EB2 NIW Eligibilty checker

Confidential assessment to determine EB-2 NIW eligibility

Global Nomad

Legal

Business Travel

Dear Product Hunt Team This is a small tool with a slightly bigger story than I expected. What his tool does A free, 3-minute eligibility test for the U.S. EB-2 NIW visa (and four related sub-paths: PERM, NIW STEM, NIW Pilots, NIW AME). visitors answer a handful of questions about their education, their field, and what they actually want to do in the U.S. At the end this tools is able to tell you if he user qualifies or not. here's what to do next" or "not yet, here's why and what would change that." No paywall, no pre-screen email-capture, no high-pressure call at the end. The good thing about this tool is that all the questions and results are backed by an actual immigration law firm, that is what makes this tool legit, and again free to use and without any engagement what so ever. Why I built it I built it with Harvey Law Group, who'd been receiving the same email two or three times a week for years: "Hi, I'm a researcher / engineer / doctor / founder, do I have a shot at the NIW?" etc. And then having to either charge for a consult to find out, or send a polite "book a call" reply that half of those people couldn't afford. Meanwhile, a lots of people who clearly didn't qualify were booking calls and paying an hour to hear "sorry, this isn't for you." Lose-lose for everyone except the rare match. The tool just says the quiet part out loud, earlier. If you fit, you fit. If you don't, you don't waste the firm's time or yours. The build was supposed to be a weekend It wasn't. The form itself took an 2 months to do due to the back and forth with the lawyers to get it write— five branching question flows, a couple of legal disclaimers, an email handler. Done. Then production happened. - Email delivery. My local PHP mail() worked fine. On the live host it returned true and silently dropped every message. Three providers, two transactional services, and one bad assumption ("Brevo is free, right?") later, the tool now talks SMTP directly to a Namecheap mailbox with relaxed TLS verification (because shared-host certs don't match the per-domain hostname). I built a "send test email" button into the admin that surfaces the actual SMTP server response when it fails — because "it doesn't work" is not a useful bug report. - Security vs. signal. I stacked a honeypot, time gate, IP rate limit, MX check, and disposable-email blocklist all in one go. Real submissions started disappearing. Turned out the honeypot field's name (hp_website) was triggering browser autofill — every real user was unknowingly tripping the bot trap. Lesson re-learned: any defense that fails silently is a bug. Stripped it back to defenses that fail loudly. - GDPR isn't a footer link. Linking to a privacy policy doesn't make a form compliant. The form now has an explicit consent checkbox, a no-attorney-client-relationship disclaimer in the firm's own published language, and a timestamped consent record attached to every email — so if anyone ever asks "did this person consent?", the answer is documented. - The form needed an admin. Started as a single file. Quickly realised every config change meant redeploying. So I added a hidden admin console (login + bcrypt + CSRF + rate-limited login + session timeout) where the firm can view inquiries, change SMTP, run a live email test, set the favicon, plug in GA4 / Search Console / Microsoft Clarity, and write a custom meta title and description. The folder is named something unguessable so admin-scanning bots don't find it. The whole thing is still one deployable folder. JSON files for everything — no database, no build step, no framework. Runs on $4/month shared hosting.