Section 01
Your website positivefxcounseling.com
Your site lives at positivefxcounseling.com. Anyone can visit. It is the front door of your practice.
What is on it
Twenty-nine pages organized into a few clear sections:
- Home. The hero introduction with your photo and brand promise.
- About June. Your bio, training, credentials, and a personal note in your own voice.
- Services overview plus six service pages: Anxiety & Depression, Trauma & PTSD, Grief & Loss, Life Transitions, Veterans & Military, and one for the Kaizen philosophy that runs through your work.
- Six Japanese philosophy pages anchoring your therapeutic approach: Kintsugi, Kaizen, Gaman, Yutori, Oubaitori, and Shikata Ga Nai. Each one is a short essay on the concept.
- Your first session. A walkthrough of what to expect when someone books with you.
- Rates and insurance. Including a Good Faith Estimate page with the 90837 CPT code, per Florida requirements.
- Book. Embedded SimplePractice scheduling widget.
- Contact. A form that routes to your inbox and admin panel.
- FAQ. The questions people ask most often.
- Kaizen Blog. Your articles, filterable by topic.
- Free Resources. Downloadable PDFs and curated reading.
- Crisis page. 988 and 911 information, prominently linked from every header on the site.
- Utility pages. Privacy policy, accessibility statement, intake form, and a custom 404 page.
How it performs
Every page is independently tested every month against Google's PageSpeed Insights. The home page scores essentially perfect across performance, accessibility, best practices, and SEO. Other pages stay in the green band. The exception is the Book page, which is a few points lower because of the third-party SimplePractice widget embedded inside it. That is the trade-off for letting visitors schedule directly without leaving the site.
The whole site runs on Cloudflare's global network. Pages serve from the closest data center to each visitor. No traditional server, no monthly hosting bill aside from your domain registration. Updates push out worldwide in seconds.
The contact form
When someone submits a message, three things happen at once:
- The message is saved in your admin under Messages, where you can read and reply.
- You get an email notification from noreply@positivefxcounseling.com.
- An auto-reply is sent back to the visitor confirming you received their note.
If the notification email ever lands in your Gmail spam folder or Promotions tab, mark it "Not spam" once. Gmail learns and delivers future ones to your inbox.
The Book page
Embeds the SimplePractice scheduling widget so visitors can request a consult without leaving your site. When the Google Calendar connection is active, bookings flow into your calendar automatically.
The Kaizen Blog
Posts have a built-in editor in your admin panel with formatting, links, image upload, topic tags, draft and schedule states, and SEO meta fields.
Auto internal-linking. On save, the blog worker reads your post body and automatically links phrases like "anxiety," "grief," "trauma," "loss of a loved one," "boundaries," and many others to the matching service page. You do not have to insert links manually. Just write naturally, and readers get a path from your article to your service pages.
Auto social-share image. When you publish, the system generates a custom Open Graph image for that post on the fly. When someone shares your article on Facebook, LinkedIn, iMessage, or X, a branded preview shows up with your title and a Positive FX visual.
Auto sitemap update. Your sitemap at positivefxcounseling.com/sitemap.xml is dynamic. Every time a post publishes (or you add a new page), it appears in the sitemap automatically. Google rechecks the sitemap and indexes the new URL within a day or two.
SEO and discoverability
- Dynamic sitemap at positivefxcounseling.com/sitemap.xml. Generated on each request from your live pages and published blog posts. New posts appear automatically.
- Robots.txt allowing search engines, blocking the admin panel from indexing, with the newer content-signals standard so AI crawlers know what they can use your content for.
- Schema.org structured data (JSON-LD) on every major page so Google can show rich previews. Blog posts use BlogPosting schema. Service pages use LocalBusiness / MedicalBusiness schema. The about page uses Person schema with your credentials and license.
- Per-page Open Graph images. Every page has its own custom social-share image (og-home.png, og-about.png, og-anxiety-depression.png, etc.) so links shared on Facebook, LinkedIn, iMessage, or X show the correct branded preview.
- Auto-generated OG images for blog posts. Each blog post gets its own social-share image generated on the fly when someone shares it. You do not have to design one per post.
- Canonical URLs so Google never sees duplicate versions of the same page.
- Google Search Console connected so you can track impressions and rankings.
Quiet polish
A few touches running in the background that you do not need to think about, but that make the site feel cared for:
- Crisis banner at the top of every page with 988 (mental health crisis) and 911 plus a link to more resources. Always visible, never optional.
- Mobile sticky bar with a permanent Book Now button so phone visitors can schedule from anywhere on the page.
- Scroll reveal animations on key sections so content gently fades and slides into view as the visitor scrolls. Subtle, not distracting.
