Smart contracts are state machines

Counters, setting variables, addresses, dictionaries, etc are the major primitives for logic you want to create

Reading from the blockchain does not cost gas fees

Use this to your advantage

Writing to the blockchain costs gas

Sending out funds also mutates the state and hence costs gas

Receiving funds does not cost gas fees to the incoming smart contract

You will automatically also know which wallet address sent you the funds. You can also listen for events related to balance

You do not have access of the wallet address of a visitor

But you can detect if the user is using Phantom or Metamask. Even change of subdomain or port is akin to a new website

Once the user has connected to your app, then you can see their wallet address, balance.

You can reject incoming funds based on some logic

eg: not being an approved sender or not being larger than X

That said you can not put much logic or modifications when your smart contract receives funds

Since there is a gas limit and time restriction that ensures that it should do the absolute minimum

Fund transfers can be pull, as well as push

eg of pull is to show the balance, and allow them to pull money out eg of a push is to click a button and send out funds that reside in a smart contract

No server is required to interact with the blockchain from a website

Just regular javascript is used for rpc calls to read, write.

You can detect if a user denies connecting to your app

and either show a retry or a failure message

A connected user who is temporarily locked out of their wallet will need to log back in

if they fail to, you can again handle the error. You won't know which wallet it is.

You can listen to the firehose of events of any smart contract

eg: listening to random events getting pushed out by the smart contract eg: beginning a disbursement and waiting for it's completion to show a success UI

Checking for NFT's begins with checking against known NFT contracts with the said wallet

Which is why you instead start with a bunch of NFT contracts and check if the user has one of the said collection. Or services exist that index or routinely cache NFT's and reverse engineer to give a pretty list of NFT's held by a user

access to all wallets will be compromised when the seed phrase is compromised

tread carefully

services like infura, alchemy, morallis etc do not cover gas fees despite free api calls

They require you to wire funds to the wallet addresses running any write/mutations. reads are free.