A few weeks ago I was sat with a client looking at a spreadsheet of guide downloads, and one row stopped me. An HR manager at a mid-sized employer had downloaded their neurodiversity guide at 9:14 on a Tuesday morning. Not a like. Not a page view. A real person, at a real organisation, who had decided that this exact topic was worth handing over their work email for, that morning. That row is what content marketing lead generation actually looks like when it works, and it’s the opposite of what most people think content is for.

Because most people treat content as “traffic.” You publish a thing, the numbers go up, everyone nods. But traffic is a vanity metric until something happens next. The interesting question isn’t how many people downloaded the guide. It’s what that download told us, and what we did about it.

A download is a signal, not a finish line

The client here is Workplace Mindfulness. They generate a genuinely large volume of gated guide downloads, practical resources aimed at the people who actually have to make wellbeing decisions inside an organisation. The neurodiversity-for-HR guide is a good example: it’s written for HR teams who are trying to support neurodivergent colleagues properly and don’t quite know where to start.

Here’s the bit that matters. When someone downloads that guide, they’re not just consuming content. They’re raising their hand. The download is a signal of intent: this specific person, at this specific organisation, cares about this specific topic right now. That last word does a lot of work. Timing is most of the battle in sales, and a download is one of the few honest signals you get about timing.

Content isn’t traffic. The right guide attracts the right person, the download identifies intent, and the follow-up turns that interest into pipeline.

What happens after the download

This is where it stops being marketing and becomes a sales process, and where most businesses drop the ball. The signal goes to a sales rep. Not as a name on a list to blast, as a prompt to start a genuinely useful conversation.

The rep reaches out, and the tone is everything. It is not “I see you downloaded our guide, can I book you a demo.” It’s closer to “You grabbed the neurodiversity guide, that’s a topic a lot of HR teams are wrestling with at the moment, how are you finding it where you are?” A real question, from someone who knows the subject, with no hard pitch attached. People can feel the difference instantly.

And in that conversation, one quiet question does more than any pitch ever could: when does your organisation next review its wellbeing and support provision? Because the honest truth is that most people who download the guide aren’t ready to buy this week. But they will be, on a timeline, and now you know roughly when. That’s how you build pipeline: not by pushing, but by being in the right place at the right time, then staying in touch until the timing lines up.

The pipeline, start to finish

Strip it back and the mechanism is simple:

• The right guide attracts the right person. A neurodiversity-for-HR guide doesn’t pull in students or window-shoppers. It pulls in HR people with a live problem.
• The download identifies intent. You now know who cares about what, and when they raised their hand.
• The follow-up turns interest into pipeline. A helpful human conversation finds the buying window and keeps the relationship warm until it opens.

None of that works if any link is missing. A great guide with no follow-up is a PDF nobody acts on. A keen sales team with no signal is just cold-calling. It’s the connection between content and sales that creates the result, which is a theme I keep coming back to because it’s true everywhere: everything is connected, and the parts only pay off when they feed each other.

Why content marketing lead generation beats chasing reach

This is why I’m a broken record about lead magnets and useful content over reach for its own sake. A viral post that reaches fifty thousand strangers and identifies none of them is worth less than one guide download from the right HR manager. One of those is a number you screenshot. The other is the start of a sales conversation.

The Workplace Mindfulness work bears this out. Once we focused on getting the right guides in front of the right people, downloads climbed sharply, here’s the one published figure I’ll put a number to:

But the number on its own isn’t the point, and I want to be careful here, because it’d be easy to wave that figure around as if downloads were the goal. They’re not. That 146% only mattered because every one of those extra downloads was a fresh, identified signal of intent dropping onto a sales team that knew exactly what to do with it. The download is the start of the value, not the end.

Content does three jobs at once

The other reason I keep pushing clients towards proper guides and lead magnets is efficiency. A good gated guide doesn’t do one job, it does three, and that’s where the leverage is.

First, it’s a lead-generation engine, the download-as-signal mechanism above, and the reason gated content drives qualified leads when it’s paired with honest follow-up rather than a hard pitch. Second, it’s an SEO asset: a genuinely useful resource on a topic people search for, which earns its own traffic over time without you paying for every click. Third, it’s email fuel: everyone who downloads it has, by definition, given you permission to keep being helpful, which is precisely what feeds a sensible B2B email follow-up that nurtures the not-yet-ready ones until their review window comes round.

One piece of content, three returns. That’s why a lead-generation approach built on useful content compounds in a way that one-off campaigns never do, and why I’d rather a client publish one brilliant guide than ten forgettable blog posts.

The honest takeaway

If you take one thing from the Workplace Mindfulness example, make it this: stop measuring content by how many people saw it, and start measuring it by how many of the right people put their hand up, and what you did next. A download is a person telling you they care about something, right now. That’s a gift. Most businesses leave it sitting in a spreadsheet.

Get the right guide in front of the right person, treat the download as the intent signal it is, and follow up like a helpful human rather than a salesperson, and content stops being a cost centre. It becomes the top of a real, human sales process, which is the only reason any of it is worth doing.

The first thing I tell people when they hear the number is that it’s real, and the second thing I tell them is that it was boring to earn. We got a 33:1 return on a B2B email campaign for a client of ours, Workplace Mindfulness, and I’m proud of it. But there was no magic subject line, no clever hack, no one moment where it all clicked. It was weeks of unglamorous, careful work that most people skip because it isn’t fun and nobody claps for it.

That’s really the point of writing this. When people talk about B2B email marketing ROI, they reach for the headline figure and stop there, as if the number arrived on its own. The often-quoted benchmark is roughly $36 returned for every dollar spent on email, but averages like that hide the work that separates the programmes earning it from the ones that don’t. It didn’t. So rather than wave the 33:1 around like a trophy, I want to walk you through the actual craft underneath it, because that craft is the thing you can copy, and the number is just what it produces.

