Web Design Agency Japan — Bilingual Web Development, Tokyo

Ninety Percent of Web Work Is the Guts

Your Japan website probably looks fine. The question is what's happening underneath — build pipelines, security, hosting, SEO, performance monitoring. That's where most corporate sites in Japan fall apart, and it's where we spend most of our time.

eSolia builds and operates websites for businesses in Japan. Sometimes that means a ground-up build. More often, it means inheriting an existing site — one that headquarters launched years ago, that a local agency has been patching, that nobody fully understands anymore — and making it fast, secure, properly localized, and running on infrastructure that doesn't need babysitting.

We run multiple production sites on SvelteKit with Svelte 5 — esolia.co.jp plus our product line (Pulse, Periodic, Courier, Nexus). SvelteKit gives us server-side rendering where we need it (language detection, API routes) and static prerendering for everything else, deployed to Cloudflare Workers at the edge. The result: sub-second page loads globally, TypeScript end-to-end, and a build pipeline that catches problems before they ship.

We also maintain production sites on Hugo, Lume, Next.js, and Hono, and handle WordPress on WP Engine and enterprise AEM when client requirements demand it. But SvelteKit is where we've invested deepest, and it's what we recommend for new projects.

Web Security Operations

A website isn't secure because you set it up carefully once. It's secure because someone is actively watching and tuning. This is the work most agencies skip — and the work that matters most after launch.

Edge security with Cloudflare WAF. We write and maintain custom firewall rules that block scanner probes, credential-stuffing bots, and exploit attempts before they reach your application. Our own production sites run multi-layered rules covering known scanner signatures, API endpoint protection, and suspicious request patterns. These rules get updated as attack patterns evolve — not set-and-forget.

Rate limiting at two levels. Cloudflare's edge rate limiting catches bulk attacks (brute-force login attempts, API abuse). Behind that, application-level rate limiting with KV-backed counters handles more granular throttling — per-endpoint, per-IP, with configurable windows. Contact forms, API routes, and authentication endpoints each get tuned limits.

Bot management. Legitimate crawlers (Googlebot, Bingbot, GPTBot) get through. Scanner bots hitting /wp-admin, /.env, and /api/debug get blocked. We maintain an active blocklist and review firewall logs regularly.

Security headers and CSP. Every site ships with HSTS, Content Security Policy, X-Frame-Options, Referrer-Policy, and Permissions-Policy configured for the specific application. These aren't boilerplate defaults — they're tuned per site.

Search Performance Management

SEO isn't a one-time setup. We treat search performance as an ongoing operational discipline — the same way we treat security.

Structured data (JSON-LD). Every page gets machine-readable schema markup: Organization, Service, BreadcrumbList, Article. This drives rich results in Google and Bing — the enhanced listings with breadcrumbs, service descriptions, and organization info that stand out in search results.

Search performance monitoring. We pull data from Google Search Console and Bing Webmaster Tools into a purpose-built analytics pipeline. Query performance, content gaps, crawl errors, and 404s from search traffic are tracked and reviewed regularly. When a page is getting impressions but no clicks, we rewrite the meta title and description with the exact phrases people are searching for.

Content gap analysis. Search data reveals what people are looking for that your site doesn't adequately cover. We identify these gaps, prioritize by search volume and business relevance, and create or strengthen content to fill them.

IndexNow on every deploy. When content changes ship, search engines are notified within minutes — not days. Our CI/CD pipeline triggers IndexNow submissions to Bing and Yandex automatically on every push to production.

Build-time quality auditing. Title lengths, description lengths, broken internal links, and trailing slashes are checked automatically at build time. Problems get caught before they reach production, not after a search engine reports them.

Core Web Vitals as ongoing work. Page speed and interaction metrics directly affect search rankings. We monitor LCP, INP, and CLS continuously and optimize as framework updates, browser changes, and content additions affect scores. This isn't a checkbox — it's a recurring maintenance item.

SEO for the Japanese Market

Japanese search behavior doesn't map onto English patterns. Users search in mixed katakana, kanji, and romaji. Query intent differs by language — the same person might search in English at work and Japanese at home. We handle bilingual keyword research, proper hreflang implementation, canonical URLs across language variants, and Google Business Profile optimization for local visibility.

What We Build Into Every Site

Techniques we use on esolia.co.jp and ship to client sites:

• Progressive image loading with blur-up placeholders
• Critical CSS inlining and edge-optimized image resizing (Cloudflare Image Resizing)
• Full-text bilingual search with Japanese tokenization
• Structured data (Schema.org JSON-LD) for rich search results
• Semantic HTML and heading hierarchy for crawlability
• XML sitemaps, canonical URLs, and hreflang tags for bilingual SEO
• Open Graph and Twitter Card metadata for social sharing
• Privacy-respecting analytics (Fathom — no cookie banners needed)
• Automated build pipelines: lint, typecheck, test, build, deploy on every push

Hosting and Infrastructure

We deploy to Cloudflare Workers (Pro plan) as our primary platform — edge compute in 300+ cities, integrated DNS, Image Resizing, D1 database, and the WAF/rate limiting described above. We also maintain production sites on Netlify and Deno Deploy, and run WordPress on WP Engine when the client requires it.

Aspect	Edge-Deployed (SvelteKit + Workers)	Traditional CMS
Performance	Sub-second globally — static + edge compute	Server-rendered, single origin
Security	WAF + rate limiting + minimal attack surface	Plugin updates, database patching
Infrastructure	CDN, no servers to manage	Servers, databases, PHP runtime
Backup & Recovery	Git repository = complete history	Database dumps, file backups
Deployment	Automated on every push	Manual or fragile CI/CD
Maintenance	Dependency updates, framework upgrades	Ongoing plugin/theme/core updates

Localization That Builds Trust

Companies regularly underestimate what it takes to localize a website for Japan. Machine translation produces content that's technically comprehensible but fails to build trust with Japanese business audiences. We've cleaned up enterprise AEM projects where machine-translated content had to be completely reworked because it read as robotic and unprofessional.

Our bilingual team handles the full scope:

• Cultural UX adaptation — navigation, layout, and interaction patterns suited to Japanese expectations
• Content that reads naturally — adapted for Japanese business communication, not translated word-for-word
• Legal compliance — Japan's Personal Information Protection Act, GDPR where applicable, accessibility standards

What Ongoing Operations Look Like

After launch, we don't disappear. A typical month includes:

• Dependency updates and security patches across the framework and toolchain
• WAF rule review — checking firewall logs, updating scanner patterns, tuning rate limits
• Search performance review — checking GSC/Bing data, addressing content gaps, rewriting underperforming meta
• Core Web Vitals check — verifying scores haven't regressed after content or framework changes
• Content pipeline maintenance — build system health, image optimization, search index updates
• Framework upgrades as SvelteKit, Cloudflare Workers, and related tools release new versions

This is what "web operations" means in practice. The site keeps getting faster, more secure, and better indexed — not just maintained at the level it launched.

Portfolio

See our approach on our own products — Pulse, Periodic, Courier — built with the same stack we use for client projects. Full portfolio available on request.

Related Pages