Twenty-five years of shipping software that holds up.

E-commerce, form building, automations, integrations, and security tooling including penetration-testing utilities. Written as modules with their own upgrade path, not as functions bolted into a theme that the next update overwrites.

Across both generations of the platform, which between them cover most of its life. On Magento 2 that means Open Source and Adobe Commerce — the same codebase with materially different constraints around licensing, extension review and upgrade cadence. Catalog work is where a generic e-commerce platform runs out of road first, and Magento is usually where that shows up.

Shopify fixes the storefront and leaves the operations around it open. That is where the work lives: syncing catalogs, moving orders into the systems that actually fulfill them, and automating whatever the merchant is currently doing by hand in a spreadsheet.

Twenty-five years leaves very few content or customer platforms we have not extended, integrated, migrated or replaced. Where nothing off the shelf fitted, we wrote the platform itself — Smooth Promotion below began life as exactly that, a multi-user, multi-level CRM and CMS built from scratch.

An AI agent that works inside a WordPress site rather than alongside it, with access to the files, the command line and the database, wired into the SEO and analytics tooling the work depends on. This site is managed with it, and it gets its own section below.

The current generation of the work, and where the largest builds now live. The multi-site commerce platform below is one of them, shown in full because a claim about custom development means nothing until somebody shows the inside of a codebase.

When the front end wants to be its own application, or several applications need the same data, we build the API first and treat the interface as one consumer among several. That decision is cheap at the start and expensive to retrofit.

Retrieval over your own content, structured extraction, and agents that do a job rather than demo one. The interesting work is rarely the model — it is the plumbing, the evaluation, and knowing which parts should not be probabilistic at all.

Twenty-five years in this trade means most of what we meet was written by somebody else, often a long time ago. Custom importers, a mapped schema, and a version stamped on every migrated row so the next migration can dispatch on it.

Linux, Apache, MySQL and PHP on an MVC framework, with Java alongside it, running on AWS. Deliberately unexotic, and that was the point — it stayed stable for sixteen years on technology that is thoroughly understood. Most systems do not earn their keep that long before a rebuild is worth doing.

Managing several storefronts from a single place was the original requirement and it survived into the rebuild unchanged, with an API layer reaching out to accounting software, email platforms and whatever else the business runs. Go Promotional sits on the front of it, fully responsive HTML5, tuned so each page costs as few queries as it can.

Every page, post, product and category exists once. A background indexer projects it into a per-site table that answers one question: is this visible here, at what URL, with what metadata. Adding a new site became a configuration exercise rather than a content migration.

Each site picks its own path strategy per content type, so the same product can live at /product-name on one storefront and /drinkware/travel-mugs/product-name on another. Collisions resolve deterministically — the first claimant keeps the URL and later ones are flagged for an editor rather than silently breaking an established link, with a database constraint closing the race.

Rename anything, at any depth, and inbound links keep working. The redirect left behind stores no target: it resolves the entity's current URL at request time, so a category renamed five times still has every historical URL pointing at the latest address with no chain to follow. Deleted content returns 410 Gone rather than a 404, which is the correct signal for a search engine.

Promotional products carry quantity-tiered pricing across six brackets and imprint options that change the price. The engine stores the increment and the included count and derives each option price, rather than baking a price into every combination — which removes an entire class of off-by-one errors instead of testing for them.

This industry quotes, it does not check out. An anonymous cart keyed to a long-lived visit token lets a buyer build a quote before identifying themselves, line items store the selection rather than a frozen price so a catalog update is never stale in a cart, and a state machine governs the lifecycle so an undeclared transition throws instead of quietly corrupting an order.

Email and a one-time code, no passwords to leak. An unknown address produces exactly the same response as a known one, so the login form cannot be used to enumerate customers, and two independent layers of guard isolation keep the customer panel and the staff admin from ever reaching each other.

It runs in the site's own container with the files, the command line, the database and wp-cli in reach. So it does not describe a change and leave you to make it — it makes the change, loads the page, and looks at what it actually did before saying it is done.

Ahrefs, Semrush, DataForSEO, Google Search Console and Tag Manager connected directly, so a question about rankings is answered from the data rather than from a guess, and a headless browser for seeing the rendered page at any width instead of assuming it rendered.

Content edits are written as code and versioned like code, which is what stops staging and production drifting apart. Every change can be rolled back and every change can be reviewed before it goes anywhere. The alternative — an agent editing a live database with no undo — is not a product, it is an incident waiting for a date.

Preferences live in a file the site owner controls, read at the start of every conversation. Tell it once that a client's absolute traffic numbers are never to be published and it will still be refusing to publish them six weeks later, in a task nobody connected to the original instruction.

The product is an AI tool and it was built with them, which is the honest version of this pitch: we are not selling a technique we have not run at ourselves first. The same thinking reaches client work — our Laravel platform ships schema introspection and version-accurate framework documentation specifically so a coding assistant working in that repository gets facts instead of confident guesses.

Anything it writes can be put through AI-text detection before it ships and rewritten, window by window, until it reads as human. That is a measured bar rather than an opinion about the prose, and it matters because a page that was generated and never edited is increasingly obvious to readers and search engines alike.

On a national multi-location brand — 27 locations across 8 metro markets — it shipped 120+ pages over 9 concurrent workstreams in 20 active development days: 361 commits, 11 releases, every release approved by a person before production. The same scope costed manually came to 820 to 1,060 hours of senior work, or about six months full time. The whole thing is published at mysitebuddy.ai/case-study.

The reason those eleven releases were gated on a human is that generating is cheap and being right is not. This page went through several rounds of revision against real screenshots at phone and desktop width, and two rounds of factual correction once the client read it. That loop is the product; the speed is what it buys.

AWS, Azure and Google Cloud, and the long tail underneath them — managed WordPress hosts, cPanel and Plesk estates, VPS providers, bare metal. There are very few configurations twenty-five years has not made us work with. Most clients arrive committed to a provider for reasons that have nothing to do with engineering, and moving clouds to suit an agency is rarely the best use of a budget.

nginx, PHP-FPM, MariaDB or Postgres, Redis, queue workers, TLS and certificate renewal, cron and scheduled jobs. Configured to match the application rather than left on defaults, and documented so the next person can read it.

A backup nobody has ever restored is a hope rather than a backup. We take scheduled snapshots, keep them somewhere the primary environment cannot reach, and rehearse the restore — because the first time you find out how long recovery takes should not be the day you need it.

Testing an application the way somebody attacking it would: authentication and session handling, access control between accounts, injection, file upload paths, and the dependency tree underneath. Findings come back ranked by what an attacker could actually reach, with the fix alongside.

Least-privilege access, no shared logins, audit trails on the actions that matter, secrets kept out of the repository, and a patch cadence for the operating system and the dependency tree. Most breaches we are called in after were a known vulnerability nobody had scheduled time to update.

Uptime and error monitoring, log retention, and alerting that reaches a person rather than a dashboard nobody has open. Knowing a site went down before the client rings is most of the job.

We have delivered for publicly traded companies, where a security questionnaire and an audit trail are part of the deliverable rather than an afterthought, and we have taken multiple sites through ADA accessibility compliance end to end. Both come down to evidence — who had access, what changed, when it was patched, which pages were tested against WCAG and what was fixed — and evidence has to be collected while the work happens rather than reconstructed afterwards.