First, let’s be honest about what the 33:1 is, and isn’t

You may have already read our published case study on Workplace Mindfulness, where we talk about a 6.6× return. That’s the same client, and I want to be completely clear so there’s no confusion: those are two different channels doing two different jobs.

• The 6.6× is the return on their Google Ads spend, money in versus revenue out on paid traffic.
• The 33:1 is the return on the email channel specifically, what the email programme returned against what it cost to run.

They’re not competing figures and they’re not the same figure dressed up twice. They’re two parts of one connected system, each measured on its own terms. The email programme is only one piece of a wider machine, and if you want the full picture of how it all fits together, the complete Workplace Mindfulness case study lays it out. I’ve written before about why everything is connected in a business like this, and email is a textbook example: it doesn’t work in a vacuum, it works because the rest of the system feeds it.

The unglamorous craft behind the number

Here’s what the work actually involved. None of it is exciting on its own. All of it mattered.

Warming up the domain so the emails actually arrived

Before we sent a single campaign that mattered, we spent real time warming up the sending domain and sender reputation. If you go from zero to blasting thousands of emails overnight, the inbox providers treat you like a stranger who turned up shouting, and they quietly bin you. Deliverability is the unglamorous foundation everything else sits on, because an email that lands in spam has an ROI of exactly nothing, no matter how good the copy is. So we built reputation slowly, sent gradually, and protected it like it was the asset it is.

Testing everything, so every send taught us something

We A/B tested relentlessly. Subject lines, send times, the content itself, the calls to action, all of it. The goal was never just to win a single send. It was to make sure every send taught us something we could use on the next one. That’s the difference between sending email and running an email programme: one is a series of guesses, the other compounds.

A 33:1 return isn’t a clever trick. It’s the sum of a hundred boring decisions made carefully instead of skipped.

Sequences, not one-off blasts

We built multi-email sequences and chains rather than firing off one-off blasts and hoping. A single email asks a lot of a busy person at exactly the wrong moment. A well-built sequence shows up over time, earns a bit of trust, and is there when the person is finally ready to act. Most of B2B buying happens in the gap between “interesting” and “ready,” and sequences are how you stay present through that gap without being annoying. This is the same disciplined approach I broke down in our guide to B2B email lead generation, applied to a live campaign.

Keeping the data clean

And then there’s the part nobody wants to do: the data. List hygiene, segmentation, removing dead contacts, keeping records clean so the right message reached the right person. Messy data is the silent killer of email ROI. You can have brilliant copy and a beautifully warmed domain, and still torch your results by sending the wrong thing to the wrong segment, or by emailing a list full of dead addresses that drag your deliverability down with them. Clean data isn’t glamorous, but it’s the difference between a programme that improves and one that slowly rots.

What that discipline produced

When you do all of that properly, the results stop being about volume and start being about precision. Here’s what the email programme delivered for Workplace Mindfulness.

Look at the middle figure for a second, because it’s the one I find most telling. Double the enquiries from half the send volume. That’s not what most people expect, because the instinct in email is always to send more. Send more, reach more, surely get more. But sending more to a poorly managed list mostly trains people to ignore you and then unsubscribe. Sending less, but better, to the right people did the opposite: more enquiries, and fewer unsubscribes, not more. That’s the whole philosophy in one line. Relevance beats volume, every single time.

This is what good B2B email marketing ROI actually looks like

If you take one thing from this, let it be this: a number like 33:1 is real, but it’s the output of the rigorous, boring work that most people skip, not the input. Nobody got there with a single inspired idea. We got there with domain warm-up, with testing, with sequences, with clean data, done patiently and in order.

I’ll also be honest about the timeline, the way I always try to be. These results are genuine, and they’re also still building. A well-run email programme isn’t a one-off win, it’s an asset that keeps compounding as the data sharpens and the sequences improve, and Workplace Mindfulness’s is still getting better. I’d rather tell you that plainly than pretend a number is a finish line when it’s really a checkpoint.

If your email marketing feels like it’s working hard for very little, the answer usually isn’t a flashier template or a cleverer subject line. It’s the unglamorous foundations, done properly. That’s the part we genuinely enjoy.

A few weeks ago I watched myself do, in an afternoon, something that would once have needed a small team and a fortnight. A campaign concept, the landing copy, a set of ad variations, a follow-up email sequence and the first draft of a blog post, all roughed out before the kettle had properly cooled. None of it was finished. All of it needed my judgement, my edits and my understanding of the client to be any good. But the heavy lifting of execution had quietly collapsed into a fraction of the time, and I couldn’t unsee what that means for the shape of marketing teams, or for what a sensible AI marketing strategy should now look like.

So here’s my honest take, and I’ll flag up front that this is exactly that, an opinion. I think a sensible AI marketing strategy doesn’t look like “more people doing more things faster.” It looks like fewer people doing sharper, more connected work, with one capable senior head pulling the strings and AI handling much of the execution underneath them. And rather than something to dread, I think that’s a genuine opportunity, especially for smaller businesses.

From big and siloed to small and joined-up

The traditional marketing team grew by adding specialists. An SEO person here, a paid ads person there, someone on email, someone on social, a content writer, a web person. On paper that’s coverage. In practice it’s silos. Each channel ends up with its own owner, its own targets, its own way of measuring success, and almost inevitably its own version of the story. The ads say one thing, the website says another, the emails are off doing their own thing entirely, and nobody is fully accountable for whether the whole machine actually joins up.

That fragmentation is the real cost of a big team, and it’s the thing AI quietly dissolves. When one strategist can credibly orchestrate SEO, ads, email, content and the website, with AI doing a lot of the grunt work across all of them, you don’t just save on headcount. You remove the seams. The person setting the strategy is the same person it flows through into every channel, so the message stays consistent and the parts pull in the same direction by default.

Why this fits the “everything is connected” thesis

This is the bit I feel strongest about. I’ve written before that in marketing, everything is connected, your ads feed your website, your website feeds your enquiries, your email keeps the not-yet-ready warm, and so on. A result in one place is almost never about that one place. It’s about how the whole system fits together.

