Skip to content

The unfortunately-extensive catalogue

Get F-cked. 100 ways.

Five horror stories from thirty years of being handed sites that were someone else's problem yesterday. Plus a catalogue of 100 specific ways to lose your money, your rankings, or your mind.

If one of these is yours: you're not alone, and it's fixable. Send us the URL.

Top 5 horror stories

The ones that still wake me up. redacted where needed.

Names changed, numbers real. The cast of sectors and platforms is wider than you'd think. The pattern, sadly, is always the same.

  1. Story 01

    Scrapped · rebuilt at 4× cost

    A new Magento build came in for an audit two months after launch. It had to be scrapped and rebuilt from scratch.

    The original Magento project had taken about six months and shipped at the client's first deadline. It survived two months live before the cracks became impossible to ignore. The brand came to my agency at the time for a second opinion, a full, detailed audit of what they'd actually bought.

    The findings were categorical. Architectural decisions that couldn't be fixed incrementally. Critical stability issues in checkout and order processing. Data integrity problems that meant every transaction carried uncertainty. The honest answer was: this cannot be rescued inside a sensible rescue budget, it needs to be binned and rebuilt properly.

    We re-quoted at roughly four times the original figure and did exactly that. In parallel, we stabilised what we could on the live site, patched the worst of the performance and reliability issues, stopped the active bleeding, so the client wasn't losing revenue through the rebuild window. Launched the proper version. Everything the first engagement should have been.

    Lesson: A build that shipped 'on time' isn't the same as a build that shipped well. The two-months-post-launch audit is the one that actually tells you what you bought.

  2. Story 02

    £5–7k · don't launch

    Countless WordPress builds so bad Gary has had to advise the client not to go live.

    The repeat scenario. A £5–7k WordPress site delivered after a three-month engagement. Looks OK at first glance. Then you open the hood.

    Page-builder theme with render-blocking JavaScript everywhere. Plugins marked 'custom development' on the invoice that are free on WordPress.org. Admin area the client can't use without breaking the layout. Accessibility scores in the 30s. SEO setup that contradicts basic best practice from a decade ago.

    'Don't launch this' is the hardest advice to give someone who's just paid for a website. But shipping it costs them more in ranking damage, re-dev and brand cost than starting again does.

    Lesson: Cheap isn't the same as affordable. An unfit-for-purpose site is 100% waste, not 50% good-enough.

  3. Story 03

    Liquidation · SEO migration

    A market-leading ecommerce brand thrown off a cliff by an amateur SEO migration strategy.

    Thriving B2C ecommerce brand. Strong organic revenue. The agency sold them a 'platform modernisation', migration to a shiny new stack.

    No redirect map. URL patterns changed wholesale. Indexed pages dropped heavily inside the first month. Organic traffic collapsed. Paid ads tried to backfill the gap, costs ballooned, margins evaporated.

    The company didn't recover. Six months after cutover it was in liquidation. The prevention was two weeks of work and a spreadsheet. The damage was done by people who genuinely believed they were modernising.

    Lesson: The cheap hour is the SEO migration plan. Skip it and you can lose a business.

  4. Story 04

    10M URLs · 18-month clean-up

    A crawled layered navigation that generated ten million near-duplicate URLs in Google Search Console.

    A retailer's layered navigation generated URL parameters for every filter combination: colour, size, brand, price, stock, sort order. Google's crawler found the path and started indexing the combinations (colour × size × brand × price × sort × stock) exponentially.

    Ten million thin, near-duplicate URLs ended up in Google Search Console. Site authority diluted across the noise. Real product pages buried. Rankings slid. The brand wondered why organic traffic was softening even though they were publishing more content.

    The clean-up ran for eighteen months: systematic noindex, canonical corrections, URL parameter rules, Search Console removal requests at scale, then a ground-up rebuild of the facet architecture so Google could find the catalogue again. All of it recoverable, none of it cheap.

    Lesson: An afternoon of facet-URL planning prevents a year and a half of clean-up. The preventable problems are always the most expensive ones.

  5. Story 05

    3 years · still not live

    A 'KISS' Magento MVP that's been in build for three years. Still hasn't launched.

