How this site is secured

The scan

On October 17, 2026 the Mozilla Observatory graded this site A+, passing all 12 of its tests. You can run the same scan yourself.

In your browser

• HTTPS only: http requests are redirected, and a one-year HSTS header tells browsers to stay on https.
• Content Security Policy: pages may only run scripts from this site and from Cloudflare (the spam check and visitor statistics). Frames, plugins, and form posts to other sites are blocked.
• No framing: other sites cannot embed these pages, which blocks clickjacking.
• Other headers: content-type sniffing is off, the referrer is trimmed when you leave, camera, microphone, and location are switched off, and cross-origin isolation headers are set.

The contact form

• Cloudflare Turnstile checks that a person is submitting it.
• A short-window limit per IP address slows down repeated submissions.
• The server confirms the email domain can receive mail before sending anything.
• The mail and spam-check keys are stored as server-side secrets, not in the code.

What the form collects and who handles it is on the privacy page.

Code and dependencies

• The site's source is in a private repository and deploys automatically when I push.
• As of October 17, 2026, npm audit reports no known vulnerabilities in the dependencies.
• I searched the repository and its history for keys and passwords and found none.

The tools

The IT Skills Kit runs entirely in your browser. Its tools carry their own policy that blocks outbound network requests, so what you paste into theLog Sanitizer has nowhere to go.

What I have not done

• The site is not on the browser HSTS preload list. Getting off that list is slow, so I am waiting until I am sure.
• This is a self-check, not an outside audit. The scan is automated and the rest is my own review.

Found a problem?

Please tell me. My security.txt says how to reach me, and the contact form works too.