Case study · Nairobi, KenyaKenya Tanzania Safari

Niko’s brief was short and clear: drive more traffic, grow enquiries and impressions, and make the site very secure. Kenya and Tanzania safaris are one of the most crowded searches in African travel. Being found meant building pages around the questions travellers actually ask, not just a list of tours. Being trusted meant a form that real guests find easy and bots cannot abuse, and enquiries that reach the sales team rather than a spam folder.

We started with structure. The site is built around how travellers search: hubs for Kenya, Tanzania and the two combined, nine park pages, six safari style pages from honeymoons to the Great Migration, and planning guides on visas, health and packing. Pages carry FAQ and safari schema for search engines, and each one links into the itineraries it relates to, so authority flows to the pages that convert. The design follows the same discipline: a centred, image-free header, generous space and, at Niko’s request, no prices on any safari card, so every conversation starts with the trip rather than a number. Then we made enquiring effortless. One form now serves the pop-up, the Contact page and the Safari Planner, replacing a six-step wizard at the request of Niko and his sales team. It pre-selects the destination from the page the guest is reading, and floating Enquire and WhatsApp buttons follow visitors on every page. Each enquiry gets its own reference, such as KTS-26-0142, arrives as a personal email in the guest’s name, and appears in an Enquiry Dashboard that shows which pages, markets and channels are sending enquiries, including AI assistants, and tracks every one from New to Booked. Security was built into the code rather than bolted on with plugins. The theme is custom, with no page builder. Every enquiry passes five checks before it is accepted: a signed token, a timing check that drops anything submitted in under three seconds, two hidden honeypot fields, rate limits per address and per email, and strict validation that confirms the email domain can actually receive mail. Links are stripped from messages, bots are shown a convincing thank-you so they learn nothing, a consent box links every enquiry to the privacy policy, and the dashboard and its exports are open only to the team.