Every site we build is measured against this list

Encryption & transport

How data moves between your customer's browser and your site.

• HTTPS enforced everywhere. Any attempt to reach the site over plain HTTP is permanently redirected to the encrypted version.
• HSTS with preloading. Browsers are instructed to refuse an insecure connection to your domain — including on a visitor's very first visit, which is the gap a plain redirect leaves open.
• Modern TLS only. Obsolete protocols (TLS 1.0 and 1.1) are refused rather than silently accepted.

Browser-level protections

Instructions sent with every page telling the browser what it is and isn't allowed to do. These are real HTTP response headers, not decorative tags — you can read them off the wire yourself.

• Content-Security-Policy. Scripts and styles may only load from your own domain, with no unsafe-inline escape hatch. This is the single most effective defence against cross-site scripting, the injection attack that most commonly hits small business sites.
• X-Frame-Options: DENY. Your site can't be loaded invisibly inside someone else's page to trick your customers into clicking something they didn't intend — an attack known as clickjacking.
• X-Content-Type-Options: nosniff. Stops a browser second-guessing file types, which is one route by which an uploaded file ends up executed as code.
• Referrer-Policy. Sites you link out to aren't told the full address your visitor came from.
• Permissions-Policy. Camera, microphone and location access are switched off at the page level, because a brochure or booking site has no business asking for them.
• Verified after deployment, not just configured. Headers are checked against the live site once it's up — hosting platforms sometimes override what a config file asks for, so we confirm what's actually being served rather than what we intended to serve.

Forms & your customers' data

Every enquiry or booking form is a door into your business. These are the locks on it.

• Honeypot field. An invisible field real people never see. Automated bots fill in everything, so they identify themselves, and the submission is dropped silently.
• Submission timing checks. A form completed impossibly fast is treated as automated. Deliberately not a CAPTCHA — those hand a tracking script from a third party to every visitor and punish real customers with puzzles.
• Validated twice. Fields are checked by the browser and again in code, so a scripting error can't silently switch validation off.
• Input escaped, never stripped. Anything a customer types is escaped so it can't be interpreted as code, without mangling legitimate entries — a surname with an apostrophe or a note with an ampersand still arrives intact.
• Safe failure. If scripting fails to load, the form falls back to a harmless reload rather than putting your customer's name, email and phone number into the address bar and their browser history.

Your data stays yours

This is an architectural choice rather than a policy promise — the structure means we couldn't hold your customer data even if we wanted to.

• Enquiries go straight to your accounts. Bookings and messages land in your own inbox and your own spreadsheet, under your own login. We aren't a middleman holding your customer list.
• No developer-held keys. Credentials live in configuration files that are never committed to version control, and they belong to your accounts, not ours.
• Nothing shared between clients. Every build is its own isolated project — no shared endpoints, no shared accounts, no shared anything.
• If you leave, nothing breaks. Because the accounts are yours, moving the site to another developer doesn't require anything from us.

What we deliberately leave out

A lot of a website's risk arrives in things that were added without much thought. Our default is to add nothing.

• No analytics or tracking pixels unless you specifically ask for them — and if you do, we'll tell you what it means for your privacy notice.
• No third-party scripts on client builds. Nothing loads from anyone else's servers, so nobody else's outage or breach becomes yours.
• No plugin ecosystem. Sites are built as plain HTML, CSS and JavaScript with zero external dependencies — which means zero dependency vulnerabilities to patch, ever. This is the quiet reason these sites age well.
• No admin login unless you need one. Every login page is a door to be attacked. If your site doesn't need one, it doesn't get one.

Verify it yourself

You don't have to take our word for any of this, and you shouldn't. These are independent, free tools with no relationship to us. Run them against this very page.

What we don't claim

A standard is only worth reading if it's honest about its edges. Anyone who tells you a website is unhackable is selling something.

Why we bother

A freehold is only worth owning if the structure is sound.

• Because "you own it" has to mean something. Owning a website you can edit is the easy half. Owning one that's still standing, still secure and still yours in five years is the half that creates the value.
• Because the alternative is invisible until it isn't. None of this shows up in a design mockup. It shows up the day someone tries the door — or the day a customer asks whether their details are safe with you.
• Because it costs us discipline, not you money. None of these measures add to your invoice. They're simply what we think the minimum standard is for handing something over and calling it finished.