David Joni

• Logic-only WordPress framework shipped as a private Composer package and required by client themes rather than sitting under them: not a parent theme, not a plugin. The theme's functions.php boots it and declares which modules it wants (consent, SEO, security, comments, assets, blocks, models, theme); the framework owns the mechanism. Two live client sites run on it today, on the same release.
• Built after two sites from a common starting point were measured and found to have diverged 67 to 79 percent. The rule that keeps it from happening again: fix behaviour upstream, cut a release, bump the pin. Never patch around the framework inside a site.
• The version pin is a checked fact, not a declaration. A custom lint reads each site's composer.lock against the framework's latest stable tag, excludes prereleases, fails on a major lag and reports a minor one. Deliberately not Dependabot, because a release existing and a live client site changing are different decisions with different blast radius. The check reports lag; a human decides when a live site moves.
• 146 PHP tests carrying 270 assertions plus 88 JavaScript tests, because a bug in a theme is one site and a bug in the framework is every site at once. Deploys run from GitHub Actions on manual dispatch only, so no push to any branch can reach a server; the post-deploy health check asserts a string that changes every release rather than an HTTP status, which a cached page returns either way.

• Custom WordPress theme built from scratch for a Japanese head spa salon (no page builders, no templates), and the first site on wp-base. Hand-written PHP templates, semantic markup, WebP imagery, a video hero with a poster fallback carrying the first paint, non-critical assets deferred.
• GDPR cookie consent as default deny with a real reject rather than a dismiss button that records acceptance, running Google Consent Mode v2 so tags load in a denied state and update only on an explicit choice. GTM integration and full SEO foundation.
• Closed the standard WordPress author-enumeration surface: REST users endpoints, the ?author= redirect, the oEmbed author name, the RSD link, XML-RPC pingback. Four closed on the first attempt; the fifth kept leaking because the block was hooked at the same priority as core's canonical redirect and core registered first. A partial success is the most convincing false pass available.

• Custom WordPress theme for a single-clinician microsuction ear wax removal clinic, and the second live site on wp-base, consumed by Composer and pinned to the same release as the first.
• Built so the site holds no special-category data at all: no forms, no accounts, no shop. Booking goes out to Fresha, so clinical enquiries never enter wp_postmeta, the backups, or a subject access request answered out of a CMS. Removing the form removes the whole class of problem. The trade is named rather than hidden: funnel analytics now stop at the outbound click.
• Sits behind a LiteSpeed page cache and Cloudflare, which is where two deploy invariants came from. A health check must assert content rather than status, because a cached page returns 200 whether or not the deploy landed. And a full purge does not purge the homepage, which kept serving the previous build on a cache hit, so it is now purged by URL as a separate documented step.

• Solo-built side project, live end to end: bulk domain availability across multiple TLDs from manual input, file upload, or AI-generated business-name suggestions. GDPR-compliant with tiered rate limiting.
• Backend: Laravel 13 + PostgreSQL + Redis on Laravel Octane (FrankenPHP) for low-latency request handling. Filament v5 admin with dashboard widgets (search volume, TLD popularity, top demanded domains).
• Frontend: React 19 + TypeScript + Tailwind CSS v4 + Shadcn/ui via Inertia.js v3. Server-Sent Events stream concurrent domain results with per-row loading, error, and available states.
• Engineering: 4-step verification cascade (DNS, RDAP, WHOIS over raw TCP port 43, paid DomScan API as fallback) cuts paid API spend roughly 90%. AI name generation via Cerebras + Groq (Llama 3.3 70B) with automatic failover.

• Solo-built mobile app shipping to iOS, Android, and web from one codebase: Expo SDK 55 / React Native / TypeScript / Expo Router. Working dev build is feature-complete on core flows.
• Voice pipeline (turn-based REST): chose REST over ElevenLabs' realtime WebRTC/WebSocket SDK after persistent breakages from Expo + package-version updates made the SDK unreliable. Pipeline: expo-audio WAV capture, ElevenLabs STT, Claude Haiku, ElevenLabs TTS, base64 MP3 played back client-side.
• Backend, auth, payments and data residency: Node.js / Hono on Hetzner via Coolify; Clerk JWT integrated into Supabase as a third-party provider with row-level security on every table; Stripe Checkout Sessions and signed webhooks for subscriptions and one-off upgrades. Supabase in eu-west-2 (London) for UK residency, consent before voice capture, on-device audio deleted immediately after upload, and a Varlock + 1Password secrets architecture keeping sensitive keys out of the client bundle by construction.

• Main frontend dev on the production web app for a UKRI / RICS / Google Cloud / NatWest-backed startup turning fragmented property data into real-time geospatial insights.
• Shipped Next.js 14 (App Router) + React 18 + TypeScript + Tailwind features: real-time WebSocket AI chat UI with auto-reconnect and connection-state UX, interactive Mapbox GL globe-projection map with polygon drawing and live area calculation (Turf.js), edge-authenticated Firebase sessions with custom Next.js middleware.
• Honest framing: this is where I onboarded into the modern React / Next ecosystem, bridging from my PHP / agency background into production Next.js work. It was built before I adopted Claude Code; every React / Next / React Native project since has used a Claude Code-assisted workflow (MCP servers, custom hooks, project-aware context).

Remote, UK

• Build and ship custom WordPress themes, plugins, and bespoke product UI across a portfolio of client sites: responsive, accessible, performance-tuned.
• Bespoke WooCommerce setups for client stores, including product configurators that go past what WooCommerce's built-in product types can do: multi-step forms, conditional pricing, live preview.
• Internal tooling that replaces paid third-party services and their usage-based overage charges, built with Claude Code.
• Daily Claude Code workflow (MCP servers, custom hooks, slash commands, OpenGrep, marketplace plugins) for dev, debugging, and content tasks.

Remote, UK

• Responsive WordPress and Statamic builds with interactive Vue.js components, pixel-perfect implementation from designer briefs, working directly with non-technical stakeholders.
• Reusable component patterns built once and reused across client engagements: forms, modals, filters, data-driven sections, animation primitives.

Darlington, UK

• Cross-browser WordPress and WooCommerce builds with custom plugins and bespoke functionality. E-commerce and brochure projects shipped under real deadlines.
• Owned Google Workspace, Microsoft Exchange, and cPanel/Plesk admin alongside development, plus front-line client support on hosting, mailbox setup, and account access.

Newton Aycliffe, UK

• Custom WordPress sites in PHP, JavaScript, jQuery and CSS for small and medium businesses, each handled from the first client conversation through to launch.

Coventry, UK

• End-to-end WordPress site builds in PHP, JavaScript, jQuery, CSS: design (Photoshop) through implementation and ongoing maintenance. Delivered user-friendly admin dashboards so non-technical clients could self-serve.