If you believe that, then a big siloed team is arguably the worst structure you could pick, because it splits a connected problem across people who each only see their slice. One senior strategist with AI leverage is, counter-intuitively, better for integration than ten specialists, precisely because there’s a single brain holding the whole picture. The connections aren’t handed off between departments and lost in translation. They live in one place.

A big siloed team splits a connected problem across people who each only see their slice. One sharp head with AI leverage keeps the whole picture in one place.

That’s the shift I think is coming, and it’s why I keep using the word opportunity. Leaner, more strategic, more connected marketing isn’t a downgrade. For a lot of businesses it’s the first time the pieces have ever actually been coordinated by one accountable person rather than scattered across freelancers, agencies and an internal hire who never quite had time.

More accessible for smaller businesses

Here’s the part that genuinely excites me. Joined-up, senior-led marketing used to be the preserve of companies big enough to afford a proper team. If you were a smaller business, you got fragments, a bit of ads from one place, a website from another, the odd email when someone remembered, and you wore the integration cost yourself, usually without realising it.

AI changes the maths. When one experienced person plus the right tools can do what used to take a department, the price of coherent, connected marketing drops into reach for businesses that were previously priced out. The model we already work to, one senior person who actually understands your business orchestrating the whole picture across content, search, ads, email and the website, becomes more affordable, not less. That’s a good thing for the kind of ambitious smaller businesses we like working with.

The honest caveat: your AI marketing strategy amplifies thinking, it doesn’t replace it

Now the balance, because I’d be doing you a disservice if I pretended this was all upside. AI is a phenomenally powerful tool, and like any powerful tool it’s only as good as the hand on it. Point it in a vague direction and it will produce vague, plausible, generic work at remarkable speed. It needs direction. It needs judgement. It needs someone who actually understands the brand, the audience and the goal, and who is accountable for whether what comes out is accurate, on-message and genuinely good.

That’s the bit that doesn’t shrink. AI takes over much of the execution, but strategy, taste, brand understanding and accountability for quality become more valuable, not less, because they’re now the scarce ingredients. The whole thing rests on the human at the centre. AI amplifies a good strategist. It doesn’t replace strategy, and anyone selling you “set it and forget it” marketing is selling you noise.

There’s a related point I made when writing about AI and websites: the output looking right is not the same as it being right. A page, a campaign or a claim can read beautifully and still be wrong, off-brand, or quietly exposing you to risk. Speed without scrutiny is a liability. So the senior head pulling the strings isn’t a nice-to-have you can optimise away. They’re the entire reason the smaller, sharper team works at all.

What I think this means for you

If you run a business, I don’t think the lesson is “rush to replace people with AI.” I think it’s “stop equating good marketing with a big team.” The question worth asking isn’t how many specialists you can hire. It’s whether there’s one capable person, in-house or as a partner, who holds the whole picture and uses modern tools to execute it coherently. That’s the structure I’d back to win.

It’s also, for what it’s worth, the way we already work, one senior person who understands your business, treating your marketing as a single connected system rather than a pile of disconnected tactics, and using AI to do more with less. If you want the strategy itself as a deliverable you own, that is our marketing consulting. I’m optimistic about where this goes. Smaller, sharper and more connected is, to my mind, simply better marketing, and it’s becoming available to more businesses than ever.

A few weeks back I was sat with a business owner who told me, almost as a throwaway line, that they’d “tried email and it didn’t work.” When I asked what they’d actually done, the story was the one I hear nearly every time: they’d bought a list, written one email, hit send to a few thousand people, and waited. Nothing happened. A handful of unsubscribes, a couple of polite get-lost replies, and a quiet conclusion that email was dead.

Here’s what I told them, and what I genuinely believe after years of doing this: b2b email lead generation is the most undervalued channel there is. Not because it’s easy. Because it’s done badly so often that most people have written it off, which means the few who do it properly have the field almost to themselves.

Why b2b email lead generation has such a bad name

Email’s reputation took a battering for a simple reason: the barrier to doing it badly is basically zero. Anyone can buy a list and blast it. So that’s what most people do, and the results are predictably grim. The emails land in spam, the few that get through are generic and irrelevant, and the whole thing reinforces the idea that email doesn’t work.

But “buy a list and blast it” isn’t email marketing any more than handing out flyers on a wet high street is a campaign. It’s the laziest possible version of the channel, and it’s the version almost everyone judges email by. The honest truth is that the bad name is deserved, but it’s deserved by the method, not the channel. Done with a bit of craft, email quietly outperforms nearly everything else we run. The proof is real, not theoretical: we’ve written up a 33:1 return from a single email programme elsewhere, and that wasn’t luck.

The bad reputation is deserved, but it belongs to the method, not the channel. Most people judge email by the worst possible version of it.

The craft that separates spam from a real programme

So what does “done properly” actually mean? It’s not one clever trick. It’s four bits of unglamorous discipline, and skipping any of them is where most efforts fall apart. Here’s the plain-English version of each.

1. Warm up the domain and the sender, slowly

This is the bit almost nobody does, and it’s the bit that quietly decides everything. You cannot take a fresh domain, or a sending address with no reputation, and fire thousands of emails out on day one. Mailbox providers, the Gmails and Outlooks of the world, don’t know you yet, and a brand-new sender suddenly blasting huge volume looks exactly like a spammer to them. So they treat you like one.

The fix is to ramp up gradually. You start with small, sensible volumes to engaged contacts, build steadily over days and weeks, and let the providers learn that your mail gets opened, gets replied to, and doesn’t get marked as junk. This is the standard approach every deliverability team recommends: ESP guidance on warming up an email domain spells out the same phased, engagement-led ramp over several weeks. That’s how trust is earned. Skip it, and you don’t just have a bad week, you torch your deliverability, sometimes permanently, and every future email pays the price. Warm-up isn’t a nicety. It’s the foundation the whole thing stands on.