- Custom 404 page if anyone reaches a broken link. On-brand, with paths back to the home page and resources.
- Security headers on every response: HTTPS-only, no framing in other sites, no MIME-sniffing, restricted permissions, and Content Security Policy. These prevent common web attacks.
- Caching strategy. Images are cached forever (they never change), CSS for five minutes (in case we update styles), and the 404 page never caches. This makes pages load instantly on repeat visits.
Section 02
Your admin panel your private dashboard
Your admin lives at admin.positivefxcounseling.com. This is your private dashboard. No one but you can see it.
How to log in
Once you sign in, you stay signed in for seven days on that device and browser. After that you do the email-code step again. There is no password to remember or lose. If anyone tries to access the panel without going through your email, they cannot get in.
The six tabs
Your home base. Six cards on one screen.
Next appointments shows upcoming sessions pulled from your scheduling. New messages shows unread contact-form submissions. License health reads your record from the Florida Department of Health and counts days until renewal. CE progress tracks training hours toward your renewal cycle. PLLC status watches your Sunbiz filing for the May 1 deadline. Recent posts shows your three most recent blog publications.
Calendar view with month navigation. List of upcoming sessions you can click into for details, reschedule, or admin-cancel. Blackout days for vacations or PTO. And the Google Calendar connection card.
Click Connect Google Calendar once. The flow opens Google sign-in, you allow access, and you bounce back to the admin. From then on, bookings made on your website land in your Google Calendar, and your existing entries (SimplePractice, Headway, personal) show up here for context.
Every contact form submission lands here. You can read each, mark read, reply from inside the panel (the reply sends from your noreply address), or delete. There is a separate view for replies you have already sent.
Rich-text editor with bold, italic, headings, bulleted lists, links, and image uploads. Tag posts by topic (Anxiety, Grief, Self-Care, etc.) so the filters on your public blog page work.
Three save modes: Save as draft (no one sees it yet), Publish now (goes live immediately), Schedule (publishes at a future date and time), or Backdate (publish with an earlier date if you are migrating a post).
Each post has an SEO meta-description field. Every save runs HTML sanitization so accidental bad markup can never break the site.
A date dropdown lets you switch the time window: 24 hours, 72 hours, 7, 14, 28, 60, or 90 days.
Site analytics shows page views and unique visitors with a daily bar chart. Active visitors now is live to the second. Conversions counts contact-form submits, booking clicks, and phone taps. Top pages and Traffic sources show what is reading and where they came from. PageSpeed scores cycles through your six representative pages every three seconds.
Drag a photo onto the drop area, or click to choose one. The system auto-resizes for the web, optimizes the file, and replaces your headshot across every page of your website within about twenty minutes.
Previous headshots are kept in a strip on the right. Click any thumbnail to restore. Star a favorite so it does not get auto-cleaned when you cross ten archived versions. Click the small × to manually delete an archived version.
Section 03
Workers running for you ten tiny programs, one job each
"Workers" are tiny programs that live on Cloudflare's network and do specific jobs for your site. They run continuously, scale up automatically if traffic spikes, and cost essentially nothing because Cloudflare's free tier covers everything we use.
Checks the Florida Department of Health's verification page for your LMHC license. Calculates days until renewal. Surfaces the number on your Overview tab so you never get surprised by an expiry.
Tracks your PLLC annual report status from Florida Sunbiz. Florida requires PLLC filings between January and May 1 each year. This worker watches and reminds you.
Stores your booking data, manages blackout days, handles reschedules and cancellations from the admin, and serves available slot data to the public booking page.
Receives form submissions from your public site, validates the data, stores the message, sends you a notification email, and sends an auto-reply confirmation back to the visitor.
Stores all blog posts and drafts. Handles the publishing pipeline including scheduling future posts, auto internal-linking on save, sanitizing HTML, and generating the social-share image for each post.
Stores your profile photo and keeps the last ten versions archived. Serves the live photo to your website with proper caching headers. Handles uploads, restores, and favoriting from the Photo tab.
Connects to Google Analytics 4 with a securely stored OAuth token. Pulls visitor counts, traffic sources, page popularity, and conversion event counts. Caches results so your admin loads fast even when you change the date range.
On the first of each month, asks Google's PageSpeed Insights to test the speed and quality of your six representative pages: Home, About, Blog, Book, First Session, and Anxiety & Depression.
Every day at 4am ET, takes a complete snapshot of every database your admin uses: blog posts, contact messages, scheduling data, license records, AR records, and your profile photo. Keeps thirty days of snapshots.
