THIS SITE IS THE CASE STUDY

Anyone evaluating a technical studio opens PageSpeed on its own domain before reading a single portfolio page. Rightly so. This page documents how nadiamaar.dev is built — the decisions, the constraints and the numbers — because every claim here can be checked: in the source, with a curl, or against measurements taken right now on your own device.

A visitor and a crawler do not see the same HTML

The site is a client-rendered application served as static files from a CDN. Metadata, however, is written by JavaScript — and Bingbot, GPTBot or a WhatsApp preview never execute it. They get a dedicated path.

Person

• The browser receives the static shell from the CDN — no server function in the path.
• Critical CSS and the boot screen are already in the HTML: the first frame is dark, not white.
• React mounts the application; every route beyond the home page is a chunk downloaded only when visited.

Crawler

• The user-agent is recognised at the edge and the request routed to a prerender function.
• The function reads the route's title, description, hreflang and JSON-LD from the database.
• The crawler receives HTML with the metadata already inside — the same metadata the admin panel governs without a deploy.

Seven choices you can see in the numbers

None of them is exotic. What makes the difference is that they are written down, measured, and defended by tests that fail when someone dismantles them by accident.

Fonts served by us, with a test standing guard

Five families as variable woff2 on this domain, latin and extended subsets, the two above-the-fold ones preloaded. A build test fails if a single request leaves for Google Fonts: an @import is one line, and it slips back in easily during a refactor.

Bilingual, with completeness enforced by the compiler

Every text lives in an Italian+English dictionary whose shape is constrained by the type system: a half-translated key is not a warning, it is a build that refuses to start. The language is an address prefix, hreflang links are reciprocal, and the sitemap declares them in full.

SEO governed by the database, not by deploys

Titles, descriptions and structured data live in Postgres and are edited from the panel. The prerender serves them to crawlers, the sitemap updates itself, and publishing a new language for a page is one database row — no recompilation.

Cookieless analytics, IP never stored in the clear

No banner because there is nothing to confess: the session is an ephemeral identifier in sessionStorage, the IP address becomes a salted fingerprint before touching the database, and funnel events travel via sendBeacon without blocking navigation.

Security at row level, not interface level

The client area is isolated with Postgres Row-Level Security: the data filter holds for any client, not just for the interface that remembers to apply it. Public forms insert with the anonymous key inside CHECK constraints, and aggregate reads go through security-definer functions.

One canonical address

The platform alias and the apex domain answer 308 towards www.nadiamaar.dev. A site reachable at two addresses is two sites competing against each other in the index — and a permanent redirect is the only unambiguous way to tell Google.

A written performance budget, with uncomfortable thresholds

LCP under 1.8 s on mobile, less than 320 kB of JavaScript on first load, zero third-party requests in the critical path. The budget lives in the repository next to the code: when a change breaks it, the problem belongs to the change.

Verify it yourself

Four checks anyone can run in a minute, without believing a word of this page.

• What a crawler receives: curl -A "GPTBot" https://www.nadiamaar.dev/ | grep description
• The security headers: curl -sI https://www.nadiamaar.dev/ | grep -iE "strict-transport|content-type-op"
• Google's own measurement: pagespeed.web.dev → www.nadiamaar.dev
• The index for AI assistants: www.nadiamaar.dev/llms.txt

Nadia Maar