Security

How we protect this site, and yours.

A security firm should be able to show its own work. This page explains what this website does with your data, how the free check behaves on your server, and how to tell us if we got something wrong.

Last reviewed 26 October 2026.

How this site protects you

HTTPS only. Every page is served over HTTPS with HTTP Strict Transport Security, so browsers refuse to load it insecurely.
A strict content security policy. Scripts run only from this site. Styles and fonts come from this site and Google Fonts. Nothing else can load, and the page cannot be framed by another site.
No trackers, no third-party analytics. This site loads no advertising or analytics scripts. Its only cookie remembers which version of the homepage you see while we test two, and the homepage keeps daily per-version counts with no identifiers.
Data minimisation. The free check stores a website origin, a job status, and a sanitised report for five minutes. Raw IP addresses are never written to the database; a daily-rotating hash supports rate limiting instead.
No passwords, ever. The enquiry form prepares an email on your device and does not submit anything to our server. We never ask for passwords, keys, or customer data by email.
Managed infrastructure. The site runs on Vercel with a Neon PostgreSQL database. Secrets live in the hosting platform’s environment, not in the code, and the code repository is private.
Dependencies audited. The application’s dependencies are checked against public vulnerability databases before each release.

How the free check works

The checker makes the same kind of request a visitor’s browser makes, then reads what came back. It is deliberately boring on your side of the connection.

It resolves your domain through public DNS and refuses to contact private, internal, or reserved addresses, including after redirects.
It requests the public homepage once (following up to three redirects), the plain-HTTP address once to see whether it redirects, and opens one TLS handshake to read the public certificate chain. That handshake sends no data.
It reads response headers, up to 128 KB of the page, the attributes of cookies set on that response (never their values), and the paths of scripts, styles, and images on the page.
It never logs in, submits forms, sends exploit payloads, requests private files, scans for malware, or tests checkout. It cannot certify that a site is secure, and the report says so.
Each report lists 15 observations with a plain-language next step. Findings describe what was seen from outside; they are not proof of a hack.

Latest audit of this site

Reviewed on 25 October 2026 against the headers, dependencies, and scanner behaviour described above.

Transport and headersHTTPS with HSTS, content security policy, frame denial, nosniff, referrer and permissions policies, and cross-origin isolation headers present on every response.

DependenciesZero known vulnerabilities reported for production dependencies at the time of review.

Data handlingOne cookie, holding only the homepage version you see. Reports expire after five minutes, errors after thirty seconds, queued jobs after two minutes. No raw IP addresses stored.

Scanner safetyPublic-address enforcement at DNS and at the socket, bounded request size and time, per-connection rate limits, read-only certificate probe.

Our own checkRunning the free check against this site returns no findings needing attention.

Disclosure channelA security.txt file is published with a monitored contact address.

Report a vulnerability

If you believe you have found a security issue in this website or in our free check, email hi@weblocksmith.com with the steps to reproduce it. Please give us a reasonable time to fix the issue before sharing it publicly, and do not access, change, or keep data that isn’t yours while testing.

In return, we will acknowledge your report, keep you informed as we fix it, and credit you if you would like us to. We will not pursue legal action against research carried out in good faith within these guidelines.

Now check your own site.

The same outside view an attacker gets, in under two minutes.

Scan my website