Cookie settings
This site uses cookies to ensure the best experience. Choose which categories you want to allow. More information is available in the privacy policy .
Security and Data Protection
Your security is my priority. I take multiple steps to keep your data safe – from secure connections and browser rules to secure code and infrastructure protection.
In Brief
I handle security in multiple layers: I protect the connection (HTTPS), strictly configure the browser (CSP, security headers), use secure practices within Laravel, and the site is protected from the outside by Cloudflare.
- ✓ Always encrypted connection via HTTPS.
- ✓ Strict browser rules (CSP, security headers).
- ✓ Secure code in Laravel (CSRF, XSS protection, SQL parameterization).
- ✓ Traffic protection and loading acceleration via Cloudflare.
Secure Connection (HTTPS/HSTS)
I direct all requests to HTTPS and instruct the browser to use only secure connections in the future.
- Automatic redirection to HTTPS: if you arrive via HTTP, the site redirects you to a secure page.
- HSTS (Strict-Transport-Security): I instruct the browser to use only HTTPS (1 year, including subdomains).
- Upgrade insecure requests: where possible, links are automatically loaded via HTTPS.
Browser Protection
To prevent unwanted code from entering the site, I use a set of rules and headers that restrict what the page can do.
- Referrer-Policy: I only send essential information about the origin of the visit.
- X-Content-Type-Options: prevents the browser from "guessing" the file type, reducing the risk of attacks.
- X-Frame-Options: this website will not display in a third-party
iframe– protection against clickjacking. - COOP/CORP: I isolate windows and resources between domains, reducing risks during content sharing.
- Permissions-Policy: sensitive features (camera, microphone, location…) are disabled by default.
Content Security Policy (CSP) and Nonce
CSP is a "whitelist" of allowed sources. Every script has a one-time signature (nonce), so only what I have explicitly authorized will run. This significantly reduces the risk of Cross-Site Scripting (XSS).
| Directive | Value (simplified) |
|---|---|
| default-src | 'self' |
| script-src | nonce-{nonce} 'strict-dynamic' https: 'self' |
| style-src | 'self' |
| img-src | 'self' data: blob: and approved domains |
| frame-src | approved video platforms only |
| object-src | 'none' |
| connect-src | 'self' + analytical endpoints |
Actual values are set dynamically (a nonce is generated for each request).
Secure Code (Laravel)
The application runs on Laravel and I adhere to industry best practices.
•
CSRF Protection: forms include security tokens to prevent misuse.
•
XSS Protection: outputs are properly escaped, further supported by CSP.
•
SQL Injection: queries use bound parameters (parameterization).
•
Validation and Input Sanitization: I check formats and values before processing.
•
Sessions and Login: secured cookies with appropriate expiration times.
•
Rate Limiting: I limit the number of attempts on sensitive actions.
Protection via Cloudflare
I use Cloudflare – it protects the site from attacks, filters malicious requests (WAF), mitigates DDoS, and speeds up loading via CDN.
Monitoring and Response
- I monitor availability and errors in real-time.
- I regularly update the system and libraries.
- I back up key data and test recovery procedures.
- I have an internal incident response procedure for quick remediation.