Duca Dizajn

Everything the visitor needs to see is on one page, split into five sections that are numbered as you scroll: the intro, My Work, What I Offer, Work Process and Frequently Asked Questions. The navigation at the top does not lead to other pages but jumps to those sections, and the Contact item goes straight to the Instagram profile.

The opening screen says who he is and what he does in one sentence and offers two ways forward — the portfolio or the profile. Next to the heading are three tags that cover the field (logo design, branding, print design), and below the buttons three short points about how he works: direct agreement, print-ready files and digital formats.

The My Work section is deliberately not a gallery maintained by hand. Instead of a row of images someone would have to update every time a new piece is finished, there is one card with a collage of work that leads to the profile. The reason is practical: the designer posts on Instagram anyway, and a gallery on the site would fall behind within the first week, and after six months it would be lying about what he does today.

That one page comes with three legal subpages and a custom 404 error page. That is the whole site — five documents, nothing more.

The What I Offer section is four cards, one for each service. Each has a short description, a starting price marked “from” and a list of what is included — for logos that means several concepts, revisions, all file formats and basic usage guidelines for the mark; for business cards, a design for both sides, print preparation and an option with a QR code. The logo design card carries a “Popular” label.

Pricing is deliberately set as a starting price, not a price list. Graphic design is not sold by the piece — a business card for one person and a series for a company with ten employees are not the same job, even though they go by the same name. The “from” label captures that difference without negotiating up front, and the Terms of Use spell it out: the amounts are approximate, the final price depends on complexity, number of revisions, delivery formats and deadline, and it is agreed before work begins. The price confirmed when the order is accepted is binding on both sides.

The same prices are also in the page's structured data, as an offer attached to each service. When a price changes, it changes in both places — there is no magic to it, both entries are in the same file about twenty lines apart, so it is hard to forget. A site where the visible price and the price in the structured data say different things is a common, silent mistake.

Two sections exist only to make the first message shorter. Work Process is four steps — conversation, sketch, design, delivery — each in two sentences. Not because the process is complicated, but because someone ordering design for the first time does not know what to expect, and not knowing stops them before they even ask.

Frequently Asked Questions does the same job, only more directly: how long does it take, can I ask for changes, which formats do I get, how does payment work. The answers are short and specific — a turnaround in business days with a note that a rush option exists, a list of the formats delivered at the end, and a split into a deposit before the start and the rest on completion.

Those four questions were not invented to fill the section. They are the questions that kept arriving in messages, one after another, each time needing the same answer typed out again. Now they are on the page, so a message that arrives after them usually already knows what it wants — and that is the difference between ten messages that turn into one job and ten messages that eat up an afternoon.

The questions and answers are also machine-readable, marked up as FAQPage. The markup helps search engines understand the content, but it does not promise any special display; these days Google shows the FAQ rich result mostly for well-known government and health sites.

The site is plain HTML5, CSS3 and vanilla JavaScript. No PHP, no database, no CMS, not a single plugin. The entire home page is one file of about thirty kilobytes that the server sends as is, without executing anything along the way.

The decision is not laziness but arithmetic. A one-person portfolio with four services changes a few times a year. For that volume, a CMS would mean a database that can go down, an admin area that has to be updated every month and a login page left open three hundred sixty-five days a year for a change that happens in March and in October. A static page has nothing to break into through a login that does not exist.

What you get is speed without optimization: no queries, no page generation, no caching to configure and then verify. Nginx sends the file, static assets are cached for thirty days, compression is on, and that is the whole performance story.

The source code lives in a git repository and syncs to the server, so every change leaves a trail and can be reverted. The maintenance mode files, which sit in the same folder, are blocked at the server level so nobody opens them by accident.

The most interesting part of the job was not the design but one failure you could not see.

At the time, the site used GSAP with ScrollTrigger-driven section reveals and Font Awesome for icons. Both were initially loaded from a public CDN, as is usually done. Then the content security policy was tightened on all the sites we maintain, so that the browser may execute scripts and load styles only from the same domain. The result: script blocked, icon styles blocked, animations dead, all icons invisible.

The sneaky part was that the site did not crash. The sections stayed visible, because an animation that never starts leaves the element where it is. The page opened, the text could be read, nothing shouted that there was an error — it was just dead. A failure like that survives for months if nobody opens the console.

The fix was to stop borrowing the libraries. Pinned versions of GSAP and Font Awesome, with all their webfont files, were downloaded and placed on the site itself. Along the way, that also removed the dependency on a third-party server that could one day change its address, slow down or drop a version.

