Site security
How this site protects you.
I advise organisations on security, so this site follows the same rules. Here is what that means for you, and how to check it yourself.
What it means for you
Private by default
No advertising, no analytics trackers, no tracking cookies. The only outside service is a privacy-friendly spam check on the contact form.
Encrypted, always
Every page loads over HTTPS with modern encryption. Older, weaker connection types are refused.
Only the data needed
Contact form messages go straight to my inbox and are not stored on the site. Readiness checks keep anonymous scores only, never names or email addresses.
Email you can trust
Email sent from this domain is signed and authenticated, so messages pretending to be from me are much easier for your mail provider to catch.
How it is looked after
- Automated security checks run on every change before it goes live.
- Third-party code is checked for known vulnerabilities on every change.
- The site has had a full security assessment, and every finding was fixed and retested.
- Security settings are reviewed whenever the site changes, not once a year.
No website is ever completely secure. These are the habits I recommend to clients, applied here.
Check it yourself
These free, independent tools test the site live. The results are theirs, not mine.
Found a problem?
If you believe you have found a security issue on this site, please tell me through the contact form. I will acknowledge your report, keep you updated, and credit you if you would like.
Please test responsibly: do not access other people's data, overload the site, or send automated spam through its forms.
Machine-readable details are in security.txt, following the RFC 9116 standard.