Case Study: A Faster, Locked-Down New Website for Ultra Spray South

We've just launched a brand new website for Ultra Spray South, an onsite commercial paint spraying contractor working across the UK since 2000. They spray ceilings, cladding, shopfronts and roller shutters for the shopfitting, retail, construction and industrial sectors, often overnight so their clients can keep trading.

Here's how we took them from an old single-page WordPress site to a fast, secure website built to win commercial work.

The brief

Ultra Spray South's customers are main contractors, shopfitters, facilities managers and national retailers. These are people who want to see quickly that a contractor is accredited, experienced and easy to deal with. The old website was a single page on WordPress, and it wasn't doing the business justice.

The new site needed to:

• Show the full range of services clearly, each with its own page
• Showcase recent projects and the brands they've worked for
• Put their accreditations front and centre
• Make it quick to request a quote, with replies in under 24 hours
• Be fast, secure and simple to maintain, without the constant updates WordPress needs

What we built

We expanded the site from one page to a full, structured website:

• Home: what they do, who they work for, their accreditations and a quote form
• Services, with dedicated pages for ceiling and soffit spraying, cladding painting and spraying and shopfront and roller shutter spraying
• Projects: a gallery of recent work
• About: their story and the way they work
• Contact: a simple quote request form and both phone numbers

Their SafeContractor, SSIP, Constructionline Silver and IPAF accreditations sit just below the opening banner, so procurement teams see them straight away. The design is clean and professional, in the company's navy and blue, and works perfectly on phones, which matters when site managers are looking things up on the go.

The technology

Rather than rebuilding on WordPress, we built a static HTML website with a single, tightly secured PHP script that handles the quote form. There's no database and there are no plugins.

That brings big advantages for a business like this:

• It's very fast. Pages are pre-built, so there's nothing to generate when someone visits.
• There's very little to attack. No database, no admin login and no plugins means most of the ways websites get hacked simply don't exist.
• There's almost nothing to update. No more weekly WordPress, theme and plugin updates.
• Content is still easy to change. Each page is edited from one source file and the site rebuilds itself in seconds.

Microsoft 365 email

Ultra Spray South's email runs on Microsoft 365. When someone requests a quote, the website sends it through a dedicated sending-only mailbox straight into their Microsoft 365 enquiries inbox. Each email arrives with the reply address set to the customer, so the team can simply hit reply.

The connection is encrypted and the mail server's certificate is checked every time. The mailbox password is stored outside the public part of the website, so it can never be downloaded.

Security: built properly from the ground up

As a cyber security company, this is where we really went to town. Contractors' websites are a common target for spam and hacking, and a quote form is usually the weakest point.

Spam protection without the puzzles

We didn't want potential customers clicking on traffic lights to prove they're human, so there's no reCAPTCHA and no third-party service. Instead, the form is protected by several layers that work silently in the background:

• Only real browsers can send it. The form checks for signals that every modern web browser sends automatically, which blocks scripts, bots and other websites trying to post to it.
• Single-use security tokens. Each form gets a signed token tied to that visitor's browser and connection. It can't be forged, reused or copied to another device.
• Proof of work. Before sending, the visitor's browser quietly solves a small maths puzzle in the background. People don't notice, but it makes sending spam in bulk slow and expensive.
• Traps and checks. A hidden honeypot field catches bots, anything submitted too quickly is rejected, and messages are checked for spam links, sales pitches and fake email addresses.
• Rate limits and bans. There's a cap on how many messages can be sent per hour and per day, and repeat offenders are automatically blocked for 24 hours.

It's also privacy-friendly. Visitors' IP addresses are only stored in a scrambled form, and message content is never written to the logs.

A hardened website

• Strict security headers. The site uses a very strict Content Security Policy that blocks everything by default and allows only the site's own files, with no outside scripts at all. HSTS, clickjacking protection and other modern headers are all switched on.
• Nothing can run except the form. The server only allows the quote form script to execute. Every other script, anywhere on the site, is refused.
• No uploads, no admin area. There's simply no way in for an attacker to plant files.
• Old WordPress addresses are retired. Requests for old WordPress login and admin pages now return "Gone", so the bots that constantly probe them give up.
• Suspicious requests are blocked before they reach the site, and private settings are stored safely out of public reach.

Built to be found

For a contractor, being found on Google for the right services matters. Every page has:

• A unique, keyword-focused title and description
• Structured data describing the business, its services and each page, so Google understands exactly what they do
• A share image for each page, so links look professional on LinkedIn, Facebook and WhatsApp
• A clear heading structure, with a sitemap ready for Google Search Console

Supporting UK businesses

Ultra Spray South is a specialist trade business that has built its reputation over more than 25 years. What they need from a website is straightforward: something that shows off their work, earns trust quickly, brings in quote requests and then gets out of the way. That's exactly what we set out to deliver, with security that a lot of much bigger companies would be proud of.

Need a new website?

If your website is slow, out of date or you're worried about security, we'd love to help. Take a look at our website design service, our websites for trades and Microsoft 365 business email, or try our free website security check to see how your current site measures up.

Get in touch or call us on 03303 410 910 for a friendly, no-obligation chat.

Visit the new website: ultraspraysouth.co.uk