    The project was scoped as a minimum-viable Magento build. Keep it simple. Take payments, ship product, nothing clever. The plan was six months. It's now in its third year of active development. It hasn't gone live once.

    What happened is a case study in how digital projects die quietly. The two people who understood the original architecture left inside eighteen months. Knowledge walked out with them. Their replacements had to reverse-engineer decisions nobody had documented, and duplicated work rather than touch code they didn't understand.

    Client expectations were mis-managed from the first sprint. 'Nearly done' after year one, 'nearly done' after year two, 'nearly done' after year three. Every quarter produced a new list of blockers and a fresh round of invoices. The client paid monthly, believed they were nearly there, and kept being wrong.

    Lesson: Time is the cheapest signal you have. If an MVP is in year two, something structural is broken: the team, the platform, the management, or all three. Get an audit before you write another cheque.

A boarded-up shopfront on a grey British high street, with 'CLOSED, DEAD SITE' sprayed in neon green across the plywood, a ram-headed man in a dark suit facing it.

Most common outcome · never recovers

The site doesn't go down. It just stops working hard enough to matter. That's what dead looks like.

And the other 100 …

100 ways to get f-cked in digital and AI.

Click any row to unfold the detail. Ten categories, ten per category. Most of them are mine in the sense that I've cleaned them up. Some are probably already yours.

No paywall, no email capture. If it's useful, share it. If it's hitting too close to home, send us the URL.

01 · 10 ways

Hiring the wrong firm.

Before the work goes wrong, the choice did.

  • 01.01 Agency that pivoted from 'Etsy consultancy' to 'AI transformation' six months ago

    If their positioning changes with the trend, their expertise does too. You're paying for the learning curve.

  • 01.02 Case studies dated 2019 or earlier, 'we're between projects right now'

    They're not between projects. They haven't had a new one. There's a reason.

  • 01.03 Freelancer who takes the Zoom call but won't share a recent portfolio

    The portfolio they'd share is under NDA. Or doesn't exist. Ask anyway.

  • 01.04 White-label relationship where the 'senior' on the call is subcontracted

    You meet the senior; a junior does the work; invoices go through two agencies. You pay for both overheads.

  • 01.05 47-slide pitch deck with no prices

    The price you can't see is designed around what they think you'll pay, not what it'll cost.

  • 01.06 Award-winning agency where the awards are for the pitch, not the build

    Award shows favour storytelling. They don't audit what shipped three months later.

  • 01.07 Firm that insists on a paid discovery workshop before any quote

    They're selling you insights they haven't earned yet. The workshop is the pitch, charged.

  • 01.08 Twelve-month minimum retainer quoted as 'onboarding'

    You're paying for their sales recovery, not their service.

  • 01.09 'Technology partner' who can't tell you which framework they'd use

    They don't write code. They brief agencies who write code. You're three degrees from the build.

  • 01.10 Account manager re-assigned twice in the first six weeks

    Internal churn is the first symptom of the work quality that's coming.

02 · 10 ways

Website builds (Static / CMS).

The site that shipped. And what's underneath.

  • 02.01 Custom CMS nobody else can edit

    Sold as 'tailored to your business'. What it means: you can only edit it through the agency. Hostage setup.

  • 02.02 Page-builder (Elementor, Divi, WPBakery) sold as 'bespoke design'

    The same blocks every other agency client gets, with your logo.

  • 02.03 Free plugins billed as 'custom development' line items

    WooCommerce, Yoast, Contact Form 7, all free. If they're on your invoice, you paid someone to install them and describe it as work.

  • 02.04 Theme you can't update without breaking the site

    Updates would touch customisations the agency bolted onto core. You get locked to an old, vulnerable theme version.

  • 02.05 No version control, no repository, no change history

    When something breaks, there's no rollback, no blame tree, no audit. Everything is now, with no yesterday.

  • 02.06 Plugins 18 months out of date the day you launch

    Already CVEs against them. You're pwned on day one.

  • 02.07 No redirect map from the old site's URLs

    Rankings earned over years evaporate in a week. Recovery is measured in quarters.

  • 02.08 No staging environment, no backups, 'we'll push straight to live'

    Every fix is a coin toss. Mistakes hit your customers before you notice.

