A veterinary practice's website has one job that matters more than the rest: when someone's animal is ill at seven in the evening, it has to say, quickly and on a phone, what to do and whom to call. Everything else, the team, the services, the prices, the news, is in service of trust, and trust is not helped by a page that takes four seconds to arrive, asks about cookies before it says hello, or sits in a hosting account that is not the practice's own. Malvern Hills Veterinary Practice, an independent clinic in Hanley Swan, Worcestershire, has been a client through 2026, first for the ordinary stewardship of a small practice's IT and website, and from August for a rebuild of the site itself.
The site it had was a managed content platform on shared hosting, kept in good order: prices updated, a senior-clinic page given a proper booking route in place of an embedded form, form entries cleared down every week or two so that the site held no more personal data than it needed, and both of the practice's mail domains brought up to the full set of authentication: signed outbound mail, a tightened sending policy and reporting, verified end to end by reading the headers of real messages. In August the question was put to the practice in a written briefing, whether to stay on the platform or move to a static site, on the view that a client choosing between the two should be choosing rather than deferring. It chose the static site, and said so in writing before anything moved.
What the practice has now
Fourteen pages and a news section of thirteen posts, hand-built, with every address, title and description the old site had preserved, so that nothing anyone had bookmarked or searched for was lost, and the old addresses redirecting to their new homes. Two forms, an enquiry and a registration, the second carrying a UK address and a block for each animal, both working without scripting and both delivering straight to the practice's inbox without storing a submission anywhere on the way. A prices page one tap from the home page on a phone. A static map in place of an embedded one, so that the page requests nothing from anybody until a visitor chooses to open directions. Self-hosted fonts, images served in a modern format with the original as fallback, and a three-minute tour video that plays on every phone. No cookies: the cookie policy was retired outright rather than maintained, and the privacy notice rewritten to describe what the site actually does.
The home page scores 96 for performance on a throttled phone and weighs under four hundred kilobytes. Accessibility scores one hundred on every page, after an audit before launch that measured every text colour pairing on every template rather than sampling a few, and every page fits a 320-pixel screen without sideways scrolling. The hosting costs the practice nothing a month.
Keys handed over before the switch
The site lives in accounts the practice owns. A code-hosting account and a hosting account were created in the practice's name, registered to a mailbox in its own tenancy, with two-factor authentication on and the recovery codes in the practice's safe rather than ours. Every push to the main branch mirrors the whole history, every branch and every tag, into the practice's own repository, and the mirror writes down the last commit that made it across, so whether the copy is current is a question with an answer rather than an assumption. The credential that deploys the site is scoped so that it lapses of its own accord when our membership of the account ends; the platform's own repository integration was declined, because it installs a relationship rather than a key, and a relationship has to be remembered to be removed. Two days before the switch the logins and recovery codes were handed over in person, so that the practice held its own keys before the site went in front of the public.
Proven, not assumed
The forms were judged by the headers of what arrived rather than by the green tick on the page. Real submissions from a desktop and a phone, relayed through a sending account and a spam check held in the practice's own name, authenticated as the practice's own domain, passed the stricter check a mail filter applies to outside mail claiming to come from inside, and landed in the inbox; a reply from the practice's own mail client went to the enquirer, as it should. Every way of being refused, the honeypot, validation, a missing spam token, no scripting, a post with no body at all, was exercised without a message being sent. The phone found the one thing no harness would have: it offered a human birthday for a dog's date of birth. The pet fields no longer accept autofill, and the label says whose birthday it wants.
The build machine had no image or video encoder installed, and nothing was installed to finish the job. The images were converted by a headless browser drawing each one on a canvas and handing back its own encoder's output, forty-five of them in seven seconds, a quarter smaller overall. The tour video, too large for the hosting tier as uploaded, was re-encoded through the operating system's own encoder in three seconds; and because the tier serves a video whole rather than in ranges, which a phone's browser needs before it will play one at all, the page downloads the clip once on the first press, with a percentage, and plays it locally, seekable everywhere. Without scripting the plain video stays.
— On the switch —Changing the nameservers took minutes. The days before were spent making sure the change could take nothing with it.
A switch that could be undone with one change
The site went live on Saturday 3 October 2026, once the practice had closed for the weekend; it had approved the date on the Tuesday. Mail mattered most, because the practice's email runs on the same domain, so every record in the old zone was accounted for first. The old host's control panel supplied the list, and because its list view cut long values short, every value was read in full from the authoritative nameservers instead. Each record was then either replicated in the new zone or deliberately left behind as an artefact of the old hosting, until nothing on the list was unexplained, and the new zone was compared with the old one record by record, against both of its nameservers, before anything moved. Nothing at the old host was touched, so that undoing the switch stayed a single change: point the nameservers back.
Within minutes of the switch the public resolvers answered with the new nameservers, every mail record still matched, both hostnames carried valid certificates, and the old addresses redirected. The checks two days later found nothing to fix: the reply to a test message passed every authentication check, all twenty-seven pages in the sitemap answered at their own canonical address, and the search console had the new sitemap. A week of watching followed, the last days of it under two external monitors that fetch the site every five minutes, one of them an endpoint that answers only when the site's server-side code is actually running and both secrets the forms depend on are present, though never what they are. A final round of checks from outside on the Saturday found everything as Monday had left it. The practice raised nothing all week. The old hosting is the last thing to go, and it goes only once nothing can still be pointing at it.
What the practice has, then, is a site that is faster, plainer and cheaper than the one it replaced, that it owns outright and could hand to anyone, built on a decision it made in writing and switched over in a way it could have reversed in a minute. The stewardship continues as before, and the form entries no longer need clearing down, because there are none to hold.