them their time back to spend on the business rather than on the website. With me since early 2024.
Build and run
Clancy Business Finance
What I did
Built it out from Mercer Design's redesign. When Mercer stopped taking on web work I took the client on directly, and have run it since: monthly maintenance on WordPress and PHP, ongoing SEO, and new sections when they need them. The most recent was a case studies area, built to give them something to rank for and something to post.
Outcome
A better web presence and a steady stream of new content for search. They came across when the agency wound down its web work and have been with me since 2024.
Application
Remap
What I did
Rebuilt and redesigned the original system first. After that it has come in phases: an importer that maps spreadsheet columns onto the platform's own fields and validates before anything is committed, a custom-field system with global and per-sector scoping so teams can add what they need without every project inventing its own version of the same column, and the summary screens rebuilt as an editable data grid. The brief has moved throughout, which is normal for something people are still learning how to use.
Outcome
Fully deployed over the last couple of months and now being tested in earnest by their team.
Deployment
Remap
What I did
Set up and now manage the server and IIS. Reviewed the code, fixed a session cookie that would have failed silently once the app was embedded in another site, and flagged that the only thing standing between it and a CSRF hole was a cookie setting. Then a GitHub Actions pipeline running against a runner on the box itself: merge to main deploys the team environment automatically, while the client-facing one stays a deliberate manual step.
Outcome
They push code and it deploys. The client environment only changes when somebody decides it should. I also traced a database that kept dying mid-deploy to the box running out of memory.
Incident response
Spitfire Marketing
What I did
Those 404s came from a deleted .htaccess, which was the last thing they did rather than the thing that was wrong. Working back through the logs, the way in was a vulnerability in WordPress core rather than a plugin, and it had been open for three weeks. I removed the shells they had planted, neutralised the accounts they had created, gated the endpoint they came in through, and restored the site from a backup I could prove predated all of it.
Outcome
Back up the same day, verified clean, and now updating itself. Automatic updates had been switched off in the configuration years before, which is why a hole disclosed three weeks earlier was still open.
Performance
Spitfire Marketing
What I did
The caching plugin wasn't doing anything, because the server lacked the software it needed, so I replaced it and worked through the front end. While deploying I watched the server fall over as the cache cleared, which turned out to be the cause of the outages.
Outcome
PageSpeed went from 32 to around 90, and three times faster on throttled mobile.
03
AI in production
I build AI features into applications, and I take AI-built code and get it ready for real use. The two turn out to be much the same job. Calling the model is the easy part. The work is in everything around it: where the data lives, what happens when the model returns something you didn't expect, and what the whole thing runs on.
- AI inside a product
- My own product runs several AI features on Anthropic's API: image OCR that reads data off a photo and logs it without anyone typing it in, automated guide writing, and a chat assistant that answers questions and then acts on them. Ask it to raise an invoice and it'll work out what it still needs to know, ask you, and go and create it.
- Remap — an internal tool
- I inherited an internal React tool that had been put together quickly and was keeping all of its data in a JSON file. Once I'd been through the code and made the changes it needed, I built an ASP.NET API layer behind it, modelled a database to replace the JSON, and put the whole thing on Windows Server under IIS.
- An AI-built application, put into production
- Reviewed and secured, then deployed onto Windows infrastructure I set up and still run. Written up under Selected work.
- Agents that can be trusted with actions
- Letting an AI take actions inside a business is a different problem from letting it write text, and the difference is the control layer. I've built one: every action classified before it runs, and anything that can't be undone held until a person approves it. That's what separates an agent worth having from one that's a liability, and it's what most implementations skip.
- Across providers
- Anthropic and OpenAI where I need reliable, structured data back, ElevenLabs and Google for speech, Midjourney and Google for images. Different jobs suit different models, and if the code around them is written sensibly, swapping one out later isn't a big piece of work.
04
Capabilities
I work across two fairly different worlds, and while most jobs are PHP and WordPress, it's usually the Microsoft side that gets me a call when something turns out not to be a WordPress site at all.
Back end
- PHP
- WordPress
- ASP.NET
- Node.js
- Windows authentication
Front end
- Angular
- React
- JavaScript
- Capacitor
Data and search
- SQL Server
- PostgreSQL
- MySQL
- Elasticsearch
- Kibana
Servers
- Windows Server
- IIS
- Linux
- Apache
- Nginx
- DNS and SSL
- MinIO
Deployment
- Git
- GitHub Actions
- GitHub Runners
- WebDeploy
- CI/CD pipelines
Performance
- Core Web Vitals
- Page speed optimisation
- Caching
- Technical SEO
Security
- Incident response
- Root cause analysis
- Malware and backdoor removal
- Core and plugin checksums
- Patching and hardening
- Post-incident reports
AI
- Anthropic API
- OpenAI API
- Tool use and structured output
- Document extraction
- Text to speech
- Image generation
- Claude Code
- AI code review