Ruff Roofing had a problem that a lot of trusted local businesses eventually run into: their digital presence had become a liability. The old site was under active attack — repeated probing, injection attempts, and traffic patterns that didn't look like customers looking for a roof inspection. Before we could redesign anything, we had to stop the bleeding.

This post walks through how we secured their digital assets, then rebuilt ruff-roofing.com as a modern, fast, service-first website that reflects what Ruff Roofing actually does every day: design, repair, and replace roofs across Texas.

The State of the Old Site

When we first got involved, the site showed every sign of a long-running compromise attempt. Unusual traffic hammering the admin login, outdated plugins with publicly known security flaws, and domain settings pointing to services nobody on the team remembered setting up. For a business that relies on phone calls and form submissions from homeowners, every hour of degraded trust was a real cost.

The first job wasn't design. It was containment.

Step One: Securing the Digital Assets

Before we touched a single pixel, we treated the environment like an incident response, not a redesign kickoff.

Inventory everything. Domains, DNS records, email accounts, hosting panels, analytics, ad accounts, Google Business Profile, CMS admin users — we listed every asset attached to the business and documented who had access.
Rotate and reduce. Every password was reset. Every stale admin account was disabled. Access was narrowed to the smallest set of people who actually needed it, with strong passwords and two-factor authentication enforced across the board.
Lock down the domain. The domain is where most "mystery" compromises live. We consolidated records, removed unknown entries, turned on transfer locks so the domain can't be stolen, and moved to a more secure hosting setup.
Put a protective firewall in front of the site. A managed website firewall blocks hostile traffic — bots probing for weaknesses, attackers trying stolen passwords, automated scrapers — before it ever reaches the site. Rate limits and bot filtering cut that junk traffic significantly on day one.
Harden email. We set up proper email authentication so attackers couldn't send fake emails pretending to come from Ruff Roofing — a common follow-on attack after a website compromise.
Backups and monitoring. Off-site, versioned backups, plus alerting on suspicious logins, unexpected file changes, and traffic anomalies. If anything odd happens, the team knows within minutes, not weeks.

Only once the environment was stable did we start talking about the new site.

Step Two: Rebuilding the Site Around the Services That Actually Matter

Ruff Roofing's business isn't "roofing" in the abstract. It's a set of very specific promises a homeowner is evaluating at a very specific moment — usually after a storm, a leak, or a realtor asking a hard question. The old site buried those moments under stock imagery and navigation that read like a sitemap. The new site leads with them.

A Hero That Moves

The homepage opens with a cinematic roof video — real crews, real jobs, real Texas skies — instead of a static banner. It communicates in three seconds what a block of body copy can't: these are people who actually climb on roofs. Paired with a single clear call to action ("Get Your Free Roof Inspection"), the first screen does one job and does it well.

Roof Designer: See Your Home Before You Commit

The service we're proudest of surfacing is the Roof Designer. Picking a shingle color from a tiny swatch card is one of the worst parts of a roof replacement — most homeowners are guessing. The new site gives them an interactive designer where they can preview materials and color palettes on a home similar to their own, so the decision gets made with confidence instead of anxiety.

We wired the designer directly into the lead flow, so a homeowner who spent ten minutes choosing a shingle color can send that exact selection to the sales team with one click. No retyping, no "I think I liked the gray one."

Clear, Separate Pages for Each Service

The old site collapsed everything into a single "Services" page. The new site gives each offering its own landing page, written for the specific homeowner who would land on it from search or an AI answer:

Roof Repair — for the homeowner who just noticed a leak after last night's storm.
Roof Replacement — for the homeowner whose roof is 20+ years old and finally showing it.
Roof Inspection — for buyers, sellers, and insurance claims.
Residential and Commercial — two very different customers, two very different pages.
Shingle, Metal, and Flat Roofing — material-specific pages for homeowners who already know what they want.
Financing — because nobody budgets for a new roof in advance.

Each page is structured so Google and AI answer engines can extract the right snippet for the right query, instead of returning a generic homepage link.

Local Landing Pages for the Cities They Actually Serve

Ruff Roofing serves multiple Texas metros. We built dedicated city pages for Houston, Dallas, and Austin, each with local reviews, recent jobs, service-area maps, and city-specific content. When a homeowner in Plano searches "roof replacement near me," they land on a page that speaks to them specifically — not a generic nationwide template.

Trust, Visibly

Roofing is a trust-first purchase. Homeowners are letting strangers climb on their house and stage a six-figure insurance claim. The new site foregrounds the stuff that actually moves trust: the Owens Corning Platinum Preferred status, the manufacturer-backed warranties, real Google reviews pulled live rather than hand-picked, and an Instagram feed showing ongoing jobs. None of this is decoration — each element answers a specific question a hesitant homeowner is already asking.

Step Three: Making It Fast, Accessible, and AI-Visible

A modern roofing site in 2026 is discovered in two places: Google and AI answer engines like ChatGPT and Perplexity. Both reward the same things — fast pages, clean structure, and honest content.

Optimized images and video so the hero video loads smoothly on mobile without burning anyone's data plan.
Structured information behind the scenes describing the business, services, service areas, reviews, and financing options — so AI models can pull the right facts when a homeowner asks "who does metal roofing in Houston with financing?"
Accessibility — readable alt text, keyboard navigation, color contrast that works in Texas summer sun on a phone screen.
Fast page speed across homepage, service pages, and city pages.

What Changed for the Business

The security work made the day-to-day quieter — no more waking up to alerts about odd logins or defaced pages. The redesign made the site do its actual job: turn a worried homeowner into a booked inspection.

Hostile traffic drops significantly once the firewall and hardened domain settings are live. The team stopped spending time on cleanup and started spending it on customers.
Inspection requests now come in through a clean, spam-filtered form with address autocomplete, routed directly to the team that can act on them.
Each city page ranks for its own local queries instead of fighting the homepage for the same keywords.
The Roof Designer has become a real lead source — homeowners who engage with it convert at a meaningfully higher rate than cold form fills.

The Bigger Point

Under-attack sites are more common than most small businesses realize, and the instinct is usually to skip straight to "can you just make it look nicer?" That instinct is wrong. A beautiful site on a compromised foundation is a beautiful site that gets compromised again next quarter.

For Ruff Roofing, doing the security work first was the thing that made the redesign durable. Now the site is not only safer — it actually reflects the business. A real Texas roofing company with a specialized designer tool, honest reviews, and a crew that shows up. That's what homeowners are looking for, and now it's what they find.

See the new site at ruff-roofing.com.

Ruff Roofing: Locking Down a Under-Attack Site and Rebuilding It From Scratch