2. Sectorise, then write like a human to each group

The next mistake is the generic blast: one message, sent to everyone, that speaks to no one. A construction firm and an accountancy practice do not have the same problems, so why would they get the same email? They shouldn’t.

Proper b2b email lead generation segments the audience by sector, by role, by the situation someone is actually in, and tailors the message to each. A relevant email to a defined group outperforms a generic email to everyone by a distance that surprises people. When the reader feels like you understand their world, even slightly, they read on. When it’s obviously a mass mailout, they bin it without a second thought. Relevance is the whole game.

3. Give people a genuine reason to engage

You also have to earn the engagement, not demand it. A cold email that just asks for a meeting gives the reader nothing. A cold email that offers something genuinely useful, a guide, a checklist, a piece of insight that helps them whether or not they ever buy from you, gives them a reason to put their hand up.

And that hand-raise is gold. The person who downloads your guide on, say, getting more from their Google Ads has just told you something: they’re interested in that problem. A good lead magnet does double duty, it delivers real value and it signals intent, so you know exactly who’s worth following up with. This is the same logic that powers the email programmes we build: lead with value, and the interest sorts itself out.

4. Sequence it, because the first email rarely converts

Finally, stop expecting one email to do the job. It almost never does. Real pipeline is built over a sequence, a considered chain of emails that builds context, adds value, and follows up without nagging.

The first email might just introduce the idea. The second offers the guide. The third shares a result or addresses an objection. The fourth is a light, genuine check-in. Most replies and most booked calls come from emails two, three and four, not the opener, because by then you’ve built a bit of familiarity and the timing has finally lined up with their need. One-and-done email throws away the majority of the value before it ever arrives.

Why undervalued and effective are the same thing here

Notice that none of the above is a hack. It’s warm-up, segmentation, real value and a proper sequence, and all of it is genuine, patient work. There’s no “press send and watch the leads roll in.” That’s precisely why it’s undervalued: most people aren’t willing to do it, so they don’t, so they conclude it doesn’t work.

Which is exactly why it works so well for the people who will. When your competitors are still buying lists and blasting, a relevant, well-sequenced, properly-warmed programme doesn’t just compete, it stands out in an inbox full of noise. The effort is the moat. The channel is undervalued and high-returning for the very same reason, and email is never a standalone trick anyway, it feeds the wider system. I’ve written about how every channel pulls on every other one, and email is often the quiet engine in the middle of it.

If you’ve “tried email and it didn’t work,” I’d gently suggest you haven’t tried it yet. You’ve tried the bad version everyone tries. The good version is more work, but it’s the highest-ROI channel I know, and that’s not a sales line, it’s just what the numbers keep telling us.

If you’d rather hand the whole job over, that’s what our cold email outreach is for.

I lost count, years ago, of how many conversations started the same way. A business owner sits down, slightly frustrated, and lists the things they’ve tried. A new website a couple of years back. A run of ads that “didn’t really do anything.” An email they send when they remember. Some SEO that someone once set up. Each one cost money. Each one did a little. And none of it added up to the growth they were hoping for.

Here’s the thing I’ve come to believe, and it’s the whole reason Woodwise exists: most businesses don’t have a marketing problem, they have a missing-system problem, and the answer is almost always integrated growth marketing, channels designed to work together, rather than another tactic bought in isolation. They’ve been sold pieces, one at a time, by people who only sell that one piece. So nothing connects, and nothing compounds.

Tactics in silos vs integrated growth marketing

When you buy a website here, some ads there, and an email now and again, you get exactly what you paid for: a website, some ads, and an email. Three separate line items, three separate results, none of them aware the others exist. The website doesn’t know the ads are running. The ads point at a page nobody optimised for them. The email goes to a list that never grows. It’s not that any one piece is bad. It’s that they’re sitting in silos, each working alone, each delivering its own modest result and stopping there.

Integrated growth marketing is the opposite. You design the channels on purpose so each one makes the next work harder. The same money, the same effort, but the pieces start lifting each other instead of standing politely side by side. That’s when growth stops being linear and starts to compound. Let me make that concrete, because “synergy” is a word I never want to use again without proof behind it.

Four connections that actually compound

1. Good SEO makes your ads cheaper

This is the one that surprises people most. The work we do on SEO and website quality, making a page fast, relevant and genuinely useful, directly lifts your Google Ads Quality Score. Google treats landing page experience as a core component of Quality Score, rewarding a fast, relevant, high-quality page, and a better Quality Score means a lower cost-per-click and better ad positions. In plain English: the same SEO work that helps you rank for free also makes the traffic you pay for cheaper and stronger. One job, two channels. The page you built to be found organically is the same page that quietly knocks pounds off every click you buy.

2. One blog post is three pieces of content

Write a single proper SEO blog post and you haven’t made one thing, you’ve made three. It ranks in search and earns links over time. It’s also your LinkedIn content this week. And it’s the heart of your next email to your list. Write it once and it feeds organic search, organic social and your newsletter all at the same time. Most businesses treat content as a cost per channel: something to write for the blog, something else to write for social, something else again for email. Integrated, it becomes one asset working everywhere: the difference between paying three times and paying once.

3. A lead magnet does triple duty

A downloadable guide (a real, useful one) is the most efficient asset in marketing, because it works three channels off a single piece of effort. It ranks and earns links, so it helps your SEO. It gives your ads something valuable to offer, so people actually click and hand over an email instead of bouncing. And it starts an email nurture sequence, keeping the people who aren’t ready yet warm until they are. One asset, three channels, all pulling in the same direction. Build it once and SEO, ads and email all get sharper at the same moment.

4. Your website is the hub everything lands on

Here’s the part that ties the whole thing together. Every channel you run sends people to the same place: your website. The ads land there. The SEO traffic lands there. The email links land there. The social posts land there. If that page doesn’t convert, every other channel underperforms at once: you’re pouring more and more into the top of a bucket with a hole in it. Get the hub right and you don’t lift one channel, you lift all of them simultaneously. It’s the single highest-leverage thing in the whole system, precisely because everything else depends on it.

