Security
The security basics we set up on every site we build, in plain language.
Protection in front of your site
Cloudflare in front
Visitors reach your site through Cloudflare's network, which filters bad traffic first.
Always HTTPS
Every visit is sent to the secure, encrypted version of your site.
HSTS
Browsers remember to use only the secure version of your site.
Bots & firewall
Cloudflare bot protection and managed firewall rules block common attacks.
Safer pages
Security headers
Rules that tell browsers what may load on your pages, and stop other sites from framing them.
No inline scripts
Page code lives in separate files, which makes injected code easier to block.
Checked outside scripts
Outside scripts get an integrity check where the provider supports it.
Spam-protected forms
Cloudflare Turnstile filters bots from contact and quote forms.
Your domain and email
DNSSEC
Signs your domain's records so visitors aren't sent to a fake copy.
CAA records
Only approved providers can issue security certificates for your domain.
SPF & DMARC
Makes it harder for scammers to send email pretending to be you. Domains that don't send email say so.
Behind the scenes
No secrets in code
Passwords and keys never go in your site's code.
Scanning & alerts
Secret scanning and dependency alerts are on for your site's code.
Launch check
We run a security header scan and an SSL test at launch and keep the results.
These steps make attacks much harder, but no website can be made 100% secure.