Services
Eight of them. The first builds the whole site; the seven after it are the pieces of that same work, sold on their own for a site that already exists. They share one rule — everything is measurable before and after, by you.
1. Website builds
A complete WordPress site, crawlable from the first day it is online, rather than one that gets a technical pass a year later. A five-page site or a business site with a product catalog, brand pages and legal pages — the difference is scope, not method. Every one of them ships with the work the seven services below sell separately — crawler access, cache and TLS, structured data, the legal pages — already done, and verifiable from outside on the day it is handed over.
What is included
- Theme and layout, set up so the content survives without JavaScript
- Caching, CDN and TLS, configured and then verified from outside the server
- Security: login protection, firewall rules, and file ownership that does not break the updater
- Legal pages — privacy, cookies, terms — written for what the site actually does
- Structured data, robots.txt, sitemap and analytics, checked against the crawlers that will read them
Your material, not stock photography
Whatever your old site already holds is recovered and reused: product photographs with your own labels in them, certifications, the marks of the companies you work with. When those arrive fused into one flat picture — the row of client logos saved as a single image, unreadable on a phone — they are cut apart one by one and rebuilt as a grid, each with its own alt text. Where an image genuinely does not exist, one is generated and then checked against what it claims to show; the ones that do not survive that check are redone rather than shipped.
What I will not make
Logos or brand marks for companies that are not you. When a certification body’s mark or a client’s logo belongs on your site, the real one goes there, taken from what that company already publishes. An approximation of somebody else’s mark is a problem you do not want sitting on your own homepage.
About the legal pages
Privacy, cookie and terms pages are written to describe what your site actually does: which analytics run, which cookies are set, what a form stores and for how long. They are a starting document and not legal advice, and they are handed over to be reviewed by a lawyer before you rely on them. I am not one, and a page that describes your site correctly can still be wrong about your obligations.
Moving an existing site
A migration is quoted as its own job, and the quote names the traps before the move instead of after it. The ones that decide whether it goes well:
- Your URLs live inside serialized data in the database. A plain find-and-replace corrupts it, and the damage surfaces later as pages that half-load
- Apache and LiteSpeed do not share a security configuration. Whatever protects the old site does not travel with it and has to be rewritten for the new server
- Without 301 redirects every old URL dies on move day, and whatever ranking they held dies with them
- The destination’s PHP version is checked before anything is built on it, not after
- Mailboxes can be moved without the old passwords — pulled out by file transfer and put back with new credentials — which matters when nobody can find them
What it needs from you
A domain, a decision about hosting, and the content — or an agreement on who writes it.
Look at one before you commit
activeforgepro.com, readystatesupply.com and barmanexpresschool.com are mine, built this way and running on my own VPS, and the fourth is the site you are reading. They are not client references, and that is the point: open them and inspect the headers, the markup and the robots.txt yourself. Nobody has to vouch for me.
2. Crawler and AI readiness audit
I request your site the way each crawler does, one at a time, and report what comes back — under the rules and the stated limits in How I measure. Nothing is installed and nothing changes on your side. I publish the same kind of finding about my own domain: here is what a public check actually required, and the two records I refused to publish.
What I test
- Live fetch as Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot, with the real status code each one receives
- robots.txt, XML sitemap, canonical tags, structured data, Open Graph
- llms.txt, Content Signals, Link discovery headers, Markdown negotiation
- Server, CDN and cache layers, and which of them will fight your changes
- Redirect chains, render weight, and whether your content exists without JavaScript
- Files that answer to anyone who types their address: database dumps, site backups left in the web root, and working copies that were never meant to ship
What you get
A prioritized report. Every finding carries the request and the response that produced it, so you can repeat the test yourself. Findings are ordered by what they are worth, not by how easy they are.
What it needs from you
Your domain. Nothing else. No credentials, no plugin, no access.
3. Technical SEO
What the audit found, fixed on the layer the problem is actually on.
What I fix
- Canonical tags, and duplicate URLs competing with each other
- Redirect chains, and redirects that drop the request halfway
- Index coverage: what is indexed, what is excluded, and which of the two you wanted
- Render weight, and content that only exists after JavaScript has run
- robots.txt, sitemaps and structured data that disagree with the site they describe
Where the fix lands
Server, CDN and cache, not only the CMS. Those layers are the ones that quietly fight your changes: a rule you set in WordPress that a cache layer ignores looks exactly like a fix that worked, until someone requests the page from outside.
