Rebuilding We Buy Any Padel’s storefront and hardening the platform

A padel marketplace that needed more than a new coat of paint

We Buy Any Padel is a UK marketplace for buying and selling padel rackets, with selling gated behind login. When we started, the brand did not read as a marketplace people would trust with a transaction, and the backend behind it had no real caching strategy, thin rate limiting, and auth tokens sitting in localStorage where any script running on the page could read them. A redesign on its own would have fixed how the site looked and left the actual risk untouched. This project was always going to need both halves done properly: the part visitors see and the part they never think about.

Court Noir: the e-commerce website redesign

We designed a new front end internally called Court Noir: a near-black base, a single royal blue accent (#3A5EF9), real product photography instead of stock imagery, and a video hero. Rather than replace the Laravel backend, we integrated the new design as a v2 frontend running alongside the existing v1, so the marketplace could move to the new look without a ground-up rebuild. That approach let the redesign ship without freezing the rest of the platform while the backend work was still in progress.

Laravel performance with Redis

The backend work started with Redis, wired through Docker to handle cache, sessions and queues. Config and product data are now cached with tags, and those tags are invalidated automatically by model observers whenever the underlying data changes, so cached pages never go stale without anyone noticing. This is the part of an e-commerce rebuild that customers never see and that determines whether the site holds up once traffic actually arrives. A marketplace that slows down under load loses buyers before they ever see a listing, so this was never a nice to have.

Rate limiting that does more than block traffic

We rebuilt rate limiting on Redis Lua scripts, with named limiters set per endpoint group rather than one blanket rule for the whole site. When a limit is hit, the response is a clean JSON 429 rather than a generic error page, so the front end can handle it properly instead of showing a broken state to a real buyer or seller. Different endpoints carry different risk, so login attempts, listing searches and checkout each get limits sized to how they are actually used, not one number applied everywhere.

Secure session handling

Selling on the platform requires login, which means session security is not a minor detail. Auth tokens had been sitting in localStorage, readable by any script that got onto the page. We moved them into HttpOnly cookies with SameSite=Strict, set through middleware, so a cross-site scripting attempt cannot walk away with a session token. It is unglamorous work, but it is the difference between a marketplace that looks secure and one that actually is, and it matters more here than on a typical brochure site because real listings and real money move through these sessions.

Getting sellers ready before launch

Alongside the platform work, we built a standalone pre-signup page for early access, with a countdown and an intent form to start capturing interest before the new front end went live. It kept momentum building while the harder backend work was still underway, and it meant the redesign launched to people who were already waiting for it rather than to a cold audience.