When you need development, not a brochure site
A brochure site is the same for every visitor. Development starts when the site has to behave differently for different people, or has to store something. These are the usual signs:
- Logins and member areas: parents, students, members or staff who each see their own information.
- Bookings: classes, appointments or rooms with limited slots that must not be double-booked.
- An admin panel: a screen where your team adds events, listings or results without asking a developer.
- Portals: several kinds of user, such as organisers, judges and entrants, each with different permissions.
- Several languages kept in step across a larger amount of content.
If none of these fit, you are better served by a simpler site. See website design or our page for small businesses. If one does, the examples on our projects page show the kinds of portals we have built, from competition platforms to school portals and a business directory.
How we scope a custom portal
A portal cannot have an honest fixed price until someone has listed what it must do. So we work in this order:
- A chat. You explain who uses the system and what each person must be able to do. We ask what happens when things go wrong, such as a cancelled booking.
- A written quote. We send the feature list, the price and what is left out. The custom portal price starts from RM799 and is quoted after the chat; the more roles, screens and rules, the higher it goes.
- A deposit, in writing. For custom work only, we may agree a deposit. It is written down before you pay, with the date and amount.
- Preview and two rounds of changes. You test a working version, tell us what to change, and we change it twice before launch.
- Launch checklist. Then the site goes live, with hosting on the size that fits (see below).
The simpler tier, a site with a login or a booking form, starts at RM499. The pricing page shows both next to each other.
The technology, in plain terms
You do not need to learn these names, but you should be able to ask what is being used and why.
| Tool | What it does | Why we use it |
|---|---|---|
| Astro | Builds ordinary sites as ready-made pages. | Nothing runs on a server for each visitor, so pages load quickly and there is less to attack or pay for. |
| Next.js and React | Build pages that change for each user, such as a dashboard. | Widely used, so developers are easy to find and the tools are well maintained. |
| PostgreSQL | The database that stores accounts, bookings and records. | A proven database with strict rules for data, and your data can be exported in standard form. |
| Prisma | The layer between the site and the database. | It keeps database requests in a fixed, checked form, which closes off a common attack where text typed into a form is run as a database command. |
| Vercel | Hosts the site and serves it from many locations. | Automatic HTTPS, simple publishing and rollbacks. Its servers are outside Malaysia; our hosting page explains what that means. |
The pattern is the same throughout: common, well-supported tools, so your site is not tied to one person's habits.
Security basics we build in
These are not extras. Any site with accounts gets them:
- Hashed passwords. Passwords are stored as a one-way scrambled value, never as readable text, so even we cannot read them.
- Access control for each user. The server checks on every request that this person may see this record. We never trust an ID sent from the browser, so changing a number in the address bar does not open someone else's file.
- Input validation. Everything typed into a form is checked on the server, not just in the browser.
- No secrets in the browser. Keys and database passwords stay on the server and are never placed in code that visitors can download.
- Security headers that tell browsers to refuse common tricks such as loading the page inside someone else's site.
The common ways sites get broken into are catalogued by OWASP's Top Ten, and we build against that list. No system is unhackable, and we will not say otherwise.
The launch checklist
Before any site goes live it goes through a written checklist: security headers, a privacy notice, accessibility, backups and speed. For a portal we add checks that matter only with accounts: one user cannot open another's records, test accounts are removed, and any temporary passwords are changed. Where the site stores personal data, we also agree in writing how that data is backed up.
Ownership, data and handover
Your content and your domain are yours. Once the build price is paid, so are the finished design and files. If you leave, you tell us before the next billing date, we send your website files within 14 days and help point the domain at a new host. For a site with a database, we include an export of your data in that handover.
Hosting size for busy sites
Sites with a booking form or catalogue run on Busy hosting at RM49 a month. A portal runs on Large at RM79 a month. If you expect heavy bursts, such as a registration day when everyone logs in at once, tell us beforehand so we can size it. If a site outgrows its size we say so, and agree any change in writing; nothing moves up silently. Details are on the hosting page.
Looking for a web developer in Kuala Lumpur or Selangor? We are based in both and work with clients by WhatsApp and email; local details are on our Kuala Lumpur and Selangor pages.