What you notice as a visitor
Or rather, what you don't notice. There is no cookie banner, because there is nothing to ask consent for.
No trackers
No Google Analytics, no advertising pixels, no social media buttons watching along. I don't know who you are or what you read here.
No external services
Fonts, scripts and images are hosted on this server. Your browser does not connect to Google, Facebook or any other party.
One necessary cookie
Only on the contact page, to protect the form against abuse. It disappears when you close your browser and is not used to follow you.
The security check stays with you
Your answers are processed in your own browser and sent nowhere. They disappear when you close the window.
What happens behind the scenes
For those who want the technical detail.
Always encrypted
Every connection uses HTTPS. With
Strict-Transport-Securityyour browser remembers for a year that this site, including subdomains, must never be loaded unencrypted.Strict Content Security Policy
The browser may only load scripts, styles, fonts and images from this site. Code injected by a third party is refused, and the site cannot be shown in a frame on another site.
Extra security headers
X-Content-Type-Options,Referrer-PolicyandPermissions-Policy. Camera, microphone, location and payments are switched off for this site.No database, no CMS
There is no admin panel to break into and no database to leak. The less that runs, the less can go wrong.
A protected contact form
A one-time token against forged requests, a hidden field and a timing check against spam bots, and a check for injected mail headers. Messages go to my mailbox encrypted and are not stored in a database.
Secrets out of reach
Passwords for the mail server are kept in a configuration file that the web server never serves.
Email that cannot be spoofed
The archilogics.be domain uses SPF, DKIM and DMARC. An email that pretends to be from me but does not come from my server is blocked or quarantined by the recipient.
Reporting a vulnerability
Found a vulnerability? Following the standard, the reporting address is in security.txt. I reply within one working day.
Check it yourself
Don't take my word for it. These independent services show how the site is doing.
Security headers
HTTPS and certificate
Email security
internet.nl tests SPF, DKIM, DMARC and more.
Trackers
Blacklight looks for hidden trackers and cookies.