The businesses that grow fastest aren’t the ones with the cleverest single tactic. They’re the ones whose channels stopped working in isolation and started making each other stronger.

What it looks like when integrated growth marketing works

We put exactly this thinking to work for a client in the wellbeing space, and it’s the clearest proof I can give you. A website rebuilt to convert, Google Ads pointed at it, a frictionless booking path, and an email programme keeping the not-yet-ready warm: four pieces, connected on purpose. Run in isolation, each would have delivered a fraction of the result. Run as one system, they compounded into a 6.6x return on ad spend in six months.

That number didn’t come from spending more. It came from the pieces finally working as one. The ads were cheaper because the page was good. The page converted because the message was right. The booking path caught the ready ones, and the email caught the rest. Each part raised the ceiling on the others, and that compounding is the entire reason a 6.6x return is even possible. Pull any one piece out and the whole thing sags.

An honest question to ask yourself

So here’s where I’d leave you. Forget the dashboards and the jargon for a minute and ask one honest question: do my channels actually work together, or are they sitting in silos? Does the page my ads point at exist to convert those exact visitors? Is the content I’m writing earning its keep in more than one place? Is there an asset doing triple duty, or am I paying for everything three times over?

If the honest answer is “they’re a bit disconnected,” that’s not bad news. It’s the opportunity. It means the growth you’re after isn’t hiding behind a bigger budget or another tactic: it’s sitting in the gaps between the channels you already have. Close those gaps, connect the pieces on purpose, and the same effort starts compounding instead of leaking. Finding those gaps and putting them in the right order is exactly what our marketing consulting is for. That’s the work we love most, and it’s a conversation we’re always happy to have, honestly and with no pitch.

I’ve watched AI go from interesting experiment to genuinely useful tool in the time it takes most of us to develop a lunch habit. Claude, ChatGPT, and a dozen others can now write code that actually works: proper, clean, functional code. At Woodwise, we’ve embraced that. An AI can absolutely build you a website. What it won’t do is make that website safe to put in front of real customers.

That’s the gap this note is about. AI website builder security is not something the tooling handles for you by default. A working site and a secure site are two different things, and the difference matters more if your client is in the public sector, regulated industry, or handling any data worth protecting.

The honest thing about AI and code

Let’s get this straight first: Claude and similar tools are legitimately excellent at writing code. They understand architecture. They spot obvious mistakes. They’re faster and often cleaner than the first draft a human writes. We use them every week. But an AI has no operational context. It doesn’t know that your website will be running in production, on a real server, with real customers, and real people trying to break into it for profit or sport. A codebase can be beautiful and still be exposed.

AI website builder security: the seven things AI won’t handle for you

Here’s what needs doing after the code is written.

1. Two-factor authentication on admin logins

A password is no longer a complete lock. Anyone with your admin password can walk in. Two-factor authentication (2FA) requires a second form of identity: a code from your phone, a hardware key, or a passkey tied to your device. This is not optional anymore; it’s the difference between “our site got hacked” and “we locked the attackers out.”

For admin accounts especially, 2FA is essential. The web security standard OWASP’s multi-factor authentication guidance says so. So does every government cybersecurity agency. An AI won’t add this unless you ask it to, and even then, it will write the code but won’t configure it, won’t issue recovery codes, won’t set up a tested recovery path if an admin loses access. Those are operational tasks that need a human who understands risk.

2. Where your site is actually hosted

This one catches people off guard. Many AI tools or no-code builders will spin up your site on whatever cloud region is cheapest or fastest. For most small websites, that’s fine. For public sector work, regulated industries (finance, healthcare, legal), or any client bound by data protection rules, it matters where your data physically lives. UK-based organisations are strongly expected to use UK hosting. European clients often need European data centres. These aren’t technical preferences; they’re legal requirements for your client, and an AI won’t know them.

Your hosting decision is a human call. AI can build the website. You have to decide where it runs.

3. Rate limiting and brute-force protection on login

An attacker can guess passwords all day if there’s nothing stopping them. Rate limiting means “if you fail to log in five times, wait ten minutes before you try again.” Brute-force protection locks the admin area down after repeated failed attempts. Both are standard security practice. Neither is something an AI typically adds without explicit direction, and even then, the settings matter. Get the thresholds wrong and you lock out legitimate users or let in the attackers.

4. A web application firewall (WAF)

A firewall at the application level catches attacks that are already in your codebase. Common Vulnerability and Exposure (CVE) exploits, SQL injection attempts, cross-site scripting (XSS): a WAF blocks these before they even reach your code. Services like Cloudflare, AWS WAF, or Check Point sit between your visitors and your server and catch known attack patterns in real time. An AI will not suggest this. You have to know it exists and set it up.

5. Keeping everything patched and up to date

Your website doesn’t exist in isolation. It runs on a server, uses libraries, depends on frameworks, talks to databases. All of those have security updates. A vulnerability in a library you haven’t touched in six months can sink you. An AI can write code that uses a library, but it can’t patrol your dependencies for vulnerability patches, and it definitely can’t apply them. That’s an ongoing human job: monitoring what’s out there, testing updates, deploying them before something exploits the gap.

6. HTTPS and SSL certificates, properly maintained

HTTPS is no longer optional; it’s mandatory. Your traffic needs to be encrypted from visitor to server. But SSL certificates expire. They need renewal. If your renewal process is manual or forgotten, your site will simply stop working one day, and your visitors will see a browser warning that says “this site isn’t safe.” An AI can configure a site to use HTTPS. It can’t set up certificate renewal automation or monitor for expiry. That’s a human responsibility that recurs every 90 days or however often your certificate renews.

