Performance Marketing / Web Development
Industry: Financial Services / Insurance
~8,350
lines of custom PHP/MySQL code written
In short
This case study documents how Arcetis built a fully custom, compliance-aware web platform and lead-generation architecture for a licensed estate-planning and insurance firm. Because Meta classifies most financial-services ads in this market under a restricted "Financial Products & Services" special category that strips out detailed targeting, the strategy leads with estate-planning offers — which are not swept into that classification — to preserve full targeting, then funnels qualified leads into the firm's higher-value insurance and wealth-planning services off-platform. The website (vanilla PHP 8 / MySQL, ~8,350 lines across 35 files) and its native Meta webhook integration are live in production today; the campaign's cost-per-lead and volume figures are documented planning projections, not measured results.
The client is a licensed wealth-management, estate-planning, and life-insurance practice holding an active regulator-issued corporate insurance license. It engaged Arcetis to replace an outdated web presence with a fully custom platform and to design a lead-generation strategy capable of running on Meta despite tightly restricted advertising rules for financial products. Arcetis built a vanilla PHP 8 and MySQL web application from scratch — roughly 8,350 lines of code across 35 files, with no external framework — including a full admin dashboard, a blog and FAQ content-management system, and a native Meta Graph API integration that captures Lead Ads submissions and Messenger conversations directly into a CRM-style pipeline. In parallel, Arcetis authored a compliance-driven advertising architecture: because Meta strips most audience targeting from ads it classifies as financial services, the strategy leads with estate-planning offers, which are not subject to that restriction, and moves higher-value insurance and wealth conversations off-platform.
Two separate regulatory realities converged on this project, and both had to be solved in the architecture rather than papered over with copywriting. The first was Meta's advertising policy. Any ad that Meta's automated classifier associates with financial products — investments, loans, insurance, wealth management — gets placed into a restricted "Financial Products & Services" Special Ad Category. Ads in that category lose detailed age, gender, geographic radius, interest, and lookalike-audience targeting, which makes it materially harder and more expensive to reach a specific audience such as women 35 and older in the firm's metro market, the exact demographic the firm's estate-planning and wealth services are built around. A campaign that spoke directly about insurance or investment products from the first click would have been forced into this restricted category regardless of intent. The second was the regulatory environment for the firm itself. Under the regulator's title-protection rules, only individuals holding the appropriate credential may use titles such as "Financial Advisor" or "Financial Planner" in public-facing materials. Mid-project, this required repositioning the website's language away from "financial advisory" framing toward "business consulting" framing — a change that touched page copy, service descriptions, and calls to action across the site, not just a single page. A third, more operational obstacle compounded both of these: Meta's business verification process rejected the account twice, which meant any strategy dependent on verified business features (certain ad formats and account capabilities require verification) was not viable on the original timeline. This pushed the strategy further toward the estate-planning lane, since that lane does not require business verification to launch. None of these three problems could be solved in isolation. Fixing the Meta targeting problem by simply renaming an insurance ad "estate planning" without a genuine estate-planning offer behind it would have been a fragile, likely short-lived workaround. Fixing the title-protection language problem by relabeling titles without also restructuring what the site's pages actually promised would have left a mismatch between marketing claims and licensed scope. And neither fix mattered if the account itself couldn't get a campaign live at all because of repeated business verification rejections. Solving all three simultaneously meant the website's content architecture, the ad targeting strategy, and the backend lead-routing logic all had to be designed together, with compliance treated as a targeting variable rather than an afterthought bolted on after the strategy was set.
Arcetis served as the sole technology and strategy partner for this engagement, owning both the technical build and the compliance-driven campaign architecture end to end. Arcetis designed and wrote the full PHP/MySQL application, including the admin dashboard, the Meta Graph API webhook integration, and the CI/CD deployment pipeline, and managed deployment through to a confirmed live production state. Arcetis also translated the regulator's title-protection requirements into concrete copy and information-architecture decisions across the site, auditing every page where "financial advisory" language previously appeared. Separately, Arcetis authored the advertising compliance framework — the banned-word list, the audience-targeting rationale, and the off-platform upsell funnel — as planning documentation ready for campaign launch. Media buying and live campaign management sit outside the scope delivered to date; this case study reflects the build and architecture Arcetis was directly responsible for, not third-party ad spend or results, which have not yet been generated.
Arcetis built the client's website from scratch in vanilla PHP 8 with PDO and MySQL, deliberately avoiding a heavyweight framework to keep the codebase lean and fully owned by the client. The result is roughly 8,350 lines of code across 35 files, developed over 19 commits spanning ~10 weeks of iterative work. Deployment runs through a GitHub Actions pipeline that performs an SSH-based pull to the production VPS followed by an automated HTTP smoke test, and the site's live status was confirmed through a dedicated "Sync: VPS production state to GitHub" commit reconciling the deployed server with the repository.
