# How we protect a site we host

> A hardened header set, TLS that renews itself, Cloudflare in front, and no plugin layer to patch. Here is each part and what it stops.

Security and your data · noboringsites documentation · https://noboringsites.com/docs/security/how-we-protect-a-site-we-host/

---

Security here is a set of things you can check rather than a badge. Every item on this page is either visible in your browser or written into a policy you can read.

## The headers your site sends

A browser can be told what a page is allowed to do. These are the instructions ours send.

- **Content-Security-Policy** - names the only places the page may load code, styles, fonts and images from. Anything else is refused.
- **X-Frame-Options: DENY** - nobody can put your site inside their own page and collect what visitors type into it.
- **X-Content-Type-Options: nosniff** - a file is treated as what it says it is, never guessed at.
- **Strict-Transport-Security** - the browser refuses to load your site over plain HTTP, even if a link says otherwise.
- **Referrer-Policy** - your visitors' page addresses are not handed to the sites they click through to.
- **Permissions-Policy** - camera, microphone and location are switched off at the page level.

## Every template ships one too

The header set is not only for sites we host.

- **Every template in the marketplace ships its own `_headers` file.**
- **It lands at the deploy root**, which is where Cloudflare Pages and Netlify read it from.
- **It is sized for a site on your domain**, not ours, so it does not assume our third parties are yours.
- **A local dev server ignores it**, so check the live site rather than localhost.

## TLS and the network

The transport half.

- **SSL renews itself.** There is no expiry date for you to diarise.
- **Cloudflare's network sits in front of your site.**
- **Requests are upgraded to HTTPS** rather than served over plain HTTP.

## What is not there to attack

Some of it is an absence, and the absence is the point.

- **No plugin marketplace**, so there is no plugin layer waiting to be patched.
- **No theme to update** on somebody else's schedule.
- **No admin login on your site** to be brute-forced, because the editing happens in our portal.

## Forms

The one surface a stranger can reach.

- **Submissions are rate-limited** by a salted hash of the sender's IP address. We do not keep the address itself.
- **The forms carry a hidden field** a person never sees and a crude bot fills in.
- **Nothing sensitive is stored on the page.** An enquiry is delivered by email, not parked in a database you have to secure.

## What to do if something looks wrong

One route, and it is not a form.

- **Email team@noboringsites.com.** A person answers.
- **If it is a vulnerability**, the steps are on [report a security problem](/docs/security/report-a-security-problem/).