Whitehead Wellness

Everything Kate needs to run it herself

Built in Django with PostgreSQL, Celery and Redis, covered by 336 automated tests.

• Four membership levels billed through Stripe, with grandfathered pricing, capacity limits and a waitlist. Downgrades and cancellations take effect at the end of the billing period and can be undone until then.
• A verification queue where Kate reviews each member’s evidence, approves it or asks for changes, and every earned crest creates a task to mail a physical card.
• Daily ritual streaks counted at each member’s own midnight, with grace days applied automatically.
• A community with ten channels, reactions, reporting, and one moderation queue for posts and comments.
• Private coaching messages for the top level, with a daily digest to Kate only on days she has unread messages.
• An admin panel with roles, permissions and an audit log, and email wording Kate edits herself.

Instant to the touch

• Hand-written CSS and plain JavaScript: 15 small script files totalling about 45 KB, all deferred. No front-end framework.
• Total blocking time measures 0 ms on a throttled phone, so taps respond immediately.
• Artwork is converted to WebP and capped at 512 px.
• Static files are fingerprinted and pre-compressed so browsers can cache them long-term.

Designed at phone width first

• The stylesheets are written mobile-first: 40 breakpoints that add layout as the screen grows, against 4 that take it away.
• Separate mobile menus for the public site and the member area, announced to screen readers, closed with Escape.
• Layout shift while loading measures 0.03, well inside Google’s 0.1 “good” line.
• Every page has a matching phone-width screenshot checked during development.

Public pages found, private pages hidden

Lighthouse scores the homepage 100 for SEO on mobile.

• Titles and descriptions Kate can set per page, with sensible fallbacks so no page ever ships without one.
• Structured data: Organization site-wide, Person on Meet Kate, FAQPage on the Awakening quiz, and breadcrumbs on every Guardian page.
• A sitemap that lists members-first articles only once they are public, so paid early access never leaks into search.
• Member areas, the admin and login pages send a header telling search engines not to index them.

Members’ data treated as private by default

• HTTPS with HSTS for a year, including subdomains and preload, plus secure cookies and anti-framing headers.
• Two-factor login required for every admin account, by authenticator app or a single-use emailed link tied to the browser that asked for it.
• Card details go straight to Stripe; payment webhooks are verified by signature and processed exactly once.
• Evidence photos are stored privately and shown only to the member who sent them or an authorized admin. Anyone else gets a “not found”.

Calm, readable, and usable with a keyboard

• A skip-to-content link and visible focus outlines throughout.
• Motion switches off for visitors who ask their device to reduce it.
• Text contrast is measured (navy on ivory at 11.7:1), and the gold accent is never used for text.
• Decorative dragon art is hidden from screen readers.