Bradley Digital · client builds
Every one of our 22 live sites was built to an awards-jury bar. We build the same way for you — and then do the parts a beautiful site alone never does: the brand, the words, the search results, the ads pointing at it and the upkeep after.
£2,500 flat
the site, 3 pages
from £5,000
the whole thing
The build
£2,500 flat3 pages · no hourly billing
Tag the sites you love — that is the brief. We build yours to the same bar, on the same stack, and put it live.
The clause
+£5002-year term
By default a build may join the prompt catalog after launch — that is how the catalog stays alive. Pay this and yours does not, for 2 years.
The lot
from £5,0006 pages · 6 months of Care
You have an idea. We take it from there — named, branded, built, found, advertised and looked after.
On every custom build
Every custom build ships with an admin only you can reach. Change the copy, swap an image, update a price, read the enquiries that came in overnight — without emailing us and without waiting.
It is built for your site specifically, which is why there is no CMS underneath it. Nothing to keep patched, no plugin to be the reason you get hacked, and nothing you have to learn twice.
Package
You describe the thing you want to exist. We interrogate it until it has a shape, an audience and one reason to be remembered.
Package
Pages, structure, what each one is for and what it has to make someone do. Agreed before anything is designed.
Package
Logo, type, palette, voice. The site cannot look considered if the thing it represents has not been decided.
Every build
Signature mechanic first, then the full composition. You watch it come together live — no big reveal at week six.
Every build
Structure, metadata, schema, sitemap, speed. Built in from the first page rather than bolted on when nobody can find it.
Package
Domain, records, analytics, the deploy. Then ad creative and a campaign pointed at the page built to receive it.
Care plan
Patched, monitored, backed up, and someone to call. Six months included with the package, then your choice.
Included, never charged for
None of this is an upgrade. Charging extra for a site that is not trivially breakable would be charging you for competence.
The most common way a small business site gets hacked. We do not build on WordPress — no CMS, no plugins, statically rendered. The threat is absent rather than defended against.
Payments run through hosted Stripe checkout. Card details never touch your site, so there is almost nothing to steal and almost no compliance to carry.
A content policy that will not load a script from an origin we did not name, so a compromised widget cannot be introduced by URL. Plus HSTS, no-sniff, and a site that cannot be framed.
Every build ships a login, so every login is built expecting one: two-factor capable, lockout on repeated failures, sessions that expire, and an audit log of what changed.
Every release is reversible in under a minute. The worst version of a broken morning is a rollback, not a rebuild.
Keeping it that way
It is a thing that keeps running while the internet changes around it. Two plans, and which one you want depends entirely on what your site actually does.
For a site that sits there and sells
For a site with a login, customer data, or ad spend behind it
Everything in Care, plus:
A three-page site that shows your work and takes enquiries wants Care. Care+ is for sites where something would actually be lost — a customer list, a login, money going out on ads every day. If you are not sure, start on Care; moving up takes an email. The from £5,000 package includes 6 months of Care, which is £720 of it, so you can decide once you have lived with the site.
What we do not sell — penetration-test certification, SOC 2, PCI attestation, 24/7 monitoring or cyber insurance. And nobody honest will tell you a website cannot be hacked. What we will tell you is which ways in we have closed, and which ones we are watching.
Any site · including ones we did not build
£750 one-offone site · written report · no subscription
You do not have to be a client, and it does not turn into one. Findings are ranked by what would actually be exploited first rather than by what scores worst on a scanner — and if the honest answer is that nothing needs doing, that is what the report says.
Security headers and content policy
Dependencies and known advisories
Exposed endpoints and admin routes
Login, sessions and rate limiting
SPF · DKIM · DMARC email records
Backups, and whether a restore works
What you store about customers
Speed and Core Web Vitals
Upkeep afterwards is only offered on sites we built. Inheriting an unknown plugin stack means inheriting someone else’s incident — if the audit finds that much, we would rather rebuild it properly than promise to keep it standing.
Tell us what you are making, when it needs to exist, and how much of it you want us to carry. We take a small number of client builds so every one gets the catalog treatment. Nothing to pay until we have agreed the build.