All projects
Case Study

Auralyx

A luxury skin, hair and longevity clinic website: 20 pages, a headless WordPress blog, secure enquiry forms and a polished, animation-rich experience on Next.js 16.

Role
Full-stack developer
Type
Client website
Scale
20 pages · 4 API routes · 7 concern pages
Stack
Next.js 16 · React 19 · TypeScript · Tailwind CSS 4 · PostgreSQL · Headless WordPress
20Page routes
7Skin concern pages
16Legacy URL redirects
6Security headers
Auralyx website homepage preview

Overview

Auralyx is the website for Waldor Clinic, a premium aesthetic clinic offering facials, injectables, body contouring and hair restoration. The website is the clinic's front door: it presents treatments and skin concerns in a calm, high-end style, publishes expert articles, introduces the doctors, shows before-and-after results and turns visitors into consultation enquiries. I built it end to end, from the page architecture and animations to the database, email delivery and security.

The challenge

A luxury brand cannot look or feel generic, yet the site also has to be fast, easy for the clinic team to keep fresh, found on Google and safe to put forms on. The clinic already had an older website, so the new one also had to keep every old link working. The goal was one codebase that is beautiful, content-managed and production-hardened.

How it works

  1. 1

    Discover

    Visitors land on a home page that introduces the clinic, its signature treatments, doctors and success stories.

  2. 2

    Explore

    They browse treatments or pick a skin concern and see a tailored page with approach, benefits, safety and FAQs.

  3. 3

    Trust

    Before-and-after sliders, patient stories, doctor profiles and a blog build confidence.

  4. 4

    Enquire

    A validated contact form captures the treatments they want and their message.

  5. 5

    Deliver

    The enquiry is saved to PostgreSQL first, then emailed to the clinic team.

  6. 6

    Follow up

    Every submission has a status, so a failed email is never a lost lead.

Site map

Home

Hero, about, signature treatments, how it works, doctors, transformations, stories, blog.

Treatments (5)

HydraGlass, Waldor Signature, Body Treatment, Injectables and Hair Growth.

Concerns (7)

Acne, scarring, dull skin, loose skin, premature aging, uneven tone and wrinkles.

Blog

WordPress-powered listing with category filters and article pages.

Doctors and About

Clinic story, values, team and credentials.

Products

A shop showcase with a product grid and brand logo slider.

FAQs

Filterable by treatments, concerns and clinic.

Contact and Careers

Validated forms with email delivery and a Google Map.

What I built

  • A component-driven architecture of 430+ typed TSX files, grouped by page and section, each with its own data and types files
  • Seven skin-concern pages built from a shared section system: service hero, signature treatments, step-by-step approach timeline, benefits, patient safety, doctor, before-and-after slider, success stories and FAQ
  • Smooth, premium motion with GSAP, Framer Motion and Lenis smooth scrolling, with reveal-on-scroll cards through a custom hook
  • Interactive before-and-after comparison sliders and Swiper carousels for results and stories
  • A headless WordPress blog through the WPAPI client, with category routes, related posts and sanitized HTML
  • Contact and careers forms using React Hook Form and Zod, with toast feedback through Sonner
  • Optimized typography with Fraunces and Hanken Grotesk through next/font, plus shared constants for colors and theme

Security and reliability

  • A strict Content Security Policy that only allows the origins the site really uses: Google Maps, analytics and video embeds.
  • Six security headers on every response, including HSTS, nosniff, frame protection, a referrer policy and a locked-down permissions policy.
  • Form spam guard: origin and referer check, a hidden honeypot field that gets a fake success, and a limit of 5 requests per 10 minutes per IP.
  • Validation with Zod on the server for every submission, and HTML escaping on everything placed in the notification email.
  • Blog HTML from WordPress is sanitized before rendering, and images are only optimized from the clinic's own WordPress and Gravatar hosts.
  • Submissions are saved to PostgreSQL before the email is sent. If the email fails, the record is marked email_failed instead of being lost.
  • A startup check logs any missing environment variable at once, so a bad deploy is spotted immediately.
  • Staging and preview hosts automatically send a noindex header, so only the real domain is indexed.

Problems I solved

Keeping every old link alive

Problem. The clinic already had a website, and moving URLs would break bookmarks and Google rankings.

Solution. 16 permanent redirects map the old pages (menu, appointments, home variants) to the new treatment and contact pages.

Clean blog URLs from WordPress

Problem. WordPress categories needed to appear as friendly paths on the site.

Solution. Rewrites map each category prefix to the blog listing and each post to the article page, while the URL stays as typed.

A slow or unreachable CMS

Problem. A blog that depends on an external API must not break the page.

Solution. Requests are retried and cached for a minute with Next.js revalidation, so most page loads never hit WordPress.

Lost leads

Problem. Email servers fail, and a failed email means a lost enquiry.

Solution. The database save comes first and each record carries a status, so the team can always find and follow up.

Beautiful but fast

Problem. Heavy video, images and animation can ruin performance.

Solution. Assets are cached for 30 days, optimized images for 30 days, and an optional CDN origin is supported for large media.

Bots on public forms

Problem. Open forms attract spam and abuse.

Solution. Layered defenses: origin check, honeypot and rate limiting, with a note that Cloudflare can sit in front for more.

Architecture

Framework

Next.js 16 App Router with React 19 and TypeScript, using route groups for the website.

Styling

Tailwind CSS 4 with class-variance-authority, clsx and tailwind-merge for variants.

Animation

GSAP, Framer Motion and Lenis, plus Swiper and a compare-slider for results.

Content

Headless WordPress through WPAPI for the blog, with sanitize-html on the output.

Data

PostgreSQL with a Prisma schema for contact and careers submissions, indexed by email and date.

Email

Nodemailer over SMTP with pooled connections and escaped HTML templates.

SEO

Dynamic sitemap, robots, canonical URLs, metadata, and an llms.txt file for AI search tools.

Quality

ESLint, strict TypeScript, Zod schemas shared by client and server.

MethodEndpoints
GET/api/blog · /api/blog/[slug]
POST/api/contact
POST/api/careers

Outcome

The site is live at waldor.vercel.app. It gives the clinic a refined, fast and secure online presence where treatments are easy to explore, content can be updated without a developer, and every enquiry is stored and delivered. The project let me own a production client site from design implementation through database, email, SEO and security.

What I learned

  • Design systems of small, typed sections scale across many similar pages
  • Saving data before side effects such as email prevents lost leads
  • Redirects and metadata are part of the product, not an afterthought
  • Security headers, validation and rate limiting belong in the first release

What is next

  • Move rate limiting to a shared store such as Redis or Cloudflare
  • Add online booking and a patient portal