Hexa-Communications is a communications agency, and their founder, Cherry Lui, had already designed their website. That is a better starting point than most projects get. The brief was not “make us a website” — it was “build this one, and make it hold up.”
Building someone else’s design
When the design is already settled, the value we add moves entirely to the build. The layout, the type, the pacing of the page: those decisions were made by the person who knows the brand best, and our job was to reproduce them faithfully rather than quietly redesign them in the process of coding them.
That means matching spacing and breakpoints rather than approximating them, keeping the design intact on a phone as well as a desktop, and flagging the handful of places where a static design has to make a decision it has not made yet — what a long headline does, what an empty state looks like, how a section behaves when the content grows.
Video hosting, done on the site
The site leans on video, which is where a lot of agency websites quietly hand their brand over to someone else. Embedding from a free video platform means a third-party player, their branding, their cookies, their recommended-videos panel at the end of your showreel, and a measurable hit to page speed from scripts you do not control.
We host the video ourselves instead. The player is part of the site, the video is served from infrastructure we manage, and nothing on the page is negotiating with an advertising network. It also keeps the site’s privacy story simple, which matters when you are the agency advising other people on theirs.
A contact form that does not become a spam feed
The contact form is the point of the whole site — it is where an interested visitor turns into a conversation. An unprotected form on a public website starts collecting bot submissions within days, and the failure mode is not dramatic: it is a founder slowly learning to ignore their own enquiry emails.
We put Cloudflare Turnstile in front of it. It verifies that a real browser is submitting the form, usually without asking the visitor to do anything at all. No traffic lights, no crosswalks, no squinting at bicycles. Genuine enquiries arrive; automated ones do not.
Deployed, and graded
We handled the deployment: DNS, TLS, the CDN in front of it, and the security headers that most sites never get around to setting. The site scores A+ on securityheaders.com, with a Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy all in place.
That grade is not a vanity metric. Those headers are what stop your site being framed by someone else, stop a browser guessing at content types it should not, and stop the site being reachable over plain HTTP at all. They cost nothing but attention at deployment time, and almost nobody applies them after launch — which is exactly why we apply them before.
Why it worked
The split was clean: the founder owned the design, we owned the build and the infrastructure underneath it. Nobody had to compromise on the part they were best at.
It is the same pattern as a 10GB WordPress migration in one working day — the interesting work is rarely the part the client sees first. A site that looks right on launch day is the easy half. A site that still loads fast, keeps its video, and does not fill its inbox with junk a year later is the half that needs someone watching it.
Builds like this are part of our project work, and the ongoing patching, backups and monitoring afterwards run on a Care Plan. If you have a design ready and need someone to build and deploy it properly, get in touch.