Connects your Google Calendar via a one-click OAuth flow on the Appointments tab. Pushes booked appointments to your calendar. Pulls existing entries so you can see them in the admin. Includes a "Reconnect" button so you can re-authorize yourself if the connection ever expires.
Each worker does one job. If one ever has a problem, the others keep running. They are small, easy to update individually, and Cloudflare's free tier covers all of them combined. Total monthly cost: zero.
Things that happen automatically
The workers above quietly handle these for you. You do not have to do anything to get them.
- Auto internal-linking in blog postsThe blog worker reads your post body on save and links phrases like "anxiety," "depression," "grief," "trauma," "loss of a loved one," "boundaries," and many others to the matching service page. Just write naturally.
- Auto OG image per blog postEvery published post gets its own custom social-share image generated on the fly when shared.
- Auto sitemap updatesNew posts or pages appear in the sitemap within minutes. Google rechecks and indexes within a day or two.
- Auto contact-form auto-replyVisitors get an immediate confirmation email back from your domain. They know the message arrived.
- Auto blog HTML sanitizationEvery save passes through a sanitizer so malformed markup never reaches the live site.
- Auto photo resizeWhen you upload a headshot, the system resizes and re-encodes it for the web before storing.
- Auto access token refreshOAuth tokens for Google Analytics and Calendar refresh themselves before they expire. You never need to reconnect under normal use.
- Auto headshot archiveEvery new upload archives the previous version. Roll back to any of the last ten anytime.
- Auto monthly performance checksFirst of each month, all six representative pages get tested against PageSpeed Insights.
- Auto daily backup4am ET every day, snapshot of all your data with thirty-day retention.
Section 04
Email and Resend how messages reach inboxes
What is Resend
Resend is a service that sends transactional emails on behalf of your domain. "Transactional" means emails triggered by an action: someone fills out the form and you get a notification, you reply to a client through the admin, the backup worker fails and we get alerted. Resend handles the deliverability and authentication so those messages reach inboxes instead of spam folders.
Why not just Gmail SMTP
Gmail's outgoing limits are low (about 500 emails per day) and sending from your personal Gmail through code is fragile. Resend is built for it: a clean API, proper DKIM and SPF signatures, deliverability monitoring, and a free tier of 100 emails per day, which is more than you will ever need for a single-practitioner practice.
What Resend sends for you
- Contact form notifications to your inbox when a visitor submits the form.
- Auto-reply confirmations back to the visitor.
- Admin replies when you reply to a message from inside the panel.
- Alert emails if the daily backup ever fails (you would be the first to know).
- License renewal reminders if you ever wire that into the worker (currently it just shows on the dashboard, not via email, but the foundation is there).
The DNS records that make it work
Three records sit in your Cloudflare DNS to authenticate your email:
- SPF. Says "Resend is allowed to send mail using positivefxcounseling.com." Without this, mail servers treat your messages as suspicious.
- DKIM. A cryptographic signature that proves your message was not tampered with in transit.
- DMARC. Tells receiving mail servers what to do if a message claiming to be from your domain fails the above checks. Currently set to "quarantine" (drop to spam) instead of "reject" (refuse) so we have a soft window while your sending reputation builds.
A new sending domain takes a few weeks of consistent legitimate use to build a strong reputation. Until then, occasional messages may land in spam. Marking them "Not spam" trains Gmail and Outlook to deliver future ones correctly. After a month of steady use, you will rarely see this happen.
Section 05
Branding kit colors, fonts, logos
Everything you need to design a business card, an Instagram post, a workshop flyer, or anything else under the Positive FX brand. Click any color swatch to copy its hex code. Click any logo to download.
Colors
Click a swatch to copy the hex code.
Typography
Three typefaces, each with a distinct job. All free, all available on Google Fonts.
Logos and marks
Click any thumbnail to download. Every logo file is also hosted on your live site under positivefxcounseling.com/brand/logo/.
Vector (SVG) sources
For print, scaling, or design work, raw SVG files are at positivefxcounseling.com/brand/logo/:
- Stacked Lockup (SVG) and on dark variant
- Horizontal Lockup (SVG) and on dark variant
- Wordmark (SVG) and on dark variant
PNG sizes (for raster needs)
Sized logos for places that need a specific dimension (favicons, app icons, social profile pictures). Available at positivefxcounseling.com/brand/logo/sizes/:
- Mark only: 32, 64, 128, 256, 512, 1024 pixels (PNG). Plus 112, 224, 512 in WebP for web use.
- Full logo: 16, 32, 64, 128, 256, 512, 1024, 2048 pixels (PNG).
Brand voice notes
- Warmth without saccharin. Direct sentences that sound like a thoughtful person, not a clinical brochure.
