Dorado Rock
From a JavaScript-only shell to a server-rendered platform
A North Carolina spirit broker’s site, rebuilt from a client-rendered page with no security headers into a fast, server-rendered platform.
Before · March 2025, Wayback Machine capture · After · Live site, September 2026
| Metric | Before | After |
|---|---|---|
| Security headers | 0 of 5 | 5 of 5 |
| Mobile performance | n/a | 98 |
| Mobile accessibility | n/a | 96 |
| Mobile SEO | n/a | 100 |
Dorado Rock is our own platform: a licensed North Carolina spirit broker that represents craft producers and places their bottles with ABC stores, bars, restaurants, and retailers. We show it here as in-house work, not as a client result.
Starting point
The March 2025 capture in the Internet Archive shows a single-page React app served by Apache. The HTML that browsers and search engines received was an empty shell: a page title, a one-line description, and a notice reading “You need to enable JavaScript to run this app.” Everything a visitor saw was drawn by JavaScript after the page loaded.
The archived response headers include none of the five security headers we check: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
What we changed
We rebuilt the site on Next.js with server-rendered pages, so content arrives in the HTML instead of waiting for a script. The new site covers the full business: the spirits catalog, brand pages, single-barrel programs, services, and a blog. It is hosted on Netlify with all five security headers set, and it has been maintained continuously since the first commit in April 2025.
Outcome
- Security headers: none of five in March 2025, all five on the live site today.
- Lighthouse (mobile), live site: performance 98, accessibility 96, best practices 100, SEO 100.
How we measured
Security headers for “before” come from the original response headers recorded with the Wayback Machine capture of 28 March 2025. The “after” headers come from the live site. Lighthouse scores are the median of three mobile runs of Lighthouse 12.6 against the live site on 26 September 2026. We do not show a Lighthouse “before” because an archived copy cannot be measured fairly against a live site.