Most WordPress form plugins store submissions as plaintext. For a clinic site, that is a problem. Here is how I encrypt form data with PHP’s built-in libsodium, and what the encryption actually buys you.
Data you do not have cannot leak. The form database holding four years of intake records is the accumulation mistake almost every clinic has made. Here are the three honest retention windows.
Most clinic sites have a backup. Almost none of them have a backup that would restore at 3 AM on a Sunday when the server is on fire. Here is the gap, and the strategy that closes it.
Most clinic blog posts are written for people who already decided to call. The traffic that grows the practice comes from readers who haven’t decided anything yet. Here is how the writing changes when you write for them.
Self-hosting your fonts saves a few hundred milliseconds on LCP and drops a third-party dependency in the process. Here is how to do it, plus a few other small Core Web Vitals wins that add up.
No clinic sets out to put PHI in a non-HIPAA CRM. The drift happens in five small steps, each reasonable in isolation. Here is the audit and the three remediation paths.
A patient portal is not a website feature. It is a regulated clinical system. Bolting one onto a marketing site is a category mistake. Here is what the website should do instead.
WordPress is great at request-response. It is worse at long-running background work. Here is when adding a small Go service alongside PHP makes sense for a small business, and when it does not.
The average clinic site loads more third-party scripts than the clinic can name. Each one is a trust relationship. Here is the four-question audit and the usual suspects.
The keyword research worth doing is the one based on what your patients actually typed into Google before they called you. Not the agency dashboard version. Here is how to find the real questions.