Application development
PHP and Laravel, Node.js, Python and React: new builds, and the less glamorous work of making an existing codebase safe to change again.
Web & Application Development
Servers, Hosting & DevOps
AI & Automation
Performance, Security & Care
Hey, I'm Irfan
I build web applications and look after the infrastructure underneath them. The same person for the code and the server it runs on.
What I do
Most problems with a website sit on the boundary between the application and the machine it runs on. A page is slow: is that the query, the PHP configuration, or the disk? Email stopped arriving: is that the code, the DNS, or the server's reputation? When those are two separate people, that boundary is where things stall.
I work on both sides of it. That means fewer handovers, and it usually means the actual cause gets found rather than worked around.
PHP and Laravel, Node.js, Python and React: new builds, and the less glamorous work of making an existing codebase safe to change again.
Linux administration, nginx and Apache, cPanel and WHM, migrations, backups and the monitoring that means you hear about a problem before your customers do.
Language models applied to real workflows, with evaluation, cost control, scoped permissions and a human in the loop where it matters.
Core Web Vitals, technical SEO, malware recovery and ongoing maintenance. The work that keeps a site fast, findable and online.
Services
Grouped by what they solve rather than by technology. Each page says what is included, how I work and what it will not fix.
Custom PHP applications, plus rescue work on legacy codebases that still run the business.
Laravel applications built the boring way, queues, tests, migrations and a deploy that works.
Node services, APIs and real-time features, plus the process management that keeps them up.
FastAPI and Django services, data pipelines, and the automation scripts that quietly save hours.
Accessible, fast React interfaces, and the plain HTML and CSS underneath that make them work.
Custom themes and plugins, and rescuing sites buried under thirty conflicting plugins.
APIs other developers can actually use, documented, versioned, and predictable when things fail.
Setting up, tuning and looking after Ubuntu, Debian, AlmaLinux and CentOS servers.
Account setup, resource limits, email deliverability and the WHM settings that matter.
Moving hosts without the downtime, the broken email, or the week of mysterious 404s.
Reducing the attack surface, then making sure you would actually notice a breach.
Deployments that are boring: automated, reversible, and identical every time.
Choosing the right size box on the right provider, and configuring it so it stays affordable.
DNS records that resolve, and business email that reaches the inbox instead of the spam folder.
Applied AI features inside real products, with evaluation, cost control and a fallback path.
Automating multi-step work with tool-using agents, with limits, logging and a human in the loop.
Wiring language models into an existing product without destabilising it.
Support and sales assistants grounded in your own content, that hand over cleanly when stuck.
Finding the real bottleneck rather than installing another caching plugin.
The engineering side of search: crawlability, indexing, structured data and site architecture.
Cleaning a hacked site, closing the way in, and getting the warnings lifted.
Ongoing updates, backups, monitoring and a person to call, for sites that need to stay up.
Approach
Four things that hold whether the job is a one-day fix or a six-month build.
I read the code and look at the server before giving a number. An estimate made without that is a guess, and guesses are how projects end up costing double.
If a request is the wrong solution, or a cheaper option exists, you will hear it. That occasionally costs me work, and it is still the right way round.
Small releases rather than a big reveal. Problems are easier to trace and cheaper to reverse when the change was small.
Setup steps, environment variables, cron entries and known quirks written down. You should never be locked into working with me by a lack of information.
Writing
Things that came up often enough to be worth writing down properly.
Queues are the part of a Laravel app most likely to be silently broken in production, because when they fail, nothing visibly breaks.
The gap between an agent demo and something you can put in front of your business is not model quality. It is the constraints around the loop.
React does not prevent a site from ranking. Shipping an empty div and hoping the crawler renders it does. The fix is straightforward and largely a build-time concern.