Security
How this site is protected.
No big words and no certificates I don't have: below are the measures that actually run in this site's code. I set up client sites the same way.
Measures
What's in place.
Each measure in one sentence. Anything not listed is not promised.
HTTPS everywhere
Every connection is encrypted, and the HSTS header (two years, with the preload flag) tells the browser to open the site only over HTTPS.
Security headers
A content security policy (CSP) limits where scripts and images may be loaded from; on top of that there's protection against being embedded in other sites' frames and against file-type sniffing.
Encrypted passwords
Passwords are stored only as an Argon2id hash, never in readable form, and must be at least 12 characters long.
Two-step login
The admin supports login with a code from an authenticator app and backup codes; after too many failed attempts, login is temporarily locked.
Form protection
The contact form has a trap for bots and a limit on submissions from the same network address; the server checks every entry before it is saved.
Card payments through Stripe
Once card payment is switched on, you pay on Stripe's payment page, so card details never reach this site; a payment is confirmed only by a signed message from Stripe.
Only essential data, with a time limit
Automatic deletion every night: assistant chats after 30 days, visitor statistics after 14 months, enquiries after 24 months.
Hosted in the EU
The site runs on Vercel's servers in Frankfurt (EU), and the database is with Supabase, also in Frankfurt (EU).
The AI doesn't publish on its own
Text the AI suggests for the site or for emails is a draft — a person saves or sends it; the chat assistant on the site doesn't change anything.
Check for yourself
Don't take my word for it.
Three independent tests, each with the domain already filled in. They open in a new tab and check the site at the moment you run them.
I don't publish scores here: they only hold for the day they were measured. Run a test and see today's.
Reporting a vulnerability
Found a bug?
Write to me at the address below, ideally with the steps to reproduce the problem. I reply personally.
The same address is in the standard file /.well-known/security.txt