Kings Gardens
A regional landscaping brand brought fully online: a CMS-backed marketing site, spam-resistant lead capture, and a private admin panel, all running for roughly the price of a coffee per year.
6
Countries served
8
End-to-end services
~$1.25
All-in monthly cost
2015
Brand founded
The client
Kings Gardens is a landscape design and land stewardship company founded in 2015 by Zahi El Masry in Salima, Mount Lebanon. What began as a Lebanese landscaping practice has grown into a regional landscape and irrigation contractor.
Today the company delivers projects across six countries: Lebanon, the United Arab Emirates, Saudi Arabia, Kuwait, Bahrain, and Oman, from Beirut and Dubai to Riyadh, Kuwait City, Manama, and Muscat.
Their positioning is deliberate: not landscaping but land stewardship, living environments designed to thrive for generations. They deliver eight end-to-end services across residential, commercial, public, and semi-government projects, from landscape and irrigation design to hardscape, green walls, water features, and environmental sustainability.
The brief
Kings Gardens had a decade of regional work and no digital presence to match it. They needed a website that would:
Establish credibility across two very different markets, Lebanon and the GCC
Rank for landscaping searches in every city they serve
Present eight services and a project portfolio without looking like a template
Capture qualified leads and protect that form from spam and bots
Give the owner a private dashboard to read and manage enquiries
Cost almost nothing to run, with no dedicated IT or DevOps team
What we built
A six-page marketing site backed by a database-driven content layer and a private admin panel, built on a modern React stack and deployed on globally distributed infrastructure.
Six-page public site
Home, Our Story, Services, Portfolio, Contact, and a custom 404, each server-side rendered for fast first paint and full search-engine visibility.
Database-driven content
Services and projects live in PostgreSQL, so the business updates content without touching code or redeploying.
Dynamic per-service pages
An overview page plus a dynamic, SEO-optimised landing page for every one of the eight services.
Protected lead capture
A validated enquiry form on Next.js server actions, with schema validation, invisible bot scoring, and rate limiting layered together.
Private admin panel
A password-protected dashboard, isolated behind middleware, where the owner reviews submissions and marks enquiries as replied.
Geolocation and device insight
Every enquiry is enriched with the visitor's approximate location and device, resolved from their IP and browser.
The technology
Every layer was chosen for security, search visibility, and a running cost that stays near zero.
Framework
Next.js 15 (App Router), React 19, TypeScript
Server-rendered, strictly typed, fast first paint
UI
Material UI 6 with Emotion, custom theme
Polished, on-brand, mobile-first and accessible
Data layer
Prisma 6 with Accelerate, PostgreSQL
CMS-backed services, projects, and submissions
Bot protection
Google reCAPTCHA v3
Invisible, score-based spam detection
Rate limiting
Upstash Redis and Ratelimit
Sliding-window limit, 5 submissions per hour
Validation
Zod
Schema validation on every form input
Admin auth
HMAC-SHA256 tokens via Web Crypto API
Zero-dependency, timing-safe session security
Enrichment
geoip-lite and ua-parser-js
Location and device context for every lead
SEO
JSON-LD, dynamic sitemap, OG images
Per-city targeting and rich social previews
Hosting
Vercel
Global edge CDN, auto-scaling, free TLS
The contact form, the one public input, is guarded by three independent layers: input validation, bot scoring, and rate limiting. A failure in any one layer does not open the door.
Admin sessions use HMAC-SHA256 signed tokens generated with the platform's native Web Crypto API, with constant-time comparison to resist timing attacks. No third-party auth service, no extra cost, no extra attack surface.
Middleware validates the session token before any admin page renders, so unauthenticated requests never reach private code or data.
Services and projects live in the database, so the business can evolve its offering without an engineer in the loop.
Running costs
The entire platform runs on free and effectively free tiers. The only recurring expense is the domain.
Hosting and global CDN (Vercel)
Hobby$0
PostgreSQL database (Prisma Postgres)
Free$0
Rate limiting (Upstash Redis)
Free$0
Bot protection (reCAPTCHA v3)
Free$0
SSL / TLS certificate (Vercel)
Included$0
Image delivery CDN (static.octetlab.com)
Included$0
Domain registration
Annual (~$15/yr)~$1.25 / month
All-in total
~$1.25 / month
A production-grade, secure, SEO-optimised website with a CMS-backed content layer and a private admin panel, for roughly the price of a coffee per year. Each provider has a paid tier that lifts the limits without re-platforming, so the client pays for scale only once scale exists.
The result
A decade-old regional brand now has a digital presence that matches its reputation. Every service and every city the company serves has a dedicated, search-optimised page.
Qualified leads land directly in a private dashboard, enriched with location and device context, with spam filtered out before it reaches the owner. The owner manages content and enquiries without developer involvement, and monthly infrastructure cost is effectively zero, with a clear, low-risk path to scale when the business grows.
A production-grade platform for the price of a coffee per year.
Want a platform like this for your brand?
Octet Lab designs and builds fast, secure, search-ready sites for creators and brands.