How we secure this site.
A security company’s website should be a demonstration, not a liability. Here’s how brjconsult.com is built — the same principles we apply to client environments.
Static pages, no CMS
Every page is pre-built HTML. There is no WordPress, no database and no admin login on the public site — which removes the most common ways small-business websites are compromised.
- ✓ No plugins or themes to exploit
- ✓ No database to inject into
- ✓ No admin panel to brute-force
Cloudflare in front
All traffic passes through Cloudflare’s global network before it reaches our server.
- ✓ Web application firewall (WAF)
- ✓ DDoS protection and bot management
- ✓ Rate limiting on form submissions
- ✓ TLS 1.2+ with HTTPS everywhere
Strict browser security headers
Headers tell browsers exactly what this site is allowed to do.
- ✓ Content Security Policy (CSP)
- ✓ HTTP Strict Transport Security (HSTS)
- ✓ Clickjacking protection (frame-ancestors none)
- ✓ No MIME sniffing, strict referrer policy
Hardened forms
Our consultation and assessment forms are the only interactive parts of the site, so they get the most attention.
- ✓ Cloudflare Turnstile bot verification
- ✓ Server-side validation and length limits
- ✓ Header-injection protection
- ✓ Nothing stored — submissions are emailed, not kept in a database
Locked-down server
The hosting account only runs the one script it needs.
- ✓ Script execution blocked everywhere except the form handler
- ✓ Secrets stored outside the web root
- ✓ Directory listing disabled, hidden files blocked
- ✓ Legacy WordPress URLs answer “410 Gone”
Secure development
The site’s source lives in a private repository with automated checks.
- ✓ Dependency scanning and automatic update PRs
- ✓ Code scanning on every change
- ✓ Secret scanning with push protection
- ✓ MFA required on every account
Privacy by default
We don’t use advertising pixels or third-party trackers. Site analytics are cookie-free and aggregated. Details are in our privacy policy.