Ministry of Tourism and Environment · Government
timorleste.tl
The official national tourism portal of Timor-Leste — rebuilt from scratch and launched in August 2026, replacing the WordPress site that had served the country since October 2016. Eight languages, 689 directory listings, a shareable trip planner, and content the Ministry keeps current itself.
8
Languages
689
Directory listings
~7,000
Indexed URLs
13
Municipalities mapped
The brief
The portal that represented Timor-Leste to the world launched in October 2016 on WordPress. A decade later it was English-only, built for desktop in an era when most travel research happens on a phone, and missing everything a visitor now expects: a searchable directory of places to stay and eat, an events calendar, interactive maps, itineraries, live advisories. Content went stale because the editing system was too complex for the staff expected to run it — the most expensive failure of the three, because it undermines trust in everything else on the page.
A round of targeted SEO and mobile improvements in 2025, assisted by the South Pacific Tourism Organisation, was useful and also conclusive: incremental fixes on that foundation could not produce the platform the tourism sector needed. The recommendation was a full rebuild, and that is what we shipped.
What shipped
Eight languages, one fallback chain
English, Tetun, Portuguese, Bahasa Indonesia, 简体中文, Français, 日本語 and 한국어 — locale-prefixed URLs, hreflang and x-default across every page. Everything falls back to English, so a missing translation degrades instead of breaking a page.
The directories the old site never had
436 accommodation properties, 208 places to eat and drink, and 45 tour operators and visitor services — searchable, filterable, each with a complete profile and, where they exist, direct booking links.
Destinations, properly mapped
All 13 municipalities with destination hubs, attractions, and interactive maps — from Atauro and Jaco to Ramelau, Baucau and Maubisse.
A trip planner people can share
Visitors assemble an itinerary from real destinations and listings, then share it by link or email it to themselves. Curated 3, 5, 7 and 10-day itineraries seed the process.
An admin the Ministry actually runs
The old WordPress install proved too complex for day-to-day use, and content went stale as a result. The replacement is a purpose-built dashboard labelled in Tetun, covering listings, events, news, stories and travel advisories.
Hardened, then re-hardened
Enforced CSP, HMAC-signed admin sessions with a dedicated signing key, escaped JSON-LD on user-supplied listing text, and server-rendered transactional email with no caller-controlled body — the closed findings of a July 2026 security review.
Built to be found
Around 7,000 URLs in a locale-aware sitemap, structured data on destinations, listings and events, and an editorial layer written for how travellers actually search — plus a live advisory system for when conditions change.
On the OniT fleet
Hetzner behind Cloudflare, CI-driven deploys, Supabase Postgres for editorial content, GA4 for behaviour, and errors-only Sentry monitoring — no session replay, no PII.
Eight languages is an architecture decision
Adding a language to a site with 689 listings and a few hundred editorial pages is only cheap if the site was designed for it. Here the locale list is a single source of truth that the sitemap, the hreflang tags and the language switcher all derive from, every localised field is typed so that English is required and the rest are optional, and every read goes through a fallback helper. The result: a new locale is a data problem, not a rebuild, and an untranslated field renders in English instead of rendering nothing.
We are also explicit about what is and is not human-reviewed: English, Tetun, Portuguese, Indonesian and Chinese are human-authored or human-edited, while French, Japanese and Korean are machine-translated and await native review. Claiming otherwise on a national portal would be the wrong kind of shortcut.
The content problem was the real problem
Any agency can ship a good-looking tourism site. The reason this one was rebuilt is that the last one could not be maintained, so the admin was designed as a first-class deliverable rather than an afterthought: Tetun labels throughout, one screen per content type, and no exposure to the underlying data model. Listings, events, news, stories and travel advisories are all Ministry- editable, and publishing invalidates the affected pages in every language at once.
Operating model
We don't hand over the keys and walk away. timorleste.tl runs on the same Hetzner fleet as our other properties, deployed through CI, behind Cloudflare, with the same security baseline and backup regime. Errors report to Sentry — errors only, no tracing and no session replay, because a national portal draws heavy bot traffic and observability should not become a data liability. Content changes are the Ministry's; structural changes come to us with a fixed-scope quote.
Why it matters
This is the public face of Timor-Leste tourism. Every prospective visitor — diver, hiker, conference delegate, regional journalist — eventually lands here, and increasingly so do the AI assistants they ask first. Trilingual was never enough for a country whose visitors arrive from Indonesia, Australia, Portugal, China, Japan and Korea. Neither was a brochure: what the sector needs from the national portal is a working directory that sends real enquiries to real operators.
Stack