  • 02.09 Launch on Friday afternoon, agency unreachable by Monday

    The launch-window blind spot. The thing that'll break, always does.

  • 02.10 Hosting on the agency's shared server. You leave, you lose access

    You're not a customer; you're a tenant. Eviction is a business model.

03 · 10 ways

Ecommerce.

The cart that couldn't. Revenue-bearing bugs the other agencies missed.

  • 03.01 Checkout that crashes during peak sales

    Load tests weren't run. Autoscaling wasn't configured. The day you need it most, the tills stop.

  • 03.02 No abandoned-cart emails. Ever.

    20–30% of ecommerce revenue recovery, left on the floor because nobody set it up.

  • 03.03 Payment failures because fraud rules were misconfigured

    Legitimate customers rejected at checkout. You don't find out until the support tickets arrive.

  • 03.04 Product images 3MB+, no lazy-loading, no WebP

    PDP LCP of 6 seconds on mobile. Buyers gone before the Add to Basket appears.

  • 03.05 No analytics on the purchase funnel

    You don't know where drop-off happens. You can't fix what you can't measure.

  • 03.06 Stock not syncing between platforms, customers buy out-of-stock

    Refund apologies, 1-star reviews, cancelled orders. All from a sync job that wasn't.

  • 03.07 Platform migration with no 301 redirects from old product URLs

    Rankings evaporate, external inbound links 404, the brand's Google real estate collapses.

  • 03.08 'Multi-currency support' is a UI toggle, not a tax and VAT reality

    Tax is calculated wrong. HMRC gets interested. VAT-back requests get declined.

  • 03.09 Every PDP looks identical, no range or category-specific design

    Luxury goods, fast-moving consumables, technical hardware, all styled the same. None converts well.

  • 03.10 No structured data on products. Google loses interest

    Rich snippets, price displays, availability, all missing. Competitors with schema eat your traffic.

04 · 10 ways

SEO.

Rankings earned in years, destroyed in days.

  • 04.01 Migration that loses 70% of organic traffic in a week

    The canonical disaster. Happens when migration checklists are skipped.

  • 04.02 No redirect map from old URLs to new ones

    Google sees thousands of 404s. Indexation drops. Ranking authority evaporates.

  • 04.03 Indexation blocked in robots.txt on launch (oops)

    The dev-environment rule got promoted to production. Google stops crawling. Traffic goes to zero.

  • 04.04 Hreflang misconfigured on international sites

    Google serves the wrong country's page. Spanish customers see the UK version. Conversion dies.

  • 04.05 301 chains five hops deep

    Google drops the signal halfway. Authority leaks at every step. Rankings slide.

  • 04.06 Twelve 'blog' pages saying the same thing, cannibalising each other

    Google can't decide which to rank. So it ranks none of them. The blog you paid for hurts you.

  • 04.07 AI-generated content farm, 800 posts, all thin, all slop

    Manual action risk. Entire domain deindexed overnight.

  • 04.08 Core Web Vitals red across the board

    Google's using these as a ranking signal. Red means you lose to competitors who are amber.

  • 04.09 Schema markup missing entirely, or wrong type used

    No rich results. No product snippets. Competitors with schema steal the SERP real estate.

  • 04.10 Backlink profile 80% spam, 'we bought links'

    Penguin algorithm or manual action. Disavow work takes months.

05 · 10 ways

Paid Ads.

Where budget goes and nobody tracks it.

  • 05.01 Agency charges 15% of ad spend

    You pay more when you spend more. The agency's incentive is misaligned with your ROAS.

  • 05.02 No conversion tracking installed on the site

    You're optimising for clicks, not buyers. Budget burns, no revenue signal.

  • 05.03 Running the same creative for 18 months

    Ad fatigue. Click-through collapses. Cost per acquisition doubles silently.

  • 05.04 Branded search spend that cannibalises free clicks

    Paying for traffic that would have arrived free. Agency reports it as 'high-ROAS'.

  • 05.05 Auto-optimised campaigns with zero human oversight

    Google's AI optimises for Google's metrics. Not necessarily yours.

