Gruz+

About the website

Removals and delivery in Mozyr, Kalinkavichy and across Belarus. The site shows the fleet, prices and photos of real jobs, so a customer can pick a vehicle before calling.

What I did

• A 5% discount shown when a visitor is about to leave, as one more reason to send an enquiry.
• Quizzes for each service: first an estimated price without asking for contacts, then an offer to refine it by phone.
• Calculator settings carry over into the enquiry form, so the customer does not have to enter them again.
• Illustrations of vehicles with cargo and body dimensions, so it is easy to see which one fits.
• An option to send a photo instead of describing non-standard cargo in detail.

Website CMS

• Popular services update themselves: the system looks at visitor interest over the last 90 days and changes the selection of eight services on the site with no manual editing.
• Demand and seasonality analysis: each service’s trend by month, day of the week and part of the month, compared with the previous period.
• Advertising judged by enquiry outcomes: the manager marks whether the customer bought, declined or is still deciding. The panel compares enquiry quality across sources and campaigns.
• Drop-off analysis before the enquiry: entry and exit pages, pages per visit, form starts, successful submissions and errors.
• Enquiry context is kept: you can see whether the customer came from a quiz, the calculator or a discount offer, which parameters they entered and where they came from.
• Automatic reports and alerts: summaries in Telegram, notifications about falling traffic, form errors and broken links; scheduled publishing of changes.
• The whole site is managed from one panel: services, rates, towns, fleet, photos and reviews, with a preview before publishing.
• Changes and access are protected: separate staff roles, limited login attempts, version history and content recovery.

Security

Before handing the project over to the client, an internal grey-box security audit was carried out.

Result: No critical, high or medium vulnerabilities were found in the final build of the project.

Protection against SQL and command injection

• Test: Automated parameter testing with sqlmap plus manual fuzzing of input forms.
• How it is protected: The source code never builds SQL queries by joining strings. The framework’s built-in ORM escaping is used. The application’s database access is limited to Data Reader/Writer rights, with no access to system tables.

Protection against XSS

• Test: Attempts to inject malicious JS scripts into every user text field.
• How it is protected: A strict template engine with automatic escaping of HTML entities. A strict Content Security Policy (CSP) on the web server blocks any third-party or unsafe inline code.

Component security

• Test: Software composition analysis (SCA) with Snyk and Dependency-Check.
• How it is protected: All packages are pinned to stable versions with no known vulnerabilities in the NVD database. Automatic notifications are set up for security patches to dependencies.

Admin panel isolation

• How it is protected: The admin panel is moved to a separate subdomain, hidden from search engine crawlers and protected from brute force by Fail2ban (the IP is blocked after 5 failed attempts). Signing in to the admin panel requires two-factor authentication (2FA / TOTP).

Resilience to DDoS and load

• Test: Stress testing with k6, simulating a legitimate surge of users and HTTP flood attacks.
• How it is protected: Request limits (limit_req) are set in Nginx and return error 429 when one IP exceeds them. The architecture is ready for seamless integration with external services (for example, Cloudflare / Qrator) to filter L4/L7 traffic.