Burr Media
PR, Publicity & Crisis Management · London
A 2016 website with broken HTTPS, rebuilt for a consultant whose work depends on discretion.
A respected consultancy with a website that undermined it.
Anthony Burr is a London PR consultant working in publicity, media and crisis management, with a background as a journalist at national newspapers and broadcasters. The reputation was there. The website was not helping.
The old site was built in 2016 and had been quietly decaying ever since. It ran on PHP 7.4, which reached end of life in November 2022. Its SSL certificate had expired, and HTTPS was not merely misconfigured but entirely broken — there was no TLS handshake at all, so every modern browser marked the site “Not secure”. For a consultant whose clients approach him about sensitive matters, that is not a cosmetic problem.
The page weighed 4.5MB, of which 3.5MB was assets nothing on the site actually referenced. And the contact form did not work: it posted to # and used JavaScript to display a success message to anyone who filled it in. Enquiries were being lost silently.
Keep the brand. Rebuild everything underneath it.
The existing brand was strong — near-black, off-white and a decisive red — so we kept the palette and rebuilt around it rather than imposing something new. The original vector logo files had been lost from the client’s current setup; we recovered them from the old server, cleaned the artwork and reinstated it properly across the site and favicons.
The structure was reduced to a single, well-paced page: hero, trust strip, about, services, track record, testimonials, contact. No page-loads between a visitor arriving and understanding what he does.
Six pieces of work behind one page.
Single-page website
Eight sections, hand-coded, mobile-first, with scroll reveals and an animated statistic counter. No jQuery, no page builder.
Confidential enquiry form
A self-hosted endpoint rather than a third-party relay, with server-side spam defences. See below for why that mattered here.
Working HTTPS
New hosting, a valid certificate, HTTP to HTTPS redirect and www to apex. The “Not secure” warning is gone.
Brand recovery
Original logo vectors recovered from the old server, cleaned and normalised, with favicons regenerated from the brand mark.
Privacy policy
UK GDPR compliant, and truthful: no cookies, no analytics, no third-party requests, self-hosted fonts. Every claim verified against the build.
Accessibility pass
Contrast raised to meet AA on small red text, heading order corrected, and a WhatsApp contact button added at the client’s request.
Crisis PR enquiries do not belong on someone else’s server.
The obvious way to put a working form on a static site is a free third-party relay. We did not do that here. Someone contacting a crisis management consultant may be disclosing something genuinely sensitive before they have spoken to anyone, and routing that through an external service means the message passes through infrastructure neither we nor the client controls.
So we built the endpoint ourselves. Submissions are written to a database before mail is attempted, so an enquiry cannot vanish if delivery fails, and a nightly check flags anything accepted but unsent. Spam defences run server-side: a single-use signed token, a minimum fill time, rate limiting that counts every attempt, and a honeypot that returns a convincing success response so bots never learn they were caught.
That last part carries a lesson we now apply everywhere. An early version of the honeypot was named company — a field name browsers autofill. Real people using autofill were being silently rejected. We found it, renamed it, and re-tested end to end. Honeypot fields must never look like something a browser wants to fill in.
Lighter, faster, secure, and finally trustworthy at a glance.
HTTPS works. The form delivers, and every submission is recorded whether or not mail succeeds. There are no cookies, no analytics and no external calls, so the privacy policy says nothing the build cannot back up. And the site now loads in a fraction of the time on a phone, which is where most first impressions of a consultant are formed.
Got a site that is quietly working against you?
Broken certificates, forms that swallow enquiries, pages that take four seconds on mobile. We fix all of it, for a fixed price agreed before we start.