  • 05.06 No account access, you can't see what's being spent on

    Monthly report shows selected metrics. You can't verify. Trust built on opacity.

  • 05.07 Leaving the agency means losing pixel history and audiences

    They own the Meta Business Manager. You walk away with a blank slate.

  • 05.08 Meta audiences broader than 'UK, 18–65, interested in anything'

    Your ad shows to people who'll never buy. CTR fine, CAC catastrophic.

  • 05.09 Reports showing CTR and CPM, not CAC, LTV, or ROAS

    Vanity metrics. Nothing that connects to the money going in or out.

  • 05.10 No negative keyword list. At all.

    You're bidding on 'free [your product]'. Quality buyers, no.

06 · 10 ways

Social media.

Three posts a week, zero outcomes.

  • 06.01 Same post cross-posted across every platform

    LinkedIn, Twitter, Instagram and TikTok are different beasts. One-size-fits-all is one-size-fits-none.

  • 06.02 AI-written LinkedIn posts with em-dashes and 'dive in'

    The voice is obvious. The audience stops trusting. Nobody engages.

  • 06.03 Three posts a week to tick the retainer box

    Volume without intent. The algorithm notices. Reach drops.

  • 06.04 Agency 'hearts' its own posts, that's the engagement

    An engagement graph that flatlines the second they stop.

  • 06.05 Trend-chasing reels with no brand relevance

    You went on TikTok dance. Your buyer is a 52-year-old procurement lead. They're not watching.

  • 06.06 Brand voice that reads like ChatGPT unedited

    Generic. Inoffensive. Forgettable. The three qualities you didn't pay for.

  • 06.07 Weekly reports counting impressions, not leads or revenue

    Impressions are vanity. If the social spend doesn't connect to revenue, it's hobby money.

  • 06.08 Social manager is the founder's niece on work experience

    She's lovely. She's also not senior. Your brand is her coursework.

  • 06.09 Posting to platforms your buyer persona never uses

    Diligently posting to TikTok for a B2B audit firm. Who are you talking to?

  • 06.10 Paid influencer deals without FTC or ASA disclosure

    Not optional. Undisclosed ads get pulled and fined. The brand carries the damage.

07 · 10 ways

AI in your marketing.

The new way to get f-cked. Same playbook, faster to market.

  • 07.01 Publishing raw AI-generated copy ('As an AI language model…')

    It happens. The prompt artefact ships. Screenshots circulate. Brand trust evaporates.

  • 07.02 Product pages that hallucinate features you don't sell

    'Available in 17 colours' when you stock four. Returns, refunds, and trust damage.

  • 07.03 AI customer-support chatbot without a human in the loop

    It invents policy, quotes wrong prices, and commits you to things. Every one is a refund.

  • 07.04 AI-generated hero images on product pages

    Google's flagged image provenance signals. Amazon bans AI-only product imagery. Trust dies.

  • 07.05 AI SEO content farms, 800 posts, zero editorial review

    Manual action territory. Entire domain deindexed. See horror story #5.

  • 07.06 AI mass-translation without a native-speaker check

    Mistranslation lawsuits exist. Product labels failing regulation. Real money.

  • 07.07 No AI disclosure where required (ASA 2026 guidance)

    Ads and content generated by AI need disclosure in the UK. Your agency didn't say.

  • 07.08 AI-ghostwritten executive LinkedIn that everyone can spot

    Your voice becomes indistinguishable from your competitors'. The one thing you owned, gone.

  • 07.09 Training a chatbot on unredacted internal tickets

    The chatbot quotes internal customers back to other customers. Data exposure. Real breach.

  • 07.10 'AI strategy' deck that's the agency's standard deck with 'AI' replaced

    Same consultancy trick, new keyword. The deliverable is another deck.

08 · 10 ways

Ownership & handover.

The things you didn't realise you didn't own.

  • 08.01 Domain registered in the agency's name

    You don't own the address people type in. If they stop paying it, you lose the business.

  • 08.02 Hosting account in the agency's name

    Eviction is a decision they can make. You can't port what you don't control.

  • 08.03 GA4 property in the agency's Google account

    Years of historical data, gone the day you leave.

