flowork
Coworking booking and enquiry platform
About
Fixed-price web platform for a Dubai coworking operator running two locations, replacing a WordPress site that measured 49/100 on Lighthouse mobile with a 19.6 second largest contentful paint. I scoped the work, quoted it, wrote the contract, coordinated a three-developer team, and invoiced on delivery.
The interesting part is the enquiry backend. Every submission writes to the database before the email notification fires, so a mail outage costs you a notification but never a lead. Abuse handling is a honeypot field plus per-IP rate limiting, and only a salted hash of the IP is stored. The blog runs on a REST API with an admin dashboard sitting behind Cloudflare Zero Trust rather than a hand-rolled auth layer.
The site itself is generated by a Python build script rather than a CMS, which keeps the output static and the hosting free. Images go through an AVIF conversion and responsive srcset pipeline, and each location has a 360 degree virtual tour.
Key Features
- Enquiry forms writing to Cloudflare D1 before email notification, so no lead is lost to a mail outage
- Honeypot and per-IP rate limiting, storing only a salted IP hash
- Blog CMS with a full REST API (GET, POST, PATCH, DELETE)
- Admin dashboard secured behind Cloudflare Zero Trust
- AVIF conversion, responsive srcset, and lazy loading image pipeline
- 360 degree virtual tours for both locations
Architecture
A Python build script generates the static site, which deploys to Cloudflare Pages. Dynamic behaviour runs on Workers Functions: form posts hit an /api/submit endpoint that writes to a Cloudflare D1 (SQLite) database and then triggers a native Cloudflare Email notification, with per-service routing configurable without a redeploy. A no-JavaScript native POST fallback keeps the form working with scripting disabled. Admin routes carry no auth code of their own and rely on Cloudflare Zero Trust in front of them.