Static-first public pages
No application server, database or public admin panel unless a current journey requires one.
Fewer moving parts. Controls matched to the real risk.
Security starts with ownership, data flow, release control and recovery. The baseline is explicit; extra controls are added when the customer journey or risk justifies them.
Configured and reviewable.
Controlled releases
Locked dependencies, reviewed source changes and an exact build path before production.
Secrets outside source
Production credentials stay in encrypted platform secrets with narrow permissions.
Protected enquiries
Server-verified Turnstile, request validation, rate limiting and generic external errors.
Security headers
HTTPS, HSTS, CSP, frame denial, restrictive permissions and referrer controls at the edge.
Known rollback unit
A reviewed Git commit is the release and recovery boundary.
Never implied by default.
- Protected member identity and authorisation
- Durable queues, retry guarantees or stored submissions
- Paid firewall, bot or account features
- Regulated-data controls and specialist compliance work
- Independent penetration testing
Ownership includes decisions.
- Keep named account owners and remove access that is no longer needed.
- Use strong authentication and MFA on domain, Cloudflare, GitHub and email accounts.
- Approve the real data flows, retention needs and third-party services.
- Choose ongoing monitoring and update support appropriate to the business risk.
No absolute guarantees.
No website is described as impossible to attack or guaranteed to remain available. Launch evidence proves a defined configuration at a point in time. Ongoing risk depends on account access, dependencies, traffic, third parties and the support model chosen.
Start with a useful conversation
Need a website you can be proud to own?
Tell me what the business needs to achieve, what exists today and what is getting in the way. I will give you a direct view of fit before a proposal appears.
- Typical start
- £2,950 for a Foundation Website
- Best fit
- Owner-led businesses and specialist firms
- Ownership
- Your domain, accounts and private source repository
- First response
- A direct view of fit, scope and the next useful step