What it needs from you
Access to the layer the problem lives on — sometimes the CMS, more often the host or the CDN account. If you would rather not hand over access, you get the change written out for your developer instead.
4. Cloudflare security and performance
Cloudflare set up so that protection never costs you visibility. Managed rules ship switched on, and a rule nobody chose by hand can still return 403 to Googlebot.
What I set up
- Full (strict) TLS, so the connection is verified all the way to your origin and not only to the edge
- DNSSEC, HSTS, and the DNS records that go with them
- WAF rules that protect the login and xmlrpc without touching crawler traffic
- Cache rules verified request by request, with HIT and MISS read off the response instead of assumed from the dashboard
What I will not turn on
Bot Fight Mode and AI Labyrinth. Both challenge or feed nonsense to automated traffic, and neither can reliably tell a scraper from Googlebot. When they get it wrong, nothing in your dashboard says so.
What it needs from you
Access to the Cloudflare account that holds the zone. Finding out what it is doing to you today needs only the audit.
5. Web consulting
A second pair of eyes on the stack: hosting, DNS, TLS, email deliverability (SPF, DKIM, DMARC), caching, plugin decisions and migrations. Nothing changes until you decide it should.
What you get
The exact change, the file or DNS record it goes in, and the reason — whether I apply it or your developer does. When a change is not worth your money, you get that answer too, with the reasoning attached.
Where the silent failures usually are
Email. A domain publishing a strict SPF policy and DMARC set to reject, with a sending service that was never authorized in either, has its mail rejected on arrival and nobody is told. The contact form still shows its thank-you message. The messages simply never arrive.
Plugins are the other one. Each is a dependency and an attack surface, and I argue for removing more of them than I add.
What it needs from you
Usually read access is enough to get you an answer: the hosting panel, the DNS zone, the plugin list.
6. Business email routing and deliverability
Mail that bounces, mail that never arrives and is never reported, and a domain that cannot prove it sent anything. Email is rarely broken. It is misrouted — and which record is doing it can be shown from outside, without opening a single message of yours.
What I test
- Your MX records, and whether the server they name will actually accept mail for your addresses — asked one address at a time, against an address I invented as a control, so that an acceptance means something
- SPF, starting with whether it is valid at all. The limit is ten DNS lookups; past it the record does not get weaker, it fails outright and your domain counts as having no SPF
- DKIM: whether the selector your sender signs with resolves, and whether the key published in DNS is the key actually in use
- DMARC: what your policy instructs a receiving server to do, and whether SPF and DKIM agree with it or quietly contradict it
- What happens to a message addressed to you today: accepted, rejected at the door, or accepted and then discarded
What you get
The record that is wrong, the value it should hold, and the exchange that proves both: the SMTP conversation and the DNS answers, written out as the commands that produced them. Your provider can repeat every one of them, which is usually faster than being believed.
How the test works, and why it is safe to run
A sending server asks a receiving server whether an address exists before it delivers anything. That question is the whole test. A 250 means the address is accepted; a 550 means it is refused. No message is sent, nothing is delivered, and no mailbox is opened. The control address — one I make up, which cannot exist — is what makes a positive answer worth anything: a server that accepts everything is not telling you your address works.
When the answer is a move
Mailboxes get measured, not read. Each one reports its own size, which is what decides whether a plan priced per account will actually hold your history — a five-gigabyte limit is the wrong plan when two mailboxes hold eight. That number comes before the move is quoted, not after it has already failed.
What it needs from you
Your domain, to find out what is wrong. The tests are the same public requests any mail server makes when it tries to send you a message. Fixing what they find needs access to the DNS zone, yours or your provider’s.
What I will not do
Read your mail. Routing is diagnosed from the envelope and never from the contents, because a status code answers the question and the message does not. And I do not touch a mail account — yours or anyone’s — without written authorization from the person responsible for it. If you cannot give me that in writing, the diagnosis still runs from outside; only the repair waits.
7. Long-form articles, sources verified
Individual posts of 3,000 words or more, in English or Spanish, where every claim links to a source that was checked before publishing.
What you get
The article, its sources linked inline where the claim is made, and the structured data that tells a machine what it is reading. Written for a person first; the markup is there so a crawler does not have to guess.
What it needs from you
The topic, who it is for, and whatever a source cannot give me — your data, your process, the constraints you work under. Publishing access as well, if you want it live rather than delivered.
