Dare2Learn

Dare2Learn is a specialist practice offering literacy, maths and workplace assessments, tutoring and coaching. The site ran on WordPress with an Elementor theme.

The client asked for two things: move the site to AWS, and improve its security and presentation. The content itself was sound and did not need rewriting.

The first job was to find out exactly what was on the site. Everything was pulled through the WordPress REST API and checked against the rendered pages, which gives both the structured content and whatever the page builder had added on top of it. That produced a written inventory: 14 pages, 3 posts and 48 images, each listed with its slug, its size and a note on whether it should be carried over.

Three pages turned out to be developer leftovers that were publicly reachable. They were dropped rather than migrated. The rest were rebuilt as static pages in Astro, with the contact form, the privacy policy and the accessibility statement treated as separate pieces of work rather than straight copies.

The inventory was handed over as a findings list before any rebuilding started, so the client could see what was being fixed and why.

• Images without descriptions

  Of the 55 images across the site, 39 had empty alt text, so a screen reader announced nothing where a picture sat. On a site selling neurodiversity assessments, a page that does not work with a screen reader undercuts the service being offered. Every image the rebuild uses carries a description.

• Test pages left public

  Three duplicate and placeholder pages were live and reachable. They were removed rather than carried over.

• Unprotected contact form

  The form had no spam protection of any kind, on a page that collects names and email addresses.

• Mismatched URL and title

  One core service page sat at /numeracy-assessments/ while calling itself Maths Difficulties. Slug and title were brought into line.

• Oversized images

  Several page graphics were PNGs of 1 to 2.6 MB, served at full size to phones. Twelve more were not referenced by any page at all. The rebuild drops the unused ones and serves the rest as WebP: 18.5 MB of images became 1.2 MB.

• Legal pages out of date

  The privacy policy and accessibility statement described the old site, the old host and cookies it no longer set. Both were rewritten for the new setup and UK GDPR.

The site is static. Pages are built ahead of time and served as files, so there is no PHP running, no plugins to keep patched, no database to reach and no login page on the public site. That removes most of what gets a WordPress site compromised, rather than defending it.

• S3 and CloudFront

  Static files in S3, served worldwide through CloudFront over HTTPS.

• Contact form on Lambda

  The form posts to a Lambda behind API Gateway, which sends through SES. No third-party form service, and the messages go straight to the practice inbox.

• DNS moved to Route 53

  DNS hosting was moved to Route 53; the domain registration stayed where it was. Mail is unchanged and still hosted elsewhere: the MX, SPF, DKIM and DMARC records were carried across verbatim so nothing stopped arriving during the move.

• Admin kept off the public site

  The client's editing panel is not at a guessable path, and is gated at the CDN edge before a request reaches any page. Behind that gate: hashed passwords, server-side sessions that expire, and rate limiting.

• No secrets in the repository

  Credentials live in AWS Parameter Store and are injected at deploy time. Nothing sensitive is committed.

• Deploys on push

  A push to the main branch builds the site and syncs it to S3. There is no manual upload step to get wrong.

• Built to be found

  Canonical URLs, a generated sitemap, structured data and page titles carrying the terms people actually search. The home page went from roughly 2.2 MB of images to 224 KB, which matters for phones and for how search engines rate the page.

dare2learn.co.uk now serves from S3 behind CloudFront. The WordPress installation is gone, along with the plugin and PHP patching that came with it, and the running cost is a fraction of what hosting a database-backed site costs.

Every image carries a description, the pages that should not have been public are not, and the contact form is protected and delivers to the practice directly. The domain and the code are the client's, and the site can be handed over intact.