Security Center

Security-first website setup.

This page helps build trust and explains the basic security practices included in this static Cloudflare Pages website.

🔒

Secure Headers

The included _headers file adds CSP, clickjacking protection, referrer policy, permissions policy, and HSTS guidance.

🧱

Form Protection

Forms include required fields, validation, a honeypot field, and a Formspree endpoint instead of exposing email logic in client-side JavaScript.

🪪

Access Control

The dashboard is Cloudflare Access-ready. Use Cloudflare Access or another real auth provider before storing private customer data.

Recommended real login setup

Static JavaScript login is not secure for private client data. For actual customer accounts, protect dashboard.html with Cloudflare Access or integrate Clerk, Supabase Auth, Firebase Auth, or a custom backend.

View login plan

Security checklist

Enable Cloudflare SSL/TLS Full Strict
Protect admin/client pages with Cloudflare Access
Use strong email authentication for domain email
Do not put API keys in frontend code
Keep form endpoints and auth providers monitored