What I will not write
Claims I cannot source. If a number cannot be traced back to something you can open and read, it does not go in and the article is shorter instead. No invented references, no filler to reach a word count.
8. Ongoing care
The routine I run on my own sites, run on yours, plus two posts a month. The four sites linked above are the ones it runs on — mine, not client references, and that is the point: request one as Googlebot or as GPTBot and read the status code that comes back.
What is included
- Core, theme and plugin updates, applied after a backup and followed by a request from outside the server to confirm the site still answers
- A weekly pass over the server, cache and error logs — what changed, what started failing, and which update did it
- Crawler access re-tested as Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot, so a rule that starts returning 403 is found that week instead of at the next audit. Which of them you allow is your decision; the test reports what each one is actually served either way
- Cache, CDN and TLS checked from outside the server, and the sitemap checked against what the server returns — with index coverage too, if you give me read-only access to Search Console
- Two posts written and published, sourced the way the long-form articles above are: every claim links to something you can open, and a number that cannot be traced does not go in. These are shorter than the 3,000-word pieces, which are quoted separately
- A monthly note in plain language: what I changed, what I found, what I left alone and why, with the request and the response behind each claim so you can repeat any of it
Small fixes are part of the plan and get applied the same week. Anything larger is quoted before I start it rather than billed after: you get what I found, what changing it would take, and a price, and you decide.
What it does not cover
Nights and weekends. One person in one time zone, no pager and no 24-hour desk: if the site goes down at three in the morning, it stays down until I see it or you tell me. If an hour of downtime costs you real money, what you need is managed hosting with a support contract, and I will say so rather than take the money.
Hosting. Your site stays where it is — I work on it, I do not run it. I do not put client sites on my own server either: it carries four sites of mine, and sharing it would mean my incidents become your downtime and yours become mine. If your host is the problem you will hear it from me, with help moving to a better one. Not to mine.
Rebuilds, migrations, redesigns and recovering a site that has already been broken into are jobs, and they are quoted as jobs. No plan makes a site unbreakable either; what this one shortens is the time between something changing and somebody noticing.
What it needs from you
Access to the layers the work touches: the CMS, usually the host, and the DNS or CDN account. One person who can answer a question, so a yes or no does not wait a week. For the posts, what no source can give me: your numbers, how the work actually gets done, and what you would rather not say in public.
How it is billed
Priced per site, not from a list: the routine above, on a site closer to five pages than to three thousand URLs. What it costs on yours is agreed before the first month instead of discovered halfway through it. Month to month, no minimum term: tell me before the next billing date and it stops, and you still get that month’s note. When it ends, I will list exactly what accesses I was handed so none of them are missed when you revoke them.
Start with the audit. It tells both of us whether there is anything here worth paying for every month.
How implementation works
Where I work directly
WordPress, and at the server level on Apache, Nginx, LiteSpeed and Cloudflare: cache rules, WAF, DNS, TLS, DNSSEC, structured data, llms.txt and agent discovery.
Where I hand it to your developer
Other CMSs and custom applications. You get the exact changes, with the file, the rule and the reason. A Drupal site does not need me to know Drupal — it needs to know what is broken and what to change.
What I will not do
Touch a live site without a verified backup, an agreed window and a written rollback plan. And I will tell you when a platform makes the work pointless — Wix and Squarespace do not allow the server-level files half of this needs.
What I will not promise
That you will appear in ChatGPT, Perplexity or AI Overviews. Nobody controls what those systems surface, and anyone selling it is guessing with your money. What I deliver is a site that is readable and not turning crawlers away, measured before and after, by you.
To read anyone’s mail, or to touch a mail account, without written authorization from the person responsible for it. A diagnosis runs from outside and needs no such access; only a repair does, and it waits until that authorization exists.
Start with the free check
Send your domain and you get a written check of your homepage, free. It needs no access to anything of yours: no credentials, no plugin, no dashboard login. I make the same public requests any visitor makes.
What is in it
- Your homepage requested as Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot, one at a time, with the status code each one received
- Your level on the public checker I use, and — kept separate from it — how many of my own seven controls your site has
- robots.txt, canonicals, structured data, llms.txt, Content Signals, Link headers, Markdown negotiation, CDN and cache, on that one page
- Your sitemap found and its URLs counted
- The five requests written out as the commands that made them, so you can rerun any of them yourself, today, without me
What is not in it
Any URL but the homepage. One page is requested; the rest of your sitemap is the full scan. You get the findings on that page, not the ranked reading of them — that is the audit. No snippets, no walkthrough, and no change to your site: nothing is installed and nothing is touched.