7. Secure, tested backups

A backup you’ve never tested is a backup that doesn’t exist. Industry best practice is the 3-2-1 rule: three copies of your data, on two different storage types, with one offsite. But it’s not enough to have the backup. You need to regularly restore it to a test server to verify it actually works. One copy should be immutable, stored in a way an attacker can’t encrypt it or change it even if they get into your network. An AI can help write the backup code. It can’t restore your site from backup when disaster hits. That’s a documented, rehearsed, human process.

A working site and a secure site are two different things. AI builds the first. Securing it for production is the part that needs experience.

The real cost of cutting corners

Skip 2FA and an attacker gets admin access. Skip hosting research and your public-sector client violates data residency rules. Skip a WAF and common exploits walk straight in. Skip patching and you’re vulnerable to known vulnerabilities anyone can search for. Skip backups and ransomware wins. Each one of these isn’t a “nice to have.” Each one is a thing that will happen, and when it does, it’s expensive: recovery costs, legal liability, lost reputation, downtime, and the work to actually fix it.

The businesses that stay secure are the ones that treat security as a system, not a feature. It’s the same lesson that runs through everything we do: the pieces only work when they’re connected on purpose. Security isn’t something you bolt on after launch. It’s something you design for, build into the process, and maintain continuously.

Where the experience comes in

This is why website design done for real production use needs a human who knows what they’re doing. Not to write the HTML; an AI can do that. But to make sure the infrastructure is sound, the operational practices are in place, and the backup when something goes wrong is already tested and ready.

An AI is a brilliant code-writing tool. It’s not a production operations manager. Those are different jobs, and conflating them is how sites get built right but secured wrong. It’s the same pattern we see across the board, which is why we think of AI as something that works alongside experienced people, not instead of them.

If your site is being built by AI, the important question isn’t whether the code is good. It’s whether the person deploying it understands what not being secure looks like, and has the experience to prevent it. That’s the work where growth really lives, in the difference between “the thing works” and “the thing works and is safe to trust.”

I still remember the message that landed in the business’s inbox. An enquiry from someone at Santander. A few weeks later, John Lewis. Then Pepsi. For a small B2B business that, twelve months earlier, you genuinely could not find on Google if you typed in its own name, that was a quietly remarkable moment, and the kind that makes all the unglamorous spadework worth it.

This is a b2b seo lead generation story, and a true one. I can’t name the business, for reasons I’ll come to. But I can tell you exactly what we did, because the “how” is the useful part, and the principle behind it applies to almost any business that sells to other businesses.

Starting from genuine zero

When we started, the online presence was effectively nil. Not “a bit thin” or “needs a refresh”. Properly invisible. The site barely registered for anything beyond the company name, and the people who needed what this business offered had no way of stumbling across it. The product was strong, the team knew their field inside out, and yet, online, they didn’t exist.

That’s a frustrating place to be, because it isn’t a quality problem. It’s a visibility problem. The right buyers were out there, typing the right things into Google every day, and landing on competitors purely because those competitors had shown up first. Closing that gap isn’t magic. It’s a large, patient piece of work, and that’s exactly what we signed up for.

What a serious b2b seo lead generation project actually involves

There’s a myth that SEO is a switch you flip. In reality, ranking a B2B business for the terms its buyers are searching is a sustained project with several moving parts, and the results compound rather than arrive overnight. Here’s how we approached it.

Getting the technical foundations right

Before you chase rankings, the site has to be something Google can actually read, trust and serve quickly. So we started underneath the bonnet: site speed, clean structure, sensible internal linking, proper indexing, the lot. None of this is glamorous and none of it makes a nice screenshot, but skip it and everything you build on top wobbles. Get it right and you’ve laid a foundation the rest of the work can stand on.

Building genuine topical authority through content

This is where the real lift happened. Rather than scattering a few keyword-stuffed pages about, we set out to make the site a genuine authority on the things this business is expert in. That meant a sustained content programme: answering the real questions their buyers ask, covering the topic properly rather than superficially, and earning Google’s confidence that this was a source worth ranking. Good SEO and good content aren’t two jobs: content is the engine that makes the search visibility work, and the two pull in the same direction.

Ranking for what the buyers actually search

The temptation in SEO is to chase big, vague, high-volume terms. We did the opposite. We worked out the specific phrases a decision-maker at a large organisation would type when they had a real problem to solve, and we built the site to own that real estate. Those searches are less crowded, more commercial, and far more likely to be a buyer than a browser. When you rank for the exact thing someone needs, the click is worth a great deal more.

Zero to household-name enquiries

Twelve months of that work changed the picture entirely. The business went from invisible to genuinely findable, and the enquiries that started arriving weren’t just more numerous; they were from organisations you’d recognise instantly.

Those household names, the likes of Santander, John Lewis and Pepsi, are examples of the inbound enquiries the work attracted. (Important caveat, and I mean it: they are enquiries the SEO generated, not clients or endorsements. More on that at the bottom.) The point isn’t the logos. The point is what it proves.

You don’t need to be a big brand to get found by big brands. You need to own the search real estate for what they’re looking for.

Why this works: search doesn’t care how big you are

When someone at a large organisation has a problem and turns to Google, they don’t type your competitor’s brand name. They type the problem. And Google serves them whoever has best earned the right to answer that query, not whoever has the biggest marketing budget or the most recognisable name. That’s the great leveller of search, and it’s why a small specialist can end up in front of a decision-maker at a household name.

It’s also why I bang on so often about everything being connected. The technical work made the content rank; the content built the authority; the authority won the visibility; the visibility produced the enquiries. Pull any one thread and the whole thing slackens. If you want the longer version of that argument, I’ve written about how every part of your marketing either feeds the others or fights them.

What this means for your business

If you sell B2B and you’re effectively invisible in search, the gap between where you are and where this business ended up is not as wide as it feels. It’s a question of doing the right work, in the right order, for long enough to compound. That’s the heart of how we approach SEO: foundations first, genuine authority second, and a relentless focus on the specific terms your buyers actually search.