Arcetis delivered a complete internal admin dashboard so the client's team can run the business without touching code. The dashboard includes a stat-card overview, a bookings manager, a contact-form inbox, a blog content-management system, an FAQ manager, a services CMS, and general and email settings screens. Every operational surface the firm needs — publishing content, managing incoming appointment requests, editing service descriptions — lives in one authenticated interface built specifically around how this business operates, rather than adapted from a generic off-the-shelf CMS.
Arcetis built a native integration with Facebook Graph API v19 that receives Lead Ads submissions and Messenger conversations directly via webhook, with HMAC-SHA256 signature verification and the standard webhook challenge/verify-token handshake protecting every inbound payload. Captured leads flow into a dedicated Meta Leads inbox with a status pipeline — new, contacted, converted, disqualified — while Messenger conversations land in a separate Meta Messages inbox. This gives the client CRM-style lead tracking without depending on a third-party CRM subscription.
Beyond standard application security — CSRF tokens on every state-changing form, rate limiting, bcrypt-hashed authentication with session regeneration, and a full Content Security Policy and security-header configuration — Arcetis handled a mid-project regulatory shift: repositioning site language from "financial advisory" to "business consulting" phrasing to comply with the regulator's title-protection rules restricting who may use "Financial Advisor" or "Financial Planner" titles. This required auditing and rewriting copy across the site's pages, not just a disclaimer patch.
Arcetis built the site's discoverability layer to serve both traditional search engines and AI answer engines: a dynamic sitemap generator, a configured robots.txt, and an llms.txt file specifically intended to help AI crawlers understand and cite the site's content. This was paired with a WebP image-conversion pipeline for performance and a set of dedicated SEO landing pages targeting the firm's core service areas.
Arcetis authored the full advertising compliance framework the client will use to launch on Meta: an explicit banned-word list barring terms like "investments," "insurance," "wealth," "AUM," "loans," and tax-savings claims from cold ads and landing pages, while permitting wills, trusts, and guardianship language; a cross-asset review step required before every campaign launch; and a documented audience-targeting rationale and off-platform upsell funnel. This is planning and architecture work, delivered and ready for launch, not a record of a live campaign.
On the technical side, Arcetis built the entire application as a vanilla PHP 8 codebase using PDO for all MySQL access — no framework, no ORM, just direct, auditable code across roughly 8,350 lines and 35 files. The build proceeded over 19 commits between late March and early June 2026, a genuinely iterative ~10-week process rather than a single large drop. The admin side covers a stat-card overview, bookings management, a contact-form inbox, a blog CMS, an FAQ manager, a services CMS, and both general and email settings. Deployment runs on GitHub Actions: pushes trigger an SSH-based pull to the production VPS followed by an automated HTTP smoke test, and the deployment's authenticity is independently corroborated by a "Sync: VPS production state to GitHub" commit that reconciles server state back into the repository — strong evidence this is a genuinely live, operating system rather than a static demo. The standout integration is a native Facebook Graph API v19 webhook: it verifies the initial challenge/verify-token handshake required to register a webhook, validates every subsequent payload with an HMAC-SHA256 signature check, and routes Lead Ads submissions and Messenger messages into two purpose-built inboxes — a Meta Leads inbox with a new-to-contacted-to-converted/disqualified status pipeline, and a separate Meta Messages inbox. Security throughout includes CSRF tokens, rate limiting, bcrypt password hashing with session regeneration on login, and a full CSP and security-header configuration. The campaign architecture layered on top of this platform had to solve a targeting problem before it could solve a growth problem. Meta routes any ad it associates with financial products, loans, insurance, or wealth management into a restricted "Financial Products & Services" Special Ad Category, which strips out detailed age, gender, geography, interest, and lookalike targeting — exactly the controls needed to reach women 35+ in that metro market efficiently. Because estate planning (wills, trusts, guardianship) is not automatically classified into that restricted category, the documented strategy leads cold traffic with estate-planning messaging to preserve full targeting capability, rather than opening with insurance or investment language that would immediately trigger the restriction. Estate-planning leads are deliberately not sent to a dedicated landing page; they're routed off-platform to phone, SMS, and email follow-up specifically to avoid Meta's fraud and financial-services auto-classifier flagging the funnel. From there, the documented backend sequence moves a lead through a portfolio review, then into insurance, then into corporate strategy and funding conversations — the stages where planning materials estimate the firm's real per-client value of $20,000-$50,000 and an approximate $100,000 lifetime value actually materializes, while the cold ad itself stays free of any financial-product language. An explicit banned-word list (no "investments," "insurance," "wealth," "AUM," "loans," or tax-savings claims in cold ads or landing pages; wills/trusts/guardianship language permitted) and a required cross-asset review before every launch were documented as the compliance guardrails for this funnel. Separately, Meta's business verification process was rejected twice for this account, which is part of why the estate-planning lane was chosen: it doesn't require that verification step to go live, unlike some other ad formats and features.
