No database, no admin panel
Sites are static, pre-built pages served from a global network. There is no login page to brute-force and no SQL to inject.
Security first
Secure by design, not by plugin.
Most small-business sites are hacked through outdated plugins and weak hosting. We remove those risks from the start, and you can check our work yourself with free public tools.
Our approach
Fewer moving parts, more protection.
Strict security headers
Content-Security-Policy, HSTS preload, no framing and locked-down browser permissions on every page. The real headers are shown below.
Bot-protected forms
Every submission passes Cloudflare Turnstile, server-side validation and a hidden honeypot field. Messages are emailed to us and never stored.
Secrets stay secret
API keys live only in encrypted server settings, never in code a browser can see. Our build scan fails if a key-like string appears.
No trackers, no cookies
No third-party analytics or ad scripts. Your visitors' privacy is not for sale, and there is less code that could go wrong.
Scanned on every build
An automated, zero-tolerance scan runs before every release. Inline scripts, inline styles, unsafe patterns and broken links all fail the build.
The real thing
The headers this site actually sends.
This is not a mock-up. The block on this page is generated at build time from the same file that controls the live headers, and our build refuses to continue if the two ever differ.
The policy only allows scripts, styles, fonts and images from our own domain, plus Cloudflare's Turnstile for the bot check. Nothing can be framed, and forms can only submit to our own server.
HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'self' https://challenges.cloudflare.com; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; worker-src 'self'; frame-src 'self' https://challenges.cloudflare.com; form-action 'self'; base-uri 'none'; frame-ancestors 'none'; manifest-src 'self'; upgrade-insecure-requests
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=(), browsing-topics=()
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-originLive report
Your browser grades this page right now.
This is not a screenshot. When this page loaded, your browser sent a fresh request for it and read the real response headers. Each check below is graded from what actually came back.
Running checks...
Accounts
Locked-down accounts.
A secure site can still be undone by a compromised account. We use:
- Two-factor authentication on every account that supports it.
- Registrar lock on the domain, so it cannot be transferred away by mistake or by an attacker.
- DNSSEC, to protect against forged DNS answers.
- Least-privilege access keys, so a single key can only do one job.
We also recommend the same for your own domain, email and hosting accounts, and include a checklist with every project.
Verify it yourself
Don't take our word for it.
Run these free public scanners against this site, or any site we build:
- Security Headers grades the response headers.
- Mozilla Observatory checks best-practice security configuration.
- SSL Labs tests the HTTPS setup.
Responsible disclosure
Found something? Tell us.
If you believe you have found a security issue on this site, please email [email protected]. Our security.txt lists the details. We appreciate responsible disclosure and will respond promptly.
Want this level of protection for your own business? See security hardening.
Ready for a faster, safer website?
Tell us about your business. We review your current site first, reply within one business day, and there is no obligation.