TL;DR
- A steel-building dealer's site was hand-coded PHP, its quote form was the only way leads arrived, and the form was being hammered with spam
- In July 2025 the dealer's marketing partner asked for a staging site to rebuild it in WordPress, keeping the look the same, and wanted it by the weekend so he could start
- We created the staging site within a day. The partner rebuilt the pages as templates; we handled hosting, mail delivery, caching, security hardening, and spam filtering
- Cutover happened at about 2 AM Eastern on August 8, 2025, with everything in place before the first visitor of the business day. Spam filtering was tuned the following Monday
- In December 2025 the dealer had the site redesigned again. We migrated the new build onto the plan at no charge, verified autoscaling and the host's accelerator, noticed the contact forms were sending leads to the WordPress system address instead of the sales inbox, and recovered the submissions that arrived during the transition
One Lead Source, Buried in Spam
The dealer sells steel buildings. Its website exists to produce quote requests, and for years that was enough: a static PHP site, a form, a mailbox. Then the form became a target. Bots filled it faster than staff could read it, and the real requests were getting lost in the noise.
The marketing partner who maintains the dealer's sites wanted to rebuild it in WordPress "to help with some bad spam," keeping the look identical so customers and search engines would not notice, and asked whether we could have a staging site ready by Sunday morning because he had a free day.
What the rebuild had to preserve:
- The design, page for page
- Every lead, including the ones that arrived while the site was in transition
- The dealer's search presence, which meant the same URLs
- Normal business hours, which meant the cutover could not happen during them
Staging in a Day, Cutover at 2 AM
Staging within a day. We created the WordPress staging environment on the dealer's hosting plan and handed the partner credentials. He rebuilt the pages as templates over the following weeks while the live PHP site kept taking leads.
Everything around the site. While the pages were being rebuilt, we set up authenticated mail delivery through Mailgun so form submissions would not relay from the web server, configured caching, applied security hardening, and prepared spam filtering. These are the parts a template rebuild does not include and the parts that decide whether the new site keeps the leads flowing.
The cutover. At about two in the morning Eastern on August 8, 2025, we switched the site over. Mail delivery, caching, and security were live before the first business-hours visitor. CleanTalk spam filtering went on the following Monday once we could see what the form was receiving. The spam stopped.
Redesign number two. In late November the partner wrote that the dealer had the site redone again and asked for a timeline to go live, with no rush. We migrated the new build onto the dealer's existing plan at no charge in early December, verified that autoscaling and the host's NGINX accelerator were active on the new site, and checked the forms. They were routed to the site's WordPress system address, the one meant for security notices and new-user messages, which then forwarded to the dealer. We proposed sending leads directly to the sales inbox instead, and sent the dealer the submissions that had arrived during the transition in case the CRM had missed them.
What the Dealer Has
- A WordPress site that looks like the old site and no longer drowns in spam
- Authenticated mail delivery for every form, with filtering tuned to what the form actually receives
- An overnight cutover with no business-hours disruption and no lost submissions
- A second migration at no charge, with the forms checked and the transition-period leads recovered
- A larger hosting plan, which the dealer upgraded to and paid for the same day the second migration finished
Two rebuilds in five months, and the dealer's phone kept ringing through both.
Frequently Asked Questions
Why convert a static site to WordPress to fix spam? Because a hand-coded form has no ecosystem. On WordPress the form can use authenticated delivery, bot challenges, and a maintained spam filter, and the marketing partner can change pages without a developer. The static site was fine until the form became the problem; then the platform mattered.
How do you cut over a site without losing leads? Keep the old site taking leads until the moment of the switch, cut over outside business hours, have mail delivery tested on the new site before DNS changes, and afterward check the old mailbox and the new one for anything that arrived in between. We did that and sent the dealer what we found.
What should contact forms send from and to? From an authenticated address on the site's own domain, through a transactional mail service or a real mailbox. To the people who act on leads, not the WordPress administrative address. That address is for the system's notices; routing leads through it adds a hop and hides them among security alerts.
Why migrate the second redesign at no charge? Because the dealer was already on a plan that included it, and because a client that redesigns twice in five months is investing in the site. Verifying autoscaling and catching the form routing were the work that mattered; the migration itself was routine.
What is the 2 AM cutover for? Steel-building buyers do not browse at 2 AM Eastern. Switching DNS, cache, and mail delivery then means any surprise is found by us, not by a customer with a quote request.