Thornbury

Websites worth a second look.

Websites built for clarity, speed, and craft.

Some of what we're building isn't listed yet — on purpose.

01 / 04

Scroll

(The premise)

Most agency sites are slow, generic or beautiful. Rarely more than one.

How it's built

The parts you can't see.
01 / 03
01

Security headers, dependency and secret scanning, and a written review pass before anything ships. No unreviewed generated code reaches production — the guardrails are documented, not improvised.

Headers, dependencies and secrets — checked before every deploy.

02

Every effect is built to be switched off. Compressed media, nothing blocking the first paint, and a page that stays completely usable if the video, the motion or the JavaScript never arrives.

Switch JavaScript off. The page still works.

03

On delivery you get all of it — the repository, the hosting account, the domain and the mailbox. You own the site outright and can walk away with it whenever you like.

Repo, hosting, domain and mailbox — all transferred to you.

Check it yourself

The parts you can.

Run the audit on your own site

Send a link and you get back a real report — what is slow, what is exposed, and what to fix first. No call, no pitch attached.

Send a link

Open any piece of the work

Nothing above is a screenshot or a mockup. Every one is a deployed, multi-page site — click into it, browse it, load it on your phone.

Open the collection

Tools & platforms we use

The systems behind your site.

Every site we build runs on established, professionally maintained platforms — the same infrastructure serious software is delivered on, chosen so your site stays fast, reachable and safe to run for years.

Your site

Everything below holds it up

Vercel

Hosting & delivery

Your site is published and served from fast, global infrastructure.

Every visitor touches this

Supabase

Data & accounts

Managed database and login infrastructure, for projects that need it.

Only if your site stores things

Resend

Email delivery

Enquiries and automated messages actually reach your inbox.

Runs when someone gets in touch

OWASP ZAP

Security testing

Automated checks for common web vulnerabilities before you go live.

Before launch, and after changes

SonarCloud

Code analysis

Ongoing review of the code for reliability and maintainability issues.

Deepest — you never see it

Platforms we build on — not partners, sponsors or endorsements.

(Get in touch)

Tell us what you're building.