The Meta integration doesn't just receive data — it authenticates it. Every webhook registration completes Meta's challenge/verify-token handshake, and every subsequent Lead Ads or Messenger payload is checked against an HMAC-SHA256 signature before it's trusted and written to the database. This closes off a common integration weak point: accepting unverified webhook traffic that could be spoofed to inject fake leads or messages into the pipeline.
Deployment runs through GitHub Actions: a push triggers an SSH-based pull on the production VPS, followed by an automated HTTP smoke test before the deploy is considered successful. The pipeline's real-world operation is independently confirmed by a "Sync: VPS production state to GitHub" commit, which reconciles the live server back into version control — a strong, verifiable signal that this is an actively maintained production system, not a one-time deployment.
Rather than piping leads into an external CRM subscription, Arcetis built the pipeline directly into the application: a Meta Leads inbox carries each lead through a new-to-contacted-to-converted/disqualified status pipeline, while a separate Meta Messages inbox handles Messenger conversations. This keeps lead data, contact history, and status changes in a system the client fully owns and controls end to end, with no recurring third-party licensing cost and no data leaving the client's own database.
Admin authentication uses bcrypt password hashing with session regeneration on login to prevent session fixation, layered under CSRF tokens on state-changing forms, rate limiting against brute-force and abuse, and a full Content Security Policy plus standard security headers. These are the fundamentals of a genuinely production-hardened PHP application, implemented directly in code rather than inherited as defaults from a third-party framework or plugin.
Alongside a conventional sitemap generator and robots.txt, the site ships an llms.txt file — a discoverability layer aimed specifically at AI answer engines and crawlers, not just traditional search bots. Paired with WebP image conversion and dedicated SEO landing pages, this positions the site to be found and correctly represented across both classic search and the newer generation of AI-driven discovery tools.
lines of custom PHP/MySQL code written
production commits across ~10 weeks of iterative development
Technology used
Key learnings
This engagement is a reminder that in regulated verticals, compliance isn't a constraint layered on top of a growth strategy — it can become the growth strategy. Rather than fighting Meta's restricted financial-services classification with workarounds, the winning move was to reframe the entry point of the funnel entirely: lead with a message (estate planning) that was never subject to the restriction in the first place, and let the backend, not the ad, carry the regulated conversation. That reframing only works if it's backed by real operational discipline — an explicit banned-word list, a mandatory cross-asset review before launch, and a deliberate choice not to build a dedicated landing page for the entry offer, specifically to avoid tripping an automated fraud/financial-services classifier. The title-protection issue reinforced the same lesson from the regulatory side: "financial advisory" language isn't just marketing copy, it's a protected term, and treating it as a site-wide architecture decision (rather than a single disclaimer) was the only durable fix. The clearest technical takeaway is that owning the lead pipeline end-to-end — a native, signature-verified Meta webhook feeding a purpose-built CRM-style inbox — gives a regulated business far more control over compliance-sensitive data than routing everything through third-party marketing tools. The campaign itself hasn't run yet, but the infrastructure and the compliance logic it depends on are both real, tested, and already live.
Because Meta automatically routes ads it associates with insurance, investments, loans, or wealth management into a restricted "Financial Products & Services" Special Ad Category, which strips out detailed age, gender, geographic, interest, and lookalike targeting. Estate-planning content — wills, trusts, guardianship — is not automatically classified into that restricted category, so leading with it preserves full targeting capability while still reaching the same audience the firm's insurance and wealth services ultimately serve. Higher-value conversations move off-platform later in the funnel.
It's a real, deployed production website. The build spans roughly 8,350 lines of vanilla PHP 8 and MySQL code across 35 files, developed over 19 commits across about 10 weeks. Its live status is independently corroborated by a "Sync: VPS production state to GitHub" commit that reconciles the production server's actual state back into the code repository — not something that exists for a static mockup.
No. Those figures — a projected $18-$45 cost per lead and a projected 67-165 leads per month — come from internal campaign planning documentation and are explicitly labeled as targets, not guarantees. No paid Meta campaign has been launched against this strategy yet, so there is no real spend, lead, or conversion data to report. What is real and delivered is the underlying website, the working Meta webhook integration, and the fully documented compliance architecture the campaign is designed to run on.
The financial-services regulator enforces title-protection rules that restrict who may use titles like "Financial Advisor" or "Financial Planner" in public materials — only individuals holding the appropriate credential can use them. Mid-project, this required auditing and rewriting site copy to use "business consulting" framing instead, ensuring the site's language stayed accurate to the credentials actually held while still describing the firm's services clearly.