Security and privacy are built in
Your visitors’ data isn’t passed on to third parties, and the admin area is well protected against attacks. You don’t need any extra plugins for either.
Protecting your visitors
No third-party services
Fonts, icons and scripts ship with the website. There are no CDNs, no Google Fonts and no trackers.
Only necessary cookies
One cookie for the session and one for form protection. Services you add later only load once visitors agree.
Spam protection without third parties
A hidden honeypot field, rate limits and a built-in captcha keep spam out without sending data anywhere.
Protecting your admin area
Two-factor login
One-time codes at login, password rules and protection against password guessing.
Roles and permissions
Each action has its own permission. Anything that puts code on the server is reserved for administrators and can be switched off completely.
Content Security Policy
Scripts only run with a code that changes on every request. Security headers are sent with every page.
Password confirmation
Installing, updating and managing plugins asks for the password once more.
Safe updates
Each update is checked against its checksum, and the previous version is backed up. One click takes you back to it.
Activity log
Shows who changed what and when, including logins.
Security is ongoing work
Checked in rounds
Security reviews are repeated until a round finds nothing new. Every fix comes with a test so the problem can’t come back unnoticed.
Every component listed
A software bill of materials in CycloneDX format lists every component, and dependencies are checked for known vulnerabilities.
Found a vulnerability?
Please report it confidentially. The security.txt file explains how.