  • 08.04 Search Console unverified by anyone in your company

    You can't see what Google says about you. That's a dashboard that should be yours.

  • 08.05 Source code not in your GitHub organisation

    The build is in their repo. When you leave, you're taking a tarball of files, no history.

  • 08.06 No handover documentation at launch. None.

    The person who built it could leave tomorrow. Without docs, that's your website's half-life.

  • 08.07 All passwords in the agency's 1Password, not yours

    Credential custody = power. You're the tenant, they're the landlord.

  • 08.08 CMS admin accounts never audited, old freelancers still have access

    Every past contributor is a live threat. Ex-contractor with a grudge is a breach waiting.

  • 08.09 Ad accounts owned by the agency. You leave, pixel history resets

    Audiences built over years reset overnight. Optimisation starts from scratch.

  • 08.10 Analytics data not exportable in any usable format

    Monthly summaries in PDF. The underlying data you paid for, locked in their tool.

09 · 10 ways

Performance, security & compliance.

The silent ways your site is costing you.

  • 09.01 Lighthouse mobile score under 30

    Google uses this as a ranking signal. You're bleeding traffic you never see.

  • 09.02 Hero images 4MB+, no WebP, no responsive srcsets

    Mobile LCP over 5 seconds. Buyers gone before the fold appears.

  • 09.03 HTTPS not enforced, mixed content warnings

    Browsers warn users. Conversion plummets. Search rankings suffer.

  • 09.04 WordPress admin login at /wp-admin, open to the internet

    Brute-force attack target day one. No rate limit, no 2FA, breach is a question of when.

  • 09.05 SQL injection vector in an unpatched plugin

    Your database is one curl command from a data breach. ICO fines are not theoretical.

  • 09.06 No WAF, no rate limiting, no DDoS protection

    One coordinated attack takes the site down. Your weekend, your Slack, your revenue.

  • 09.07 Cookie banner that fires analytics tags before consent

    UK GDPR / PECR violation. Complaints to ICO. Fines up to £17.5m.

  • 09.08 GDPR subject access request takes three months to fulfil

    Legal deadline is 30 days. Complaints escalate. You miss more than the deadline.

  • 09.09 Accessibility score under 50%, legal exposure under EAA

    European Accessibility Act applies. UK Equality Act applies. Fines plus lawsuits.

  • 09.10 No backups. Or backups that don't restore when tested

    The day the database dies, you find out the backups are unusable. That's the day the site dies too.

10 · 10 ways

Contracts & retainers.

The small print that costs real money.

  • 10.01 Twelve-month minimum retainer, tied to 'onboarding'

    Onboarding was three weeks of work. You're paying eleven more months for the privilege of leaving later.

  • 10.02 Auto-renewal with 90 days' written notice

    Missed the window? Another year. Happens more than anyone admits.

  • 10.03 Scope-creep invoice three months into a fixed-price engagement

    'That wasn't in scope.' It was. They'll invoice anyway. You pay or you fight.

  • 10.04 Ownership clause: 'agency retains IP in all work produced'

    You paid for something you don't own. To use it you need a perpetual licence. Which they'll sell you.

  • 10.05 Non-compete clause stopping you using their competitors

    Applies after the contract ends. You picked the wrong one? You can't hire another for 12 months.

  • 10.06 Break clause requires notice by registered post to a specific address

    The only break clause that's harder to exercise than the contract itself.

  • 10.07 Outstanding-invoice clause lets them withhold files

    Dispute a line item? They withhold your codebase until it's paid. Leverage.

  • 10.08 Revisions limited to two rounds, then billed per change

    The third round is always the one where the feedback lands. Every project. Every time.

  • 10.09 Indemnity clauses making you liable for their work

    Agency gets sued. You pay. Read the indemnity section twice.

  • 10.10 Governing law in a jurisdiction that isn't yours

    Dispute? Good luck. The contract's jurisdiction is theirs, the courts are theirs, the solicitors are theirs.

Recognise yours?

If any of those sounded familiar, start here.

The £250 initial review. 48 hours. Headline scores, commercial impact, top three findings. If you think it's bad, it's almost certainly worse. The audit will prove it. Money-back if it doesn't.

Book the audit Send us a URL