Web Design, Automation and Sales — 29 July 2026

This meetup explored how email security, automation, customer portals and AI-assisted tools are reshaping web design and development. A consistent theme emerged: modern websites are becoming customer-facing layers within larger, connected systems.

Email deliverability starts with the domain

Jas from ShortTech opened with a practical look at DNS, email security and spam prevention. Every sending domain should have three essential records configured correctly:

• SPF identifies which services may send email for the domain.
• DKIM adds a cryptographic signature that helps recipients verify a message.
• DMARC defines what receiving servers should do when authentication fails and provides reporting.

The recommended DMARC rollout is gradual: begin in monitoring mode, review the reports for several weeks, confirm every legitimate sending source and only then progress towards an enforcement policy such as reject.

Configuration alone is not enough. Run a DNS audit and test real outbound messages to identify authentication, reputation and deliverability problems. For website-generated email, use a dedicated delivery service instead of relying on ordinary web hosting. Postmark was highlighted as an option for both transactional and broadcast messages, using separate streams so bulk traffic does not undermine important messages such as confirmations and password resets.

Where practical, avoid concentrating domain registration, DNS, hosting and email with one supplier. Separating them can reduce lock-in and prevent one provider problem from taking everything offline.

Forms and payments need layered protection

Spam prevention extends beyond contact-form messages. Public forms and ecommerce checkouts can be targeted by automated registrations, fake orders and card-testing attacks. CleanTalk was discussed as one possible layer for filtering suspicious submissions before they reach a payment provider.

It should sit alongside CDN or firewall protection, rate limiting, bot detection, strong server-side validation and the payment provider’s own fraud controls. Card testing can lead to disputes, additional fees, higher decline rates and card-network monitoring, so the practical message was to detect and stop it early.

APIs pull; webhooks push

A helpful distinction was made between APIs and webhooks. An API is used when one system requests or sends information as part of a request-and-response exchange. A webhook automatically pushes information to another system when a particular event happens. In shorthand: APIs pull; webhooks push.

They can also work together. A customer-portal example followed this flow:

1. The portal requests appointment availability from a back-office system.
2. Availability is checked against calendar information.
3. The customer selects a new time.
4. The operational system updates the appointment.
5. Confirmation is pushed back to the portal.

The wider architectural lesson was to keep the operational system as the source of truth. The website or portal provides the customer experience, while the backend owns the records and business rules. The same pattern can support appointments, documents, planning tools, budgets and other customer-specific information.

The changing agency workflow

The discussion then moved to AI-assisted delivery. Some agencies are progressing from page builders, through fully custom systems, towards hybrid workflows in which AI supports design and development.

Potential benefits included faster production, quicker design iteration, smaller teams delivering more, more bespoke interfaces and deeper system integrations. The human role does not disappear: responsibility shifts towards architecture, security, review, quality control and systems thinking.

Builder enhancements, design-to-code and video

An open-source builder enhancement tool was demonstrated with full keyboard accessibility, command-palette navigation, raw HTML editing, clear style-source inspection and the ability to convert repeated HTML into collection-style components. One useful observation was that HTML and CSS can be easier and more efficient for AI systems to understand and modify than large blocks of builder-specific JSON.

Another internal tool showed how static interface references can become coded experiences: deriving a reusable design system from an image, extending one design direction across several pages and adding interaction or animation. A related AI-video workflow covered generating avatar-led scenes, assembling them into a complete video, removing silences and adding zooms or jump cuts.

Where the industry may be heading

The wider conversation touched on increasing pressure on traditional plugin businesses as custom development becomes faster, growing interest in clean and AI-friendly code, headless CMS architectures and choosing different AI models according to cost and task.

The overall feeling was not that conventional web development is disappearing. Instead, the work is moving towards connected systems, automation and AI-supported production, with human judgement becoming more important rather than less.

Useful resources

• Email Deliverability 101: SPF, DKIM and DMARC Explained, shared by Jas.
• Postmark Message Streams for separate transactional and broadcast email delivery.
• CleanTalk guidance on preventing card fraud and fake orders.
• Stripe guidance on card-testing attacks.
• WP Plugin Auditor, shared by Miriam from Elementor, for checking WordPress plugins across security, standards, performance, compatibility, privacy and accessibility.