Big Sky Fitness Fusion

Big Sky Fitness Fusion & Pilates is the only studio in Big Sky, Montana bringing Pilates, barre, spin and group fitness together under one roof. It is owner-operated by Jolene Callahan, who has worked in health and fitness for 28 years and taught Pilates for 18 of them. Three instructors, around eight classes a week, rotating with the season.

The brief was a new website. What we found was a site that had been left to drift.

The error log had grown to 11.3 MB. The site was running PHP 7.4, which stopped receiving security updates in November 2022. The button to book a class pointed at a booking system Jolene had already left, and lived at a URL that read /apparel/ — a page repurposed years earlier without anyone changing its address. A notice about COVID-19 was still sitting on the gymnastics page in 2026.

None of that was the most important thing we found.

Partway through the audit we checked the domain's email authentication. That is not normally part of a website rebuild.

The domain had an SPF record. It had no DKIM and no DMARC, both of which Gmail and Yahoo have required since February 2024. And the SPF record it did have authorised the wrong machine — the web server's address rather than the mail server's.

The control panel reported that record as "Valid." It was. Syntactically it was a perfectly well-formed record. It was also wrong, and a control panel only checks the first of those things. Valid and correct are different words.

The practical effect is that for years, email Jolene sent from her own business address — class updates, replies to enquiries, invitations — was likely being filtered before anyone read it. She had no way of knowing. Nothing tells you when your mail is quietly set aside.

This had nothing to do with her website, and it was worth more to her business than the rebuild. SPF was corrected, DKIM and DMARC published, and all three confirmed in DNS rather than in a dashboard.

That distinction ran through the whole project: we verified outcomes rather than trusting reports. It caught two real failures. The first off-site backup reported success while logging "no remote despatch" six times — it was recording files as uploaded to nowhere. A plugin update reported success while silently leaving the contact form switched off. Both looked fine on the screen that was supposed to tell us.

The redirect map came from the database rather than a crawl, for the same reason. Crawling the old site found 12 addresses. Querying the posts table found 18 — six published pages no crawler could ever reach, because nothing linked to them. Each had accumulated whatever search history it had. A crawl-based migration would have quietly broken all six.

Access inherited from a previous arrangement was audited and tightened.

The new site is five pages on a hand-written classic theme, and it weighs 32 KB.

Most of that reduction came from something invisible. A post-launch audit found the host's plugin injecting 75 KB of block-editor CSS inline on every page load, plus 9 KB of WordPress global styles. The actual page content was 13 KB. Rather than assume none of it was needed, every one of the 405 class names across both blocks was checked against the rendered page. Not one was in use — the site runs a classic theme, and none of it applied.

For a studio whose members are mostly on phones on patchy mountain signal, that is worth more than any keyword work.

The pricing page turned up something else. Laying the rates side by side surfaced what the booking system had obscured: the monthly unlimited membership was $33 cheaper than the ten-class pass. Almost nobody should rationally have been buying the pack. We showed Jolene the arithmetic rather than a recommendation, and she repriced. The two now serve genuinely different customers — the membership pays off from about eight classes a month, the pass suits someone spreading ten classes across a season. That came out of building a pricing page, not conducting a pricing review. Laying numbers out clearly is its own kind of audit.

The rest was unglamorous and necessary: PHP brought to 8.2, thirteen plugins reduced to four, a sitemap cut from 18 entries to 5, WCAG 2.1 AA accessibility with nine fixes, weekly off-site backups confirmed in the upload log, and zero broken links across 23 checked.