A small feature request uncovered a €1,479 order that could check out at €12.99 — we fixed the revenue leaks first, then delivered more than was asked

Sector: Managed IT and datacenter services, 20+ years in business
Ask: Let customers power their virtual servers on and off from their account
Found: Pricing defects, discount errors and open security routes in the web shop
Delivered: Correct pricing, end-to-end buy-to-provision, a security sweep, new sales features — then a full platform rebuild

Context

A long-established Romanian managed-IT and datacenter provider sells virtual servers online through a WordPress/WooCommerce shop built by a previous supplier.

Challenge

The request was small: power controls in the customer account. Before building it, we reviewed the code.

What the review found

The price shown to the customer was not always the price charged
Two order steps overwrote each other, so a 15% long-term discount was lost on stored orders
24- and 36-month terms could not be selected at all
Prices meant to stay hidden leaked through emails and the API
A second checkout path would let a configured server worth €1,479 check out at €12.99

Approach — phase 1 (fix before build)

We made the server the only authority on price, closed both leak paths, and only then built the requested feature on a sound base.

What we delivered in phase 1

Correct pricing, calculated on the server
Buy → pay → provision end to end: a paid order now creates and starts the virtual server
The requested power controls (start, stop, restart), protected so a customer can act only on their own server
A security sweep: unauthenticated routes closed, an admin bypass removed, critical plugin vulnerabilities patched, automatic secret and dependency scanning added
Sales features: direct purchase instead of “request a quote”, curated server packages on the homepage, a clear order summary, long-term discount terms that work

Phase 2

The client then chose a full rebuild of the platform, delivered to user-acceptance testing in nine weeks.

Results

Revenue leaks closed before they were exploited; demo to the client within ten days of the first review; the client continued with a full rebuild.

How we measure

What we learned

The cheapest feature is the one built on correct foundations. Reviewing before building turned a small request into protected revenue.