Practising what I preach
How this site is secured
A personal website is a small target, but a security professional's site should still be an example of good practice. Here's what protects this one, and why.
Minimal attack surface
Static site, no server-side codeThere's no database, CMS, login or admin panel to attack. Pages are plain files served from Cloudflare's edge.
No third-party scripts, fonts or trackersEvery resource is served from this domain. There are no analytics cookies, ad tags or external CDNs that could be compromised in a supply-chain attack.
No cookies, no personal data collectedThe readiness scorecard runs entirely in your browser. Your answers are never sent anywhere.
Browser security headers
Strict Content Security PolicyOnly scripts and styles from this site can run. There are no inline scripts or styles, and nothing is allowed by default.
Trusted TypesThe browser refuses to inject raw HTML strings into the page, which shuts down the most common class of cross-site scripting (DOM XSS).
HTTPS only, enforced with HSTSBrowsers are told to connect only over HTTPS for two years, including subdomains, which prevents downgrade attacks.
Anti-framing and isolationThe site can't be embedded in another page (preventing clickjacking), runs in its own browsing context, and denies access to camera, microphone, location and other device features.
Domain and email protection
DNSSECDNS answers for this domain are cryptographically signed, so they can't be spoofed to send you somewhere else.
CAA recordsOnly the certificate authorities used by my hosting provider may issue TLS certificates for this domain. Any other CA must refuse. Certificate Transparency logs are monitored for unexpected issuance.
SPF, DKIM and DMARC (reject)Mail claiming to come from this domain that fails authentication is rejected, which makes it much harder to impersonate me by email.
Reporting a vulnerability
If you find a security issue, please email [email protected]. Contact details are also published in security.txt (RFC 9116). I appreciate responsible disclosure and will acknowledge valid reports.
You can check these controls yourself with tools such as Mozilla Observatory, securityheaders.com, Hardenize or internet.nl.