Security & Trust
How we think about safer business websites.
Security is not one checkbox. It is a set of practical habits around data, access, forms, admin areas and launch readiness.
What we apply on our own website
- HTTPS custom domain protection.
- Security headers for safer browser behaviour.
- Admin routes separated from public pages.
- Server-side admin authentication for the agency admin area.
- Rate-limiting on lead and admin authentication endpoints.
- Lead data routed through backend systems, not exposed in frontend code.
What we recommend for client projects
- Privacy, terms and refund pages where applicable.
- Protected admin access and safe password reset flows.
- Form spam protection and rate-limit planning.
- Careful handling of leads, bookings and customer details.
- No secrets, API keys or passwords exposed in public code.
- Security checks before launch.
Advanced protection that may require approval/access
Some stronger protections require access to Cloudflare, GitHub, hosting or code repositories. These include Cloudflare WAF rules, bot challenges, OWASP ZAP scans, secret scanning, GitHub code scanning and AI PR review checks. We only configure these after the owner approves and provides the correct access.
Important note
No website can be promised as completely risk-free. Our goal is to reduce common risks, protect client data better, and build a more professional launch foundation.