Waterproof: lead tools, servers and site work for a web agency

Waterproof Web Wizard is a German web agency for SEO, TYPO3 and WordPress, run by its owner. I started working with it on Upwork in July 2023 and moved to a direct contract in 2026. For three years it was my main client, and most of that time went to the agency’s clients.

This page is about the agency’s own systems: its WordPress site, a block theme, the lead tools and the servers they run on. One of them is Spam Checker, a live scanner that has checked more than 1,000 sites. It all began with single WordPress tasks, and the big decisions went to the owner in writing.

Projects

1. 2023

   Help desk evaluation: osTicket and UVdesk

   A hands-on evaluation of osTicket and UVdesk as the agency’s ticket system for client requests.

   I tested osTicket on a Mac and on test hosting. It would not install, and its guides assumed a Windows server. I installed UVdesk on the agency’s server together with the owner, and showed him how the ticket flow works.

   When the owner asked what I really thought, I said it straight: UVdesk worked, but it was less friendly than task tools like Asana, ClickUp or Trello, and I advised him to look further. A few months later the agency moved its tickets to a friendlier tool.

   Stack: UVdesk, PHP

2. 2023–2025

   WordPress site tasks: table of contents, layout fixes, advice

   Ongoing tasks on the agency’s own WordPress site, first on Bricks Builder and later on a Hub child theme.

   For long blog articles I built a table of contents that highlights the current section and works when the page opens on an anchor, plus a reading-progress bar. I fixed the contact page slider, and traced a blank Google map to an API key that did not allow the site’s address. Wiki pages showed duplicate headings, so I overrode one template in the child theme and kept the parent theme updatable. I also checked pages at every width and fixed gaps and misaligned elements on the pages I was given.

   Stack: WordPress, Bricks, PHP, JavaScript, CSS

3. 2025

   n8n form workflow and a login check

   An access check for the agency’s OpenProject, and an n8n workflow that sends form answers to an external API and returns the reply.

   I confirmed the OpenProject login in a normal and a private window and sent the owner a short video. The n8n workflow takes the form, sends a request to the external API and brings the reply back. Then I showed the owner how to change the request and the form fields and run a test, since what it’s for was his to define. So he has a working workflow he can reshape himself.

   Stack: n8n

4. 2025

   WordPress block theme: theme.json foundation and header

   The agency’s own WordPress block theme, a base for client sites where the Gutenberg editor shows what the live page shows. I built it together with the owner, who set up the build, Tailwind and the block plugin.

   My part started with the theme.json foundation: type sizes, radius and width presets, colour schemes and a 1440px container, with the core styles kept in theme.json.

   I served the fonts from the site and made the header and footer template parts and the header and button styles. A header block from the companion plugin failed validation after a page was reopened, so I fixed it with a migration that restores its images from the saved HTML.

   The theme carried a first client build on staging, with the editor and the front end showing the same typography, colours and widths.

   Stack: WordPress, Gutenberg, PHP, JavaScript, Sass

5. 2025

   Neos CMS content element on a new platform

   A custom content element for Neos CMS on the stock demo site, a first project on the platform within a fixed limit.

   The old Docker setup would not start, so I rebuilt the local environment with DDEV. The element is a Polaroid-style gallery where each image opens in a popup. I checked publishing and recorded a walkthrough for the owner.

   I delivered it within the limit. A year later it was followed by front-end work on a real Neos relaunch for one of the agency’s clients.

   Stack: Neos, DDEV

6. 2026

   SEO spam scanner: a PHP SaaS tool with automated tests

   A SaaS scanner that finds sites hacked with hidden black-hat SEO spam from the outside, with no access. I proposed it and built it as the only developer.

   It’s plain PHP and MySQL, with its own parallel HTTP client, a sitemap crawler and detectors for hidden text, obfuscated JavaScript, redirect chains, cloaking, spam keywords, doorway pages and look-alike domains.

   On live cases Google’s own tools reported «clean» where my detectors saw the injection, so step by step I took them out of the verdict. I also replaced a 0 to 100 score with three plain verdicts, because the score pretended to a precision the scanner doesn’t have. Every scan logs why it decided what it did.

   The scanner has shareable reports, a batch API for up to 100 addresses, a deep crawl of up to 10,000 pages, and an admin console with scan history, monitoring and alerts. It runs in production with automatic deploys and a PHPUnit suite. About a hundred commits went into false alarms, and I checked each one on the live site that caused it.

   By early July 2026 it had checked more than 1,000 sites. On the same 145 WordPress sites, confirmed threats went from 17 to 2, and one of those is probably real. So a flag from the scanner is worth acting on.

   Stack: PHP, MySQL, JavaScript, PHPUnit, GitHub Actions

7. 2026

   Lead-signal pipeline in Python and FastAPI

   A Python and FastAPI service that collects public company signals and sends the agency a morning digest. I wrote the specification with the owner from his concept, and built the code, the deployment and the server myself.

   I tested each data source before building on it. I wrote collectors for new trade register entries, EU tenders for CMS and website work, and agencies hiring TYPO3 developers.

   Then I measured lead quality. Matching companies by name found 0 of 60, so I dropped it. A keyword filter on one industry code was right 89% of the time.

   On top of that I built scoring, duplicate detection and a morning digest. I closed the confirmed findings of two rounds of crash tests and deployed it on a VPS with Docker, Caddy and scheduled jobs, with nightly backups.

   It went live on 30 July 2026. Its server now also runs another agency tool.

   Stack: Python, FastAPI, PostgreSQL, Docker, Caddy

8. 2026

   VPS setup for a PHP web tool: HTTPS, cron and tested backups

   I set up the production server for the owner’s public PHP check tool, on the VPS that already ran another agency service.

   Before the first deploy I found a missing DNS record: the subdomain did not point to this server. Then I made a key-only deploy user without admin rights, a separate PHP-FPM pool and a site config with automatic HTTPS. I closed the data folder and the settings file to the web.

   The cron lines in the ticket would have left an empty log, so I set up the cron jobs with timestamps and logging. The nightly database backup has an integrity check and is kept for 30 days, and I proved it with a test restore. The server was ready on 24 August 2026 with all five acceptance criteria met, and the configuration of the existing service stayed untouched.

   Stack: PHP-FPM, Caddy, Docker, SQLite, Debian

9. 2026

   Offer pages and a production check for a PHP client hub

   I made offer pages and deploy tooling for the owner’s PHP client hub. Each offer sits on a private link.

   I wrote a procedure for offer pages and committed it to the hub’s repository. Every claim is checked on the prospect’s live site and against the platform’s built-in features. Client documents went out through the hub in summer 2026.

   I also wrote a deploy script that ships one document to production and nothing else. Then I compared production against the repository without changing anything, and wrote down what to align before the next deploy.

   Stack: PHP, MySQL, Bash

10. 2026

    Self-hosted project tool upgrade on Docker and Easypanel

    I upgraded the agency’s self-hosted project-management tool, which could no longer be deployed on its small server.

    Before touching the template I looked at the server. The disk was 100% full with 76 MB free, while the Easypanel template already pulled the right release, so I left it as it was. The same disk held two other live systems. I freed space only from the system journal, container logs and unused images, and touched no data. Disk use fell to 89%.

    I took a database dump and wrote a rollback plan before the deploy. The deploy ran with migrations, and I checked every project’s tasks in place. The tool moved from 1.2.2 to 1.4.2. Two weeks later it was still on 1.4.2, with no rollback.

    Stack: Docker, PostgreSQL, Easypanel