- Japanese aesthetic as anchor, not decoration. The pillars (Kintsugi, Kaizen, etc.) are real philosophical references, not decoration.
- No em dashes. Use commas, periods, or middle-dots between phrases.
- No emojis. Use small line-icon SVGs when symbols are needed.
- "You" and "your," not "the client." Speak directly to the reader.
Section 06
Taking over completely if and when you decide
You own everything. Steve has access right now because he built and maintains the system for you. If you ever decide to remove him completely, here is the full path through each service. None of this is urgent. It is here so you know exactly what to do and feel in control of your own setup.
Cloudflare (your website, admin, and workers)
Where: dash.cloudflare.com, your account.
What lives here: Your domain, your DNS records, the public website (Pages project named pfx-site), your admin panel (pfx-admin), and all ten workers.
To remove Steve: Manage Account → Members → find his email → Remove. Confirm.
After removal: Generate a new ADMIN_SECRET value on each worker (10 places) and update the matching value on the Pages project. Steve can hand you the exact wrangler commands to do this in one batch, or you can do it through the dashboard one secret at a time.
Google Cloud Platform (the OAuth client behind analytics and calendar)
Where: console.cloud.google.com, project named "Positive FX Analytics."
What lives here: The OAuth Client ID that lets your workers talk to Google Analytics, PageSpeed Insights, and Google Calendar.
To remove Steve: IAM & Admin → IAM → find his email → Remove. Confirm.
After removal: The OAuth Client itself stays valid because it is tied to the project, not to a person. Workers keep working. If you want to be extra cautious, you can regenerate the OAuth Client Secret in Credentials, then update it on the analytics, pagespeed, and calendar-sync workers.
Google Analytics 4
Where: analytics.google.com, Positive FX property.
What lives here: Your visitor stats, conversion events, key event configuration.
To remove Steve: Admin → Account access management (or Property access management) → find his email → Remove.
Google Tag Manager
Where: tagmanager.google.com, container GTM-PBFJSQ7Z.
What lives here: The triggers that tell GA4 when someone submits the contact form, clicks Book, or taps your phone number.
To remove Steve: Admin → User Management → find his email → Remove.
Google Search Console
Where: search.google.com/search-console, positivefxcounseling.com property.
What lives here: Search performance data, indexing status, sitemap submissions.
To remove Steve: Settings → Users and permissions → find his email → Remove access.
Resend (your email sending account)
Where: resend.com.
What lives here: The API key used by your workers to send email through your domain.
To remove Steve: Settings → Team → find his email → Remove. Then rotate the API key (API Keys → revoke old → create new) and update it on the contact-form and pfx-backup workers.
Your domain (positivefxcounseling.com)
Where: Whoever currently registers your domain (likely Squarespace Domains or a similar registrar, the original site lived on Squarespace before we migrated).
What to do: Confirm the registration is under your name and your email. Make sure you have the login credentials. The domain renewal is yearly; missing it would take the site offline, so it is worth setting up auto-renew with a card you own.
If you want Cloudflare to register it instead: Cloudflare Registrar charges wholesale rates with no markup, which is the cheapest option. The transfer takes a week and requires unlocking the domain at the old registrar.
SimplePractice and Headway
These are entirely your accounts. Steve has no access to either and never has. Login at simplepractice.com and headway.co respectively.
Text Steve and say "let's transfer everything to me." He will walk you through it in one sitting, hand off all credentials, and the whole site keeps running through the transition. Nothing breaks. It is meant to be smooth whenever you decide.
Section 07
If something feels off what to do
If a card on the dashboard stays on "Loading" forever, if you cannot sign in, if an email never arrives, or if you spot a typo on the site, text Steve. He built it and will fix it.
Nothing on the admin can be broken by clicking the wrong thing. The destructive actions all ask "are you sure?" first. The daily backups mean anything accidentally deleted can be brought back.
None of the analytics or messaging systems track or store client health information. The website knows when people visit, which pages they read, and whether they submitted the contact form. It does not know who they are individually, what they wrote in the form (other than the message you choose to read in the admin), or anything about why they reached out. HIPAA-sensitive work happens entirely inside SimplePractice and Headway, which are separate from this site.
Quick reference URLs
- Your public site: positivefxcounseling.com
- Your admin panel: admin.positivefxcounseling.com
- This guide: admin.positivefxcounseling.com/guide
- Google Analytics: analytics.google.com
- Google Tag Manager: tagmanager.google.com
- Google Search Console: search.google.com/search-console
- Cloudflare dashboard: dash.cloudflare.com
- Resend dashboard: resend.com