Skip to content
POLARGATE
Hospitality: 4-star all-inclusive resort hotel, Caribbean

A resort website that Google, social scrapers and AI assistants can actually read

Polargate turned the bilingual website of a 349-room Caribbean resort into a fully static, hardened site with structured data for AI search, and keeps it under a monthly care retainer with an automated audit on the first day of every month.

Visit the live site
Home page of hotelmarien.com: the Marien Puerto Plata logo and menu over an aerial view of the resort's lagoon pools, blue sun loungers, palm trees and hotel buildings.
hotelmarien.com
22
public routes prerendered as static HTML
2
languages served with bidirectional hreflang (ES/EN)
98 KB
mobile hero image, down from about 288 KB
136 KB
social preview image, down from 1.74 MB
33
confirmed findings fixed in the August 2026 audit cycle
3
P0 issues closed and verified live in June 2026

The problem

The site looked right and read well, but crawlers saw something else. Content rendered in the browser, so every subpage handed Google, social scrapers and AI assistants the homepage title, canonical and Open Graph tags. Unknown URLs answered HTTP 200 instead of a real 404. The Content-Security-Policy sat in a meta tag, where the browser ignores the clickjacking directive. Structured data published an aggregate rating that could not be traced to any real source. And the backend still depended on the no-code platform the site had been scaffolded on.

What we built

Polargate audited the site black-box and white-box across four pillars (security, SEO, structure and AI positioning) and fixed it in phases. Real HTTP security headers first, then a genuine 404 page and a static head per route, then a full move off the no-code platform onto Polargate's own Supabase project and a static build with vite-react-ssg. All 22 public routes now ship complete HTML in Spanish and English, with schema.org graphs generated from the translation files, llms.txt and llms-full.txt, and a robots policy that lets AI search crawlers in.

The outcome

The three P0 findings from June 2026 were closed and verified in production, and the August cycle resolved 33 confirmed findings. The site now serves full HTML per route and per language to Google, social scrapers and AI assistants, runs on infrastructure Polargate controls end to end, and loads a mobile hero image of roughly 98 KB instead of 288 KB. A scheduled audit reviews site and repository on the first day of each month and reports; it never deploys by itself. Polargate claims no traffic or booking figures here: commercial results depend on far more than a website.

Stack

  • React
  • Vite
  • TypeScript
  • Tailwind CSS
  • shadcn/ui
  • React Router
  • TanStack Query
  • Supabase
  • PostgreSQL
  • Deno
  • Resend
  • Vercel
  • Node.js
  • GA4
  • Search Console
  • GitHub
  • Claude
  • OpenAI
hotelmarien.com

The starting point

Hotel Marien is a 4-star all-inclusive resort with 349 rooms in Puerto Plata, on the north coast of the Dominican Republic. Polargate designed and built its bilingual website, delivered in March 2026, and has run it on a monthly care retainer since. The build included the Paraty Tech booking engine, technical and content SEO, security hardening, hosting and backups, and analytics setup with GA4, Tag Manager and Search Console. Since July 2026 the hotel also runs a branded guest app on Estevano, Polargate's own hotel platform, at marien.estevano.com: an AI concierge, restaurant and spa bookings, room service and incident reporting, with a reception QR poster generated from the hotel's own brand tokens.

What the audit found

In June 2026 Polargate ran a black-box and white-box audit across four pillars: security, SEO, structure and AI positioning.

  • Unknown URLs returned HTTP 200 instead of a real 404, so search engines treated typos and dead links as valid pages.
  • The Content-Security-Policy lived in a meta tag, which meant the frame-ancestors directive never applied and clickjacking protection was inert.
  • Every subpage served the homepage title, canonical and Open Graph tags, because the content was rendered client side.
  • Structured data carried an aggregate rating that could not be verified against a real source.

Three of those were P0. All three were closed and verified in production the same month.

What we rebuilt

  • Real HTTP security headers: CSP with frame-ancestors none, X-Frame-Options DENY, HSTS with preload, nosniff, Referrer-Policy and Permissions-Policy.
  • A static head per route first, then a full static build with vite-react-ssg on Vite, React and TypeScript, with Tailwind and shadcn/ui in the interface. All 22 public routes now ship complete HTML in Spanish and English, with bidirectional hreflang and a single route source in code.
  • A full exit from the no-code platform onto Polargate's own Supabase project: the contact form as a Deno edge function with CORS restricted to the hotel domain, a server-side honeypot, forced RLS on the messages table, and delivery through Resend from a verified sending subdomain.
  • Schema.org graphs generated from the i18n files: Hotel, five HotelRoom nodes, five Restaurant nodes, the spa, FAQPage, BreadcrumbList and a WebPage node with dateModified and speakable. Plus llms.txt and llms-full.txt, and a robots policy that welcomes AI search crawlers and blocks bandwidth scrapers.
  • The unverifiable rating replaced with the hotel's real TripAdvisor score and two visible guest reviews, linked to its verified TripAdvisor, Booking and Google Maps profiles.

How it runs now

The site is hosted on Vercel with DNS in Route 53, and analytics run through GA4, Tag Manager and Search Console behind consent. Performance work brought the mobile hero image down from about 288 KB to about 98 KB with srcset, and the social preview image from 1.74 MB to 136 KB. On the first day of every month, a scheduled Claude routine reviews the live site and the repository across AI search, Core Web Vitals, breakage and security, verifies each finding adversarially, and reports. It deploys nothing on its own. Polargate reviews the findings, applies the fixes, and sends the hotel's management a maintenance report in plain language.

Build →Grow →Care →Hotels and hospitality →
FAQ

Questions about this project

How long did this take?
Polargate delivered the website in March 2026. The June 2026 remediation was audited and shipped in three phases: security headers and per-route heads went live the day of the audit, and the structured data and hardened contact form a week later. The August 2026 cycle, which moved the site off the no-code platform and rebuilt it as a static site, ran as one sprint. After that it is a monthly rhythm.
Can you do this with our booking engine?
Yes. Marien's site works with the Paraty Tech booking engine the hotel already used, and Polargate did not replace it. The approach carries over to other engines: the website stays the fast, indexable layer that answers questions and hands over qualified traffic, and we keep the handover clean so consent, analytics and tracking survive the jump into the engine.
Our site was built on a no-code platform. Can it be rescued, or do we start over?
Usually it can be rescued. With Marien, Polargate kept the design and the code, removed the platform's tooling, moved the database and functions to a Supabase project the client owns, switched the build to static generation, and repointed the environment variables by API. The site stayed live throughout. Starting over only makes sense when the underlying product or content has to change too.
Will this make our hotel show up in ChatGPT and Google's AI answers?
Nobody can guarantee that, and Polargate does not. What we can do is remove the reasons an assistant would skip you: complete HTML per route instead of an empty shell, one clear answer under each heading, structured data that matches the visible text, llms.txt, and a robots policy that lets the search and answer crawlers in. Citation still depends on authority and freshness, which take time.
What does the monthly maintenance actually include?
On the first of each month an automated audit reviews the live site and the repository across AI search, Core Web Vitals, broken things and security, and verifies each finding before reporting it. Polargate then decides what to fix, applies it, verifies it in production, and sends the hotel a report in plain language. Content requests, such as re-editing photos, are handled in the same cycle. The audit never deploys on its own.

Related work

INITIATE

Start the engine

Tell us what you are building in a few short questions. A senior engineer answers in writing within 48 business hours, with a first take on scope, timeline and price.

Start your project Talk to us