Rebuilding a Law Firm Website: From 10-Second Load Times to Under 2 Seconds

Gorayeb & Associates is a personal injury law firm based in Manhattan. At the time, they were spending roughly $25,000 a month on Google Ads — sending traffic to a site that took over 10 seconds to load. That's an expensive combination. Slow landing pages drag down Google Ads Quality Scores, which raises cost-per-click. And every second of load time costs conversions. I was brought on as the in-house technician, and alongside general IT work (including building out a full staff monitoring platform), I was asked to figure out why the site was so slow — and whether I could fix it. That question turned into a full rebuild.

The Before State

The Rebuild Plan

The shared hosting environment was the root problem — I had no control over server resources, neighboring sites, or configuration. I found that Ionos offered self-managed virtual machines at a reasonable price point, and that gave me root access and full control over the stack. I started by practicing on a fresh VM: getting Apache installed, learning how to write an apache2.conf, and serving a basic HTML page. Once I had that down, I planned the migration. The rebuild was PHP/HTML/JS — no heavy CMS — to keep the footprint lean and eliminate plugin overhead. The cutover was planned after hours to minimize any downtime impact on the firm's contact forms and active ad campaigns.

Cloudflare Setup

Moving the DNS to Cloudflare was one of the highest-leverage changes. With the site sitting behind Cloudflare's proxy, I could configure caching rules for static assets, enable image compression via Polish (WebP conversion + lossy compression), and use Rocket Loader to defer non-critical JavaScript — all without touching the origin server. I also set up a free SSL certificate through Cloudflare, which meant the site finally had HTTPS. On the email side, the firm was sending client communications from their domain with zero authentication — a spoofing liability. I set up SPF, DKIM signing through their mail provider, and a DMARC policy, starting in monitoring mode (p=none) before moving to enforcement (p=reject) once I confirmed legitimate sending sources were properly covered.

Performance Results

Conversion-Focused Landing Pages

With a $25K/month Google Ads budget spread across personal injury practice areas — car accidents, slip and fall, medical malpractice, construction accidents — generic pages weren't enough. Each campaign needed a dedicated landing page that matched the ad's intent closely enough to earn a high Quality Score. I learned the fundamentals of conversion rate optimization: clear above-the-fold CTAs, trust signals (attorney credentials, case results, client testimonials), fast forms with minimal fields, and click-to-call prominently placed for mobile users. The lead attorney eventually paid for me to take formal in-class web development courses, which helped me build these pages with cleaner, more maintainable code than my earlier attempts.

SEO Improvements

Alongside the performance work, I tackled on-page SEO: proper meta titles and descriptions per page, heading hierarchy, and structured data (LocalBusiness and Attorney schema) to give Google richer signals about the firm. I set up Google Analytics and Google Search Console to track organic traffic, monitor crawl issues, and measure the impact of changes over time. The combination of faster load times (which directly affects Core Web Vitals ranking signals) and better on-page structure led to measurable ranking improvements for the firm's target practice-area keywords in the New York market.

Lessons Learned

• Self-managed VM vs. shared hosting: The performance difference was immediate and dramatic. Shared hosting means you're at the mercy of your neighbors' traffic spikes. A dedicated VM costs more but gives you predictable resources and full configuration control — worth it for any business running paid traffic.
• Cloudflare as a performance layer: You can get significant gains without touching the origin at all. CDN edge caching, image optimization, and JS deferral are all Cloudflare-side — the server doesn't change. It's the fastest path to meaningful load time improvements on an existing site.
• Email security is a liability issue for law firms: A law firm with no DMARC is trivially spoofable. Clients receive emails from attorneys containing sensitive case information — a spoofed domain is a serious trust and legal exposure risk. Rolling out DMARC in monitoring mode first (p=none → p=quarantine → p=reject) let me confirm all legitimate sending sources before enforcing, without risking lost mail.
• This is how I got into development: What started as an IT support question — 'why is this website so slow?' — turned into months of self-taught work across Linux server admin, Apache configuration, CDN setup, and eventually full-stack web development. The lead attorney recognized what I was building and funded formal coursework. There's no obvious entry point from IT support into dev work; there's just a problem you care about enough to follow all the way down.