I’m wary of pretending any of this is a shortcut. It was a large, sustained project, and the results built over months rather than weeks. But the lesson holds for almost anyone reading this: own the search real estate for what your buyers need, and the size of the names in your inbox will start to surprise you. You can see more of the work we’ve done across very different sectors on our case studies page.

If that’s the position you’re in, a good business that simply can’t be found, that’s exactly the conversation I’m always happy to have, honestly and with no pitch.

Most businesses don’t have a marketing problem. They have a system problem. They’ve bought a tactic, a new website here, a burst of ads there, an email now and again, and each one does a little, but nothing compounds. The pieces don’t talk to each other, so the whole thing underperforms the sum of its parts.

Growth is what happens when those pieces are connected on purpose. To show what that actually looks like, here’s a real client, a real six months, and the real numbers, including the ones that are still building.

The client: a good business that wasn’t converting its potential

Workplace Mindfulness, founded by Jamie, delivers workplace wellbeing programmes that genuinely help the teams they work with. The product was strong and the reputation was real. What wasn’t happening was conversion: attention wasn’t reliably turning into enquiries, and enquiries weren’t reliably turning into booked calls and clients.

That’s a very common place to be stuck. It isn’t a lack of effort or a bad business. It’s that the journey from “someone could use this” to “someone has booked a call” has friction in it, and no single tactic fixes friction. So instead of selling Jamie one service, we built a system.

The system: four parts, designed to work together

The point of a growth system is that each part makes the next part work harder. Connected this way, the four pieces become a predictable lead generation system rather than four disconnected tactics. Here’s how the four pieces fit.

1. A website built to convert, not just to look good

We rebuilt the website so it actually did a job: speak clearly to the right people in the wellbeing space, and make the next step obvious. A beautiful site that doesn’t convert is decoration. A site built around the visitor’s decision is infrastructure. Everything downstream, the ads, the emails, the bookings, lands on this page, so getting it right multiplies everything else.

2. Google Ads to reach the right people at the right moment

With a page worth sending traffic to, we ran Google Ads to put the business in front of people actively looking, rather than waiting to be found. This is the difference between renting hope and buying intent: you’re reaching someone at the moment they want what you do. But ads are only as good as the page they point at and the follow-up behind them, which is exactly why we didn’t run them in isolation.

3. A booking path with the friction removed

We tightened the whole journey from first click to booked call, including a frictionless self-booking path. The result: half of all enquiries now self-book a call via the calendar, no email tag, no waiting, no drop-off. Removing that friction is quietly one of the highest-leverage changes a business can make, because every step you delete is a step where people used to disappear.

4. An email programme that does more with less

Finally, we sharpened the email marketing, sending less, but better. By being more relevant and less frequent, the programme now drives double the enquiries from half the send volume, with fewer unsubscribes. That’s the compounding effect in miniature: a smaller, better-targeted effort outperforming a bigger, blunter one.

The results: six months in

Here’s what the connected system produced. These are this client’s genuine figures, and where a result is still building we say so rather than dress it up.

The number we’re proudest of isn’t actually the 6.6×. It’s the 6-in-7 conversion on booked calls. That figure is what tells you the system is working end to end: the right people are arriving, the journey is sending genuinely interested prospects into the calendar, and by the time Jamie speaks to them they’re ready. High ad returns are good. High ad returns and a near-perfect close rate is a machine. Average deal size is climbing too, as the business moves into larger programmes.

“Matt really took the time to understand what we do and why it matters. The whole process was straightforward and stress-free, which is exactly what you want. I’d recommend him to anyone.” Jamie, Workplace Mindfulness.

Why it worked: the parts compounded

If you’d run any one of those four pieces on its own, you’d have got a fraction of the result. A new website with no traffic is a brochure nobody reads. Ads pointed at a weak page burn money. A slick booking link no one reaches books nothing. Great emails to a list that never grows plateau.

Run together, they compound. The ads feed a page built to convert. The page funnels people into a booking path with no friction. The email programme keeps the people who aren’t ready yet warm until they are. Each part raises the ceiling on the others, and that compounding is the entire reason a 6.6× return is even possible. It didn’t come from spending more. It came from the pieces finally working as one.

The businesses that grow fastest aren’t the ones with the cleverest single tactic. They’re the ones whose tactics stopped working against each other.

What this means for your business

This client happens to be in wellbeing, but nothing about the approach is specific to that sector. We’ve applied the same thinking to a jeweller, a construction firm and a golf studio, and the principle holds everywhere: growth is a system, not a purchase. Whatever you sell, the questions are the same. Are you reaching the right people? Does what they land on convince them? Is it effortless to take the next step? And does something keep the not-yet-ready ones warm?

If the honest answer to any of those is “not really,” that’s where the growth is hiding, and usually it’s a conversion or a journey problem, not a traffic problem. You don’t need more tactics. You need them connected.

That’s the work we do, and it’s the conversation we’re always happy to have, honestly and with no pitch. If you’d like to see where your own growth is hiding, get in touch to book a free initial consultation and we’ll map out the fastest wins together.

What buying financial-adviser leads taught me about the difference between renting enquiries and owning the intent you pay for.

The enquiry from Micky Mouse

For several years before Woodwise Media, I worked inside an FCA-regulated financial advice firm. One of the things I was responsible for was making the firm’s lead spend actually work, turning a marketing budget into enquiries, and enquiries into clients the advisers could genuinely help.

Like a lot of advice firms, we bought leads from a well-known adviser directory. You pay a subscription, and then you pay a fee for each enquiry the platform passes to you. The promise is simple: people looking for advice land on the directory, fill in a form, and you get their details.

One morning, a lead came through. The name on the form was “Micky Mouse.” We had paid for it.

It would be funny if it were rare. It wasn’t the worst lead we ever paid for, just the most memorable. There were the wrong phone numbers, the people who had no memory of enquiring, the tyre-kickers with nothing to invest, and the contacts who had already been called by three other firms before we got to the phone. Micky Mouse was simply the moment the penny dropped: we didn’t really own any of this. We were renting names, and hoping.

