F.A.R. Motor Experts

The opportunity

F.A.R. Motor Experts needed a website that could take real customer enquiries — including photos of vehicle damage — without exposing the business to the security and upkeep problems that usually come with handling uploads and personal data on a small business site.

The approach

I built the site with Astro, keeping most pages prerendered and running only the contact, quote, confirmation and private-file routes on the server. A Decap CMS instance, self-hosted from the public folder, lets non-technical staff edit services and homepage content and commit changes straight to the Git repository — no separate CMS database to maintain.

The quote and contact forms were treated as the highest-risk part of the build. Submitted photos are decoded, resized, re-encoded as WebP, stripped of metadata and stored outside the public directory; SQLite records the enquiry itself. Every submission passes same-origin checks, a signed CSRF token, a honeypot field, route-level rate limiting, server-side validation and an idempotency key, so retries and bots cannot duplicate or spoof a real enquiry. Staff access uploaded images through signed, private links that expire after seven days, and records are marked for expiry after 90 days by default.

Contribution

• Built the site with Astro, TypeScript and a Node adapter in standalone mode.
• Set up Decap CMS for Git-backed editing of services and homepage content.
• Implemented quote and contact forms with CSRF, honeypot, rate limiting and idempotency protection.
• Built an image pipeline that resizes, re-encodes and strips metadata from customer uploads.
• Added signed, expiring private links and a default 90-day enquiry retention policy.