Two details bared their teeth. First: the files were initially placed in /vendor/ and still returned 404 — because a rule that applies to all sites on the server deliberately hides that folder, since that is the usual name for a directory of third-party code that has no business being public. Instead of touching the shared rule that protects the whole server, the libraries were moved to /assets/vendor/. Second: index.html was marked as immutable at the file system level, so the automatic sync was silently failing and leaving a log message that looked like a git branch problem. The flag was removed and the sync started working again.

The story has a sequel. In September 2026, along with a refreshed visual system, GSAP was removed entirely: section reveals, the progress bar and highlighting of the current section now run on plain JavaScript, without a single animation library. The only external library left is a subset of Font Awesome icons, on the same server as the fonts.

The animations are there to guide the eye, not to be noticed. Sections appear as you scroll, a thin bar at the top shows how far you have come, and the navigation highlights the section the visitor is currently in. The work card tilts slightly with the mouse, but only on devices with a precise pointer. All of it is conditional: anyone who asks their system for less motion gets a site that stays still.

There are hardly any images — the logo, the work collage and a social sharing image. The collage loads only when its turn comes and has its dimensions set, so the page does not jump while loading. The fonts are Playfair Display for headings and Inter for body text, and both load from the same server, with no waiting on anyone else's. Loading the same font twice — once through a tag in the head, once through an import in the CSS — was removed; it is a mistake nobody notices, but it is paid for on every page load.

The site was checked at four screen widths, from a small phone to desktop. There is no horizontal scrolling, the menu switches to a hamburger on tablets and below, and the phone layout was changed so the text comes first and the logo second. It used to be the other way around, so on a small screen you saw the logo first and had to look for the message below it.

Accessibility was not left for later: at the top of the page there is a hidden link that goes straight to the content, the menu is marked up as navigation, and the gray text color was darkened until the contrast against the background crossed the readability threshold. On a cream background with a gold accent this was a must — a light palette looks gentle until you try to read the smaller text.

A portfolio without a form seems like a site with nothing to declare. It is not. Analytics alone is enough to create obligations, and tracking that starts before consent is a violation no matter how small the site is.

That is why analytics was set up through Consent Mode v2, with every category denied by default. The tracking script does not load until the visitor clicks “Accept all”. Anyone who chooses “Necessary only” gets a site that works exactly the same, just without tracking — and that is the whole point of a choice that is not fake. The decision is remembered in the browser and respected on the next visit, and the site also reads the signal the browser sends when the user has asked in their settings not to be tracked.

Three written documents go with it: a privacy policy under the Serbian Personal Data Protection Act (ZZPL) and the GDPR, terms of use, and a cookie policy that lists the cookies by name — name, purpose, duration and who sets them. They were not copied from another site. They state what this site actually does: who hosts the server and in which country, how long visit logs are kept, who the data is passed on to and how consent is withdrawn.

Since the site has no form, that is where the data story ends — no stored messages, no database to keep them in, no exports anyone would have to safeguard. The safest data is data that is never collected.

A one-page site easily ends up as an address known only to people who already got the link. To prevent that, we did the things that usually get skipped on a one-page site.

The structured data describes the business as LocalBusiness — name, description, logo, Novi Sad as the location, Vojvodina and Serbia as the service area, Instagram as the official profile and four services with starting prices. Alongside it are the WebSite and FAQPage. That is what tells a search engine there is a real business in a real place behind the address, not a page with nice pictures.

The title and description were written for the search result, not copied from the intro text. Every subpage has its own title and its own description. There is a canonical URL, a full-size sharing image for social networks and messaging apps, a theme color tag, a manifest, a favicon and a sitemap that lists every page. robots.txt blocks nothing except the maintenance mode pages.

The 404 error has its own page in the same design, with links back to the home page and the portfolio, and — more importantly — it returns a real 404 status. A page that looks like an error while its status says everything is fine is the quietest way to get a pile of nonexistent URLs into search and dilute the site from within.

A small thing that is rarely done: the site has a security.txt file with a contact, so someone who finds a vulnerability knows whom to tell instead of keeping quiet or publishing it somewhere else.

One address that does the job Instagram does not: it explains the offer, gives a starting price, describes how working together goes, answers the four recurring questions and sends people back to the profile when they are ready to write. The address can be printed on a business card, sent in a message or put in the profile bio.

No monthly platform subscription, no plugins that fall apart with the next update, no admin area to guard with a password. The site is five documents and a bit of styling — it can be copied, moved and handed over to someone else at any time, without negotiating with anyone.

Maintenance is something that actually happens, not a line item in a quote: the certificate renews itself, changes go through git with a trail, and failures caused from outside — like that security policy that knocked out the animations and icons overnight — are caught in regular checks across all the sites we run, not when the client calls to say something is broken.

If a domain of its own comes one day, the content and code move over untouched. The address changes, redirects are set up and the search listing is updated. Everything else stays as it is.