I build, secure and look after the backend behind your website: Drupal and Symfony platforms, PHP applications, APIs, integrations and the AWS infrastructure they run on. I work with organisations of every size, from charities and SMBs to large corporate teams. You deal directly with the senior engineer writing your code, at one day rate, with no account managers in between.
# Monday morning, every client site $ drush pm:security [success] There are no outstanding security updates. $ composer audit No security vulnerability advisories found. $ drush core:status --field=drupal-version 11.2.4 $
Specialist Drupal and PHP agencies do good work, and much of what they charge pays for sales teams, account managers and offices. Hire a senior backend contractor and the whole budget goes into your platform.
No overhead built into the rate.
Hover or tap to flip ↻An agency day rate covers project managers, account directors, sales and office costs. My rate covers the time spent on your site, and you see exactly what was done with it.
↻ BackYou talk to the person building it.
Hover or tap to flip ↻Requirements don't pass through an account manager, a PM and a ticket queue before reaching a developer. Ask a question on Slack or email and the engineer answers it.
↻ BackEvery hour is a senior hour.
Hover or tap to flip ↻With an agency, the senior who wins the pitch is rarely the one doing the work. Here the person who scopes the project is the one who builds, tests and deploys it.
↻ BackEngage by the day, project or month.
Hover or tap to flip ↻No 12-month retainer or minimum team size. Book a few days for an urgent fix, a fixed-scope project, or a small monthly plan for upkeep. Your code and hosting stay in your accounts.
↻ Back| Typical agency | Working with me | |
|---|---|---|
| Who you talk to | Account manager, then project manager | The engineer doing the work |
| Who writes the code | A mixed team, often junior or offshore | A senior with 10+ years of development |
| What the rate pays for | Delivery plus sales, management and premises | Delivery |
| Commitment | Retainers and minimum terms | By the day, by the project, or monthly |
| Knowledge of your site | Spread across a rotating team, often in people's heads | One person who knows it, and everything written down where you can see it |
| Documentation & handover | Often an extra cost at the end of the project | Included as I go: every change recorded in your tickets, your repository and a shared document, ready to hand to anyone |
The backend services the specialist Drupal and PHP agencies offer, delivered by one senior engineer. Most clients combine two or three, for example an upgrade that rolls into ongoing maintenance.
Drupal modules and Symfony components written around your business rules, with tests and documentation, so the next developer can pick them up.
Some projects spend most of the budget on discovery, personas and design, and the build is left half done or handed over in a state nobody wants to launch. I audit what was delivered, tell you plainly what can be kept, and finish it.
Your site kept patched, monitored and backed up. Drupal security advisories are reviewed as they are published, and critical ones are applied first.
Audits and fixes for the rules your website has to meet, with the evidence written up so you can show it to auditors, trustees or procurement.
Hosting set up, deployed and watched, on AWS or Pantheon, in accounts you own. Automated deployments mean releases happen in minutes and can be rolled back.
Keeping Drupal and Symfony applications on supported versions, and moving legacy PHP onto a modern stack, with content intact and a release plan that can be rolled back.
Multi-site and multilingual corporate and B2B websites that marketing teams can run themselves, with editorial workflows that keep content consistent across brands and regions.
Let visitors and staff ask questions in plain English and get answers based on your own content, documents and policies, with links back to the source pages. It works with a Drupal site, a Symfony application or a custom PHP platform.
Code written with Copilot, Cursor, Claude or ChatGPT often works in the demo and fails in production. I review it the way I would review any pull request, before it reaches your live site.
I work with any organisation running Drupal or PHP, whatever its size. Over the past decade that has meant large programmes for well-known UK brands across these sectors.
UK manufacturer websites with model ranges, dealer networks and enquiry journeys under heavy campaign traffic.
Regulated, multi-jurisdiction corporate sites where compliance and content governance come first.
Public health programmes with strict accessibility, security and data-protection requirements.
High-traffic retail platforms, integrations with booking and commerce systems, and performance at scale.
Sites for education providers with course information, multiple departments and content for students, staff and applicants.
Law firm websites with people directories, practice areas and insights, where accuracy and confidentiality matter.
Group websites for technology and services businesses, often multi-brand and multilingual.
Organisations that need the same standards without an agency budget or a permanent in-house team.
The first conversation is free and comes with no obligation.
30 minutes on your site, your goals and anything urgent. I may ask for read-only access to take a look first.
A clear scope with either a fixed price or a day-rate estimate, within a few working days.
You get direct access to me and regular updates. Code stays in your repository, and decisions and how-tos are written up in your tickets and a shared document, so anyone can pick the work up later.
Paulo Lopes Web Consulting Ltd is the data controller for personal data you send through this website or by email. I use your name, email address and message only to reply to your enquiry and, if we work together, to manage our contract.
The lawful basis is legitimate interests for enquiries and contract for clients. Enquiry data is kept for up to 12 months; client records are kept for 6 years to meet UK accounting rules. Data is not sold or shared for marketing.
Under UK GDPR you can ask for a copy of your data, its correction or deletion, or object to its use, by emailing the address above. You can also complain to the Information Commissioner's Office at ico.org.uk.
This website aims to meet WCAG 2.2 level AA. It can be navigated by keyboard, respects reduced-motion settings and uses sufficient colour contrast. If you find something that is hard to use, email me and I will fix it.
Content on this site is for general information and does not form an offer. Services are provided under a written agreement for each engagement. The site is governed by the law of England and Wales.