Why it isn’t a one-off: the economics of a rented lead

The directory model isn’t a scam. For some firms it ticks over fine. But it’s worth being honest about how it actually works, because the economics explain the Micky Mouse problem.

Most adviser directories run on two layers of cost: a recurring subscription, plus a pay-per-enquiry fee that can sit at roughly £50 or more (plus VAT) for each lead, depending on the plan. And, crucially, many of those enquiries are shared. The same person who filled in one form is often passed to several firms at once. You aren’t buying a relationship. You’re buying a name, at the same moment your competitors buy it too.

That changes everything about the call that follows. You’re not reaching someone who chose you. You’re racing two or three other advisers to the phone, to speak to a person who filled in a generic form and may not remember which website it was on. The fastest dialler tends to win, the quality is wildly inconsistent, and you’re paying for the privilege either way.

A directory lead is access to a name. It is not ownership of a relationship, and it never becomes one.

The difference nobody explains: buying leads vs buying intent

Here’s the distinction that took me far too long to see clearly. There is a real difference between buying a lead and buying intent.

A directory lead is a contact detail, a name and number that a platform sold you (and possibly sold to others). A Google Ads click is something different. It’s a person who, at that exact moment, typed into Google that they want a financial adviser, a pension review, advice on a transfer, help planning for retirement, and then chose to click your ad and land on your page. That’s not a name on a list. That’s intent, captured at the precise moment it exists.

And when you run your own ads, you own that intent end to end:

• The search term that triggered the click is yours to learn from.
• The landing page they arrive on is yours, written to do one job.
• The enquiry is exclusive, it isn’t simultaneously sitting in three competitors’ inboxes.
• The data and the follow-up are yours to keep and improve.

The shared directory lead disappears the moment a competitor calls first. The enquiry you generated yourself doesn’t. You can follow it up on your terms, nurture it, and learn from it, because it was never anyone else’s to begin with.

“But finance clicks are expensive”: the honest numbers

I won’t pretend the clicks are cheap. Financial-services keywords are some of the more competitive in the UK, and adviser terms can run anywhere from around £5 to £20+ per click depending on what you’re bidding on (these are indicative 2026 ranges, not a quote, and they move around). Broad, generic terms like “financial adviser” sit at the painful end. Long-tail, specific terms, the equivalent of “retirement advice for company directors” or “pension transfer adviser” in a particular niche, tend to be cheaper and far better qualified.

But cost-per-click is the wrong number to fixate on. The number that matters is cost per genuine enquiry, and what that enquiry is worth to you. A handful of pounds per click that produces an exclusive, well-qualified enquiry you own outright can work out far better value than a “cheaper” shared lead you split with competitors and chase down a dead phone number, like Micky Mouse.

The trick isn’t spending more. It’s spending precisely, on the right searches, with a page built to convert them, and tracking that tells you which clicks actually turn into clients.

“Are we even allowed to advertise?”

This is usually the real, unspoken hesitation, and it’s a fair one. But I’m a marketer, not a compliance consultant, so I’m not going to tell you what your firm can or can’t say. That’s a line only your compliance function (or your principal or network) can draw, and it should be.

What I can tell you from experience is that plenty of authorised firms advertise their own services perfectly happily. The approach that works is simple: build the ads and the landing page to be clear, fair and balanced from the start, and run everything past your compliance sign-off before it goes live. Done that way, it’s far less of a headache than most advisers expect.

We build campaigns to be compliant by design and route everything through your team for approval. We never position ourselves as the people who decide what’s compliant, that’s always your call.

What actually works instead: owned, intent-led acquisition

So what does “owning your pipeline” look like in practice? Not a sprawling account bidding on every finance term under the sun. The firms that make this work tend to share four things:

• Tight, intent-led targeting. A focused set of long-tail searches that match the clients you actually want, not broad terms that burn budget on the merely curious.
• A landing page that does one job. Not your homepage. A single, compliant page that speaks to that specific search and makes enquiring easy.
• Conversion tracking that tells the truth. You should know which searches and clicks become real enquiries, so budget flows to what works and away from what doesn’t.
• Active, ongoing management. We audit ad accounts every week. Search terms get refined, wasted spend gets cut, and the account gets sharper over time rather than drifting.

That’s the whole point of owning the channel rather than renting leads from a directory: every week, it gets a little more efficient, and every enquiry it produces is yours alone.

Proof it isn’t just theory

I’ve now seen this from both sides, from inside an advice firm watching the lead spend, and from the agency side running campaigns for clients. The principle holds: own your intent, build a tight funnel, and measure what converts.

One example from a different sector makes the point. We worked with a wellbeing business, Workplace Mindfulness case study, where the whole journey was tightened from first click to booked call. Their Google Ads delivered a 6.6× return on ad spend, and once the funnel was right, 6 in 7 booked calls converted. That’s a different industry, and the full result came from the whole funnel working together, not a single button. But the lesson travels directly to advice firms: when you own the intent and remove friction from the journey, you stop renting hope and start building a pipeline you control.

If your pipeline depends on leads you don’t own

Here’s the uncomfortable question Micky Mouse left me with, and the one worth sitting with if your new business runs on bought-in leads: if every enquiry you pay for is shared with your competitors and could vanish to whoever calls first, who actually owns your pipeline, you or the directory?

You don’t have to switch everything off overnight. But it’s worth knowing, honestly, where your enquiries come from, what they really cost once you account for the junk, and whether owned, intent-led acquisition could quietly replace the rented kind.

If you’d like a straight answer on that for your firm, that’s exactly the conversation we’re happy to have, no pitch, no pressure. Get in touch to talk through your adviser lead generation, and if you want the full, account-level detail of how we build compliant Google Ads for advice firms, we’ve put it in a deeper guide we can share.