Inhiraaf

Next.js 16 on the App Router with React 19 and TypeScript, Server Actions for every admin write and proxy.ts in front of the routes. Content lives in PostgreSQL 17 through Prisma 7: posts, books, videos, FAQs, pages and homepage slides each carry a translation table, alongside authors, categories, tags, comments, contact messages, media, redirects, settings, users and an audit log.

next-intl serves English at the original URLs and Urdu under /ur with a full right-to-left layout, canonical and hreflang tags, and untranslated articles pointing their canonical at the original language. Editors write in a Tiptap rich-text editor that handles both directions. The app runs in Docker with PostgreSQL alongside it, and is deployed to Netlify with a Neon database.

The migration is scripted rather than copied by hand: wp:import turns the raw WordPress REST export into clean seed data, wp:download fetches every upload, wp:covers renders missing book covers and page counts from the PDFs themselves, verify:media checks that each referenced file is present, and the seed is idempotent. Files not yet copied fall back to the old site through a redirect, so the switch can happen before the last upload arrives.

Load time was the other half of the brief. Images are served as AVIF or WebP through next/image with shimmer placeholders, YouTube loads only when a video is played, the PDF viewer and the admin editor load lazily, PDFs stream by range, and only the Latin fonts are preloaded — the large Urdu fonts arrive only on pages that need them. Fonts are self-hosted, and pages are revalidated when an editor saves.

Replacing WordPress removes the plugin and wp-admin attack surface, and the new admin is locked down in its place. Passwords are hashed with bcrypt at cost 12; sign-in is rate-limited per IP and locks an account for 15 minutes after 5 wrong passwords; and TOTP two-factor login works with any authenticator app. Sessions are signed, HttpOnly, SameSite=Strict cookies that expire after 12 hours and are checked against the database on every request, so a removed user or changed role takes effect at once. Admin and Editor roles are enforced inside each server action, and every sign-in, 2FA change, create, update and delete is written to an audit log with the user and IP.

Uploads are allow-listed by type and size, checked against their first bytes, stored outside the web root and served with nosniff; SVG and HTML are refused. Comments and the contact form pass a honeypot, a timing trap, rate and link limits and a keyword blocklist, with optional Cloudflare Turnstile, and every comment is held for approval. Responses carry a strict Content-Security-Policy, HSTS with preload, frame, referrer, opener and permissions policies, and visitors get no cookies, analytics or trackers at all.