What it looks like
This block is an example written to show the format. It is not any site’s data, and the domain in it is the one reserved for documentation.
EXAMPLE OUTPUT: not a real site
GET https://example.com/
Googlebot 200
Bingbot 200
GPTBot 403
ClaudeBot 403
PerplexityBot 200
robots.txt names all five
sitemap.xml 412 URLs
llms.txt not found
controls 3 of 7 present
The finding under that output would read: two crawlers your robots.txt invites by name are refused before the request ever reaches WordPress. The rule is at the edge, not in the file you edited.
A robots.txt that welcomes GPTBot is not evidence that GPTBot is being served. Reading the rules answers one question. Requesting the page as GPTBot answers the other, and the public checkers do not make that request.
When it arrives, and how many I take
One person, one time zone. I will not promise twenty-four hours. You get a short reply confirming the domain, and the check follows within two to three business days of it.
It arrives by email from john@visibleorigin.com. Look in your spam folder before you assume I ignored you: a report made of status codes and raw headers is exactly the shape a filter dislikes.
Five a week, one per site. Done by hand, a check takes real time, and one rushed to clear a queue is worth nothing to either of us. When the week is full I tell you which one is open next. Waiting never turns the free check into a paid one, and paid work is never queued behind it.
Pricing
The free check above stops at one URL. The three packages below start there and carry on through the rest of the site. The method is fixed: the same requests, in the same order, made from outside, whatever the domain is. The price is not fixed, because the work is not: send the domain and you get a number before anything runs.
The audit: three packages
One URL is free. The scan covers every URL in your sitemap. A homepage that answers all five crawlers cleanly says nothing about the pages behind it. Past a thousand URLs I quote the scan before I run it.
Scan
The same crawler requests as the free check, made against every URL in your sitemap instead of only your homepage.
- The URLs that answer differently from your homepage, listed on their own
- Your sitemap against what the server serves: the URLs that come back 404, redirected or blocked
- Requests paced one at a time, so a scan never looks like an attack on your server
For the four hundred pages behind a homepage that already tests clean. A dozen URLs on one template do not need this, and I will say so before you pay.
Audit
Everything in the scan, plus the part the scan is not: what each result means and which of them are worth your time first.
- Findings ranked by what they are worth, not by how easy they are to fix
- Which layer each block lives on. The scan shows you a 403; this tells you who sent it
- Patterns instead of rows: one bad rule explaining two hundred URLs, written once
For a red scan that needs sorting into what matters. What is already fine is stated as plainly as what is broken.
Audit and plan
The audit, plus what to do about it: the exact changes, in sequence, and a recorded walkthrough.
- The snippets themselves — robots.txt lines, cache and WAF rules, headers, markup — written for your stack
- What to re-request after each step, to confirm it landed instead of only looking like it did
- A recorded walkthrough, as a private link you can keep or forward to your developer
For whoever does the work — you, or the developer you hand it to. Implementation is quoted separately, and never without a verified backup.
What the audit does to the price
Implementation is quoted from evidence, and the audit is that evidence. Once it exists, nobody is pricing the unknown: a fixed number, in writing, before I start, covering the findings listed in that report. Not an hourly rate that keeps discovering work.
It moves in both directions. A site in worse shape than the starting price assumes costs more, and you will see which findings made it more — each with the request that produced it and the code that came back.
That number has the same limit the audit has: it is made from outside, which is where the crawlers stand. From outside nobody sees a broken theme, two plugins fighting, or a host that will not grant the access a fix needs. If one of those turns up once I am in, I stop and quote it before anything restarts. Nothing is touched until you have approved that number.
Everything else
- Website builds — scoped before they are quoted
- Technical SEO — quoted per job
- Cloudflare security and performance — quoted per job
- Web consulting — quoted per job, no starting price published
- Business email — the diagnosis quoted per domain, the repair per job
- Long-form articles — quoted per article
- Ongoing care — monthly, priced per site
Nothing here carries a list price. A five-page brochure and a three-thousand-URL store are not the same job, so the number comes after I have looked at the domain.
Send me the domain and you will have a number, not a discovery call. If what you want is a build, an article or a security review, say so in one line.
Send me your domain
That is the whole intake. No access to your site is needed for an audit — I make the same public requests any visitor makes. If what you want is a build, an article or a security review, say so in the message.