Security & delivery

Security is architecture, not a badge

A small website does not need enterprise theatre. It does need sensible modern controls matched to the risks it actually exposes.

Baseline controls

Supported public websites are expected to use HTTPS and managed DNS, with edge protection available according to the deployment.

When a website includes forms, APIs, logins or data-processing features, the attack surface changes and the design should change with it.

Reliable security also depends on being able to understand and reverse changes.

Technology

Production sites can combine global edge services with conventional cloud/server infrastructure according to the workload.

Cloudflare — Global edge delivery, DNS, CDN, TLS, DDoS protection, WAF, rate limiting, Workers and storage services. Provider information
Hetzner — Cloud and dedicated compute, networking, storage and conventional server workloads. Provider information
Linux — Production server operating systems and secure service hosting. Provider information
Docker — Portable containers for applications, services and controlled deployment. Provider information
PostgreSQL — Production relational data storage for applications and services. Provider information
GitHub — Source control, deployment history and auditable delivery workflows. Provider information
Node.js — JavaScript runtime for APIs, tooling and server-side applications. Provider information
Nginx — Web serving and reverse-proxy capability where conventional servers are appropriate. Provider information

Need the simple version?

The detailed pages exist for customers who want to inspect the engineering. The customer-facing offer remains deliberately straightforward.