ozjuliana.sk: a website for a small non-profit, no WordPress

The problem

Občianske združenie Juliána is a small Slovak non-profit. All year round it collects clothes, shoes, toys and household goods and delivers them to people in need and to community centres. The website has to tell people where and when they can drop off donations, and people at the non-profit post news about collections themselves, mostly from their phones.

I’ve been building the site as a volunteer since April 2026. Before the redesign it went through an accessibility, typography and admin audit; the redesign had one rule: whatever wasn’t meant to change mustn’t move by a single pixel.

What the non-profit gets

People at the non-profit add news with photos from their phones, no technician needed. There’s nothing to update every month, and the site runs on cheap shared hosting for a few euros a month, with no other fees. Visits are only measured if the visitor agrees, and the content backs itself up every evening.

Constraints

• Budget. Cheap shared hosting that runs PHP and nothing else – no command line (SSH), no Git – and no paid add-ons or external services.
• No WordPress. On hosting like this it would mean constant core and plugin updates, a database and endless login attempts. The non-profit adds an article with photos every few weeks.
• The audience reads on phones. The site is designed from the smallest screens up, starting at 320 px.
• No dependency on me. The site runs on the non-profit’s hosting and needs none of my servers or machines.

Decisions

1. Files, not a database. Custom PHP with no framework; each article is a single JSON file, and photos are resized on upload with the GD library. All the content backs up by copying two folders, and in an emergency an article can be fixed in a plain text editor.
2. A password plus a code from the phone. The admin requires two-factor authentication (2FA): a password and a six-digit code from Google Authenticator. The site computes the codes itself, with no third-party library – on hosting like this that’s simpler than uploading a library and its dependencies – and they are tested against the official test values.
3. Visitor privacy. Fonts come from the site’s own server, public pages set no cookies, and Google Analytics loads only after consent in a banner that follows Slovak Act No. 452/2021. Consent is recorded without the IP address. The only thing that loads from Google straight away is the map on the contact page.
4. Security without plugins. The browser gets strict rules: it loads only sources from an approved list and always opens the site over encrypted HTTPS. The contact form has a hidden field that catches bots and a rate limit. Right after launch the live site went through a two-round security audit: 38 findings, no way into the admin without logging in, and the code fixes shipped the same day.
5. A redesign that was measured, not eyeballed. The refactor before the redesign wasn’t allowed to change a single byte of HTML or a single pixel across 450 screenshots (15 pages × 10 widths × 3 modes). For the redesign itself, every intended change was written down up front and everything else had to stay identical.

Outcome

What	Value
Accessibility	0 axe findings against WCAG 2, levels A and AA, on all 10 pages (30 runs)
Phones and monitors	nothing overflows anywhere from 320 to 1440 px
Type and contrast	12 font sizes (pre-redesign audit: 29), form borders above 3:1 contrast
Content	people at the non-profit publish an article with a gallery from their phones
Backups	every evening, automatic, 30 daily snapshots
Running costs	shared hosting only, no paid services

What I do differently today

Today every visual change is measured first: the contrast of every colour pair, screenshots at ten widths from 320 px and a comparison with the previous version. After every deployment, a script also reads the live site and checks it. That’s how it caught a “set up DNS” button in the hosting admin that had quietly pointed the domain straight at the server, bypassing the CDN (the network that delivers and protects the site).

Technology and process

PHP 8.5 (8.4 minimum), HTML, CSS and three small plain JavaScript files with no libraries; Apache with .htaccess; shared hosting behind a CDN. Checks: Playwright, axe-core, html-validate and stylelint. Deployment by an FTPS script with a dry run, followed by a read-only check of the live site.

Two-factor login: TOTP per RFC 6238 in plain PHP, tested against the RFC’s test values. Content Security Policy (CSP) headers with no inline scripts and HSTS; a honeypot and a rate limit on the form.

Every change passed the tests and my review before it was merged.

The longer story of why the site runs without WordPress and how the redesign was verified is in the note How the OZ Juliána website was built.