How we protect a site we host

Security here is a set of things you can check rather than a badge. Every item on this page is either visible in your browser or written into a policy you can read.

The headers your site sends#

A browser can be told what a page is allowed to do. These are the instructions ours send.

• Content-Security-Policy - names the only places the page may load code, styles, fonts and images from. Anything else is refused.
• X-Frame-Options: DENY - nobody can put your site inside their own page and collect what visitors type into it.
• X-Content-Type-Options: nosniff - a file is treated as what it says it is, never guessed at.
• Strict-Transport-Security - the browser refuses to load your site over plain HTTP, even if a link says otherwise.
• Referrer-Policy - your visitors' page addresses are not handed to the sites they click through to.
• Permissions-Policy - camera, microphone and location are switched off at the page level.

Every template ships one too#

The header set is not only for sites we host.

• Every template in the marketplace ships its own _headers file.
• It lands at the deploy root, which is where Cloudflare Pages and Netlify read it from.
• It is sized for a site on your domain, not ours, so it does not assume our third parties are yours.
• A local dev server ignores it, so check the live site rather than localhost.

TLS and the network#

The transport half.

• SSL renews itself. There is no expiry date for you to diarise.
• Cloudflare's network sits in front of your site.
• Requests are upgraded to HTTPS rather than served over plain HTTP.

What is not there to attack#

Some of it is an absence, and the absence is the point.

• No plugin marketplace, so there is no plugin layer waiting to be patched.
• No theme to update on somebody else's schedule.
• No admin login on your site to be brute-forced, because the editing happens in our portal.

Forms#

The one surface a stranger can reach.

• Submissions are rate-limited by a salted hash of the sender's IP address. We do not keep the address itself.
• The forms carry a hidden field a person never sees and a crude bot fills in.
• Nothing sensitive is stored on the page. An enquiry is delivered by email, not parked in a database you have to secure.

What to do if something looks wrong#

One route, and it is not a form.

• Email [email protected]. A person answers.
• If it is a vulnerability, the steps are on report a security problem.