Paid traffic was landing on a homepage that gave visitors nothing to do.
The firm handles deportation defense, asylum, TPS renewals and family immigration across Long Island and NYC. Their clients arrive with deadlines. The website met them with a rotating slider, a contact form below the fold, and no mention anywhere of the removal orders, status expirations and filing windows that had sent people searching in the first place.
Underneath that, the page was too heavy to load. Page weight ran from 14.9 MB to over 21 MB, with server response between 3.2 and 3.6 seconds before rendering began. On mobile the largest element took 7.1 seconds to paint and the browser sat blocked for 620 milliseconds while scripts ran. Elements moved during scroll, so buttons shifted under the thumb mid-tap.
Two further constraints shaped how the work had to be done. The client believed the site was carrying malware, from an injected script nobody could account for. And hosting access sat with a third party overseas, so there was no staging environment: every change had to be made on production.
Google PageSpeed Insights, measured on the homepage before the work began and after the final optimization round.
| Measure | Before | After | Change |
|---|---|---|---|
| Performance score, mobile | 42 | 75 | +33pts |
| Performance score, desktop | 60 | 96 | +36pts |
| Largest Contentful Paint, mobile | 7.1s | 4.2s | -41% |
| Largest Contentful Paint, desktop | 1.2s | 0.8s | -33% |
| Speed Index, mobile | 15.2s | 5.0s | -67% |
| Speed Index, desktop | 5.0s | 1.8s | -64% |
| Total Blocking Time, mobile | 620 ms | 0 ms | eliminated |
| Total Blocking Time, desktop | 820 ms | 0 ms | eliminated |
| First Contentful Paint, mobile | 4.7s | 4.1s | -13% |
| Best Practices score | 77 | 96 | +19 pts |
| Accessibility score | 77 | 82 | +5 pts |
Audit, implement, re-measure, repeat.
Performance work ran in four rounds, with a PageSpeed capture taken after each one: 12, 13, 15 and 22 June. Findings were tested across five tools and triaged into P1 and P2 before anything was written, so the items sitting on the conversion path got fixed first and the polish waited.
The absence of a staging environment set the rhythm for everything else. Rather than editing live pages directly, we duplicated each one, made the changes on the copy, put it in front of the client for approval, and only then migrated it across. No unreviewed change reached the live site at any point.
Before

After

Put the form in the hero. Four fields and a tap-to-call button, above the fold, where attention already was.
Removed the rotating slider. One static hero: headline, form, call button. Nothing moving, nothing competing for attention on arrival.
Fixed the phone to the bottom of the screen. A sticky mobile bar carrying Call and Free Consultation, present at every scroll position on every page.
Raised the trust signals. The AILA membership badge moved above the fold, the firm’s client, experience and language figures moved up beneath it, and a “Se habla español” line went where Spanish-speaking visitors would actually see it.
Wrote the deadlines into the page. Urgency messaging for deportation orders, TPS expirations and asylum filing windows, on a practice where the deadline is usually the reason someone is searching at all.
Standardized every call to action. A mixed set of labels pointing at inconsistent destinations was consolidated into one “Free Consultation” action, with a persistent CTA added across pages.
Repaired the controls that did nothing. The hero CTA was a raw link rather than a button. The Vision and Mission CTAs were non-functional. The contact form above the map was missing on mobile. The homepage statistics counters were stuck at “0+” and were replaced with real figures.
Cleaned up the header and the layout. Header space reduced, redundant navigation links removed, the sticky header cut-off on mobile scroll resolved, and the mobile layout shift corrected so controls stop moving under the thumb.
Re-enabled pinch to zoom. Zoom had been disabled at the viewport level. On a site whose visitors are reading dense legal copy, often in a second language, that is a real barrier and not a stylistic choice.
Ran the performance pass. Render-blocking resources reduced, CSS and JavaScript delivery optimized, images converted to WebP, caching improved, and an unused slider plugin deactivated. Re-measured after every round rather than only at the end.
Investigated the suspected malware. Wordfence kept stalling, because CloudLinux shared hosting caps CPU per account and the scan runs on that same server. We switched to MalCare, which scans on its own cloud infrastructure, and the first scan completed clean: no malware, no infected files, no bad redirects. The unfamiliar script turned out to be CHEQ Essentials, the click-fraud tool protecting the firm’s own ad budget. Its obscure domain is deliberate, so bots cannot block it.
Built out the service pages. FAQ sections and attorney bios added across twelve service pages, so a visitor arriving from a search for one specific filing type lands somewhere that answers them.

First screen on mobile

Trust signals raised
Blocking time went to zero on both. It had been 620 milliseconds on mobile and 820 on desktop, which is the interval where a page looks ready and does not respond. Someone searching for a deportation attorney at eleven at night, on a phone, on a poor connection, gets one impression of whether this firm is reachable. A page that ignores the first two taps does not get a second visit.
Mobile 42 to 75, desktop 60 to 96. Largest Contentful Paint fell from 7.1 seconds to 4.2 on mobile and from 1.2 to 0.8 on desktop. Speed Index, which measures how quickly the page fills in rather than when one element lands, dropped from 15.2 seconds to 5.0 on mobile and from 5.0 to 1.8 on desktop. Best Practices rose from 77 to 96.
Before


After


A first screen that asks for one thing. Form and call button above the fold, no slider, membership badge and firm figures in view before scrolling, and one consistent action label across the site. Twelve fixes, each verified live.
A security answer rather than a guess. The malware the client was worried about was ruled out with a scan that actually completed, and the script that triggered the concern was identified as their own click-fraud protection. Nothing needed fixing. What the firm got was a documented answer instead of a standing worry.
Tools & technologies
verified