How I Got 200+ Visitors in 20 Days: Refactoring a Pure PHP Toolbox & Adding Client-Side Security

Hey DEV community! 👋

About three weeks ago, I launched Site Tools Box (https://sitetoolsbox.com)—a free, no-login toolbox for webmasters. It started as a simple side project, but after a surprising burst of traffic from Hacker News (200+ unique visitors in 20 days), I realized I needed to seriously level up the architecture.

Here is a breakdown of the latest technical updates, what I learned, and how I handled the "Zero-Login" challenge.

🚀 1. The Hybrid Architecture: Speed & Privacy First
When building a toolbox, you face a classic dilemma:

Option A: Do everything on the server (slower, heavy server load, privacy risks).

Option B: Do everything in the browser (faster, but limits complex queries).

I chose a Hybrid Architecture.
For tools like the JSON Formatter, the logic runs 100% in Vanilla JavaScript. Data never leaves the user's machine.
But for Bulk Domain Lookups, browsers can't query WHOIS/RDAP directly due to CORS and protocol limits. So, I built a server-side endpoint using native PHP's curl_multi. This allows parallel querying of up to 30 domains instantly, bypassing the sequential delays of traditional WHOIS lookups.

🔒 2. UI/UX Overhaul: Daily Domains
I recently added a "Daily Domains" feature, curating unregistered .com and .ai domains. I used to display them in clunky cards, but users got visual fatigue quickly.

I refactored the front-end to use a compact, single-row list grouped by date. It drastically reduced cognitive load. To handle the affiliate redirects cleanly, I pass the domain dynamically via URL parameters:
https://www.namecheap.com/domains/registration/results/?domain={domain}
🛡️ 3. The "Zero-Login" Security Challenge (MD5, SHA, Bcrypt)
Many users asked for a Password Generator. But as a developer, I know that generating a password is only half the battle—you need to hash it for storage.

I upgraded the tool to include:

MD5 / SHA-256 / Base64: Processed entirely via crypto-js in the browser.

Bcrypt Hashing: This was the tricky part. Bcrypt requires high CPU work (the "salt rounds"). Running it in JS is possible, but heavy.

The Tech Stack I used:

🎨 4. Avoiding the "Ugly System Alert"
One thing I hate about older web apps is the default alert() when you copy text. I wrote a tiny smooth-copy function that changes the button state to a green "✅ Copied!" and reverts after 1.5 seconds. Small details like this make a tool feel like a modern SaaS.

🚀 What's Next?
I'm currently focusing on SEO optimization and trying to get the tool indexed by more search engines. The recent jump in traffic from Japan (thanks to a tech media mention) has also motivated me to keep the UI language-neutral and fast.

If you want to check it out or give me some feedback on the architecture, here is the link:
Live Tool: https://sitetoolsbox.com
GitHub: https://github.com/kagouhui/site-tools-box

Thanks for reading! Happy coding! 💻