Our new servers keep every door shut to the internet.
Our new servers sit behind Cloudflare's global network, and we are moving every system we host onto them. Visitors and attackers alike reach the edge, never the server: no open web port, no published server address, no password that can be guessed. Then our own platform checks every request again.
Stopped before it reaches us.
Every request passes through Cloudflare first. What it filters never touches our servers.
Attack floods absorbed
Cloudflare's network absorbs denial-of-service floods, and its managed firewall rules filter known attacks before a single byte reaches us.
Probes turned away
The automated scanners that try thousands of sites a day for leaked configuration files and old admin pages are refused at the edge.
Password guessing slowed down
Rapid repeated attempts at sign-in, contact forms and chat are limited at the edge, and our platform limits sign-in attempts again behind it.
HTTPS only
Every connection is encrypted with modern TLS (1.2 at least, 1.3 where the browser supports it). A plain HTTP request is redirected to HTTPS.
Close to your visitors
Visitors connect to Cloudflare's nearest data centre, and static files such as images and styles can be served from there, so security comes with speed rather than at its expense.
Your own domain, protected too
A customer's website on its own domain gets the same edge and its own certificate, even when the customer keeps their DNS where it is.
Nothing listens to the internet.
Our servers open their own encrypted connections out to Cloudflare, and traffic comes back only through them. There is no web port to attack and no server address to find.
- No open web port: the server accepts no incoming web connection at all
- No server address in public DNS: our domains point at the edge, not at a machine
- A firewall that refuses every incoming connection by default
- Administrator access only through an identity check (a one-time code to a named person) and a personal key; passwords are refused
- Each service runs with only the rights it needs
Then our software checks again.
The applications we build on our own platform come with these protections, in every project.
The real person behind every request
Even behind the edge, our platform sees the visitor's real address, so the sign-in limits, the audit trail and the statistics follow the right person. If that ever stopped working, the platform would say so at once.
Who did what, and when
Every sign-in, every administrative action and every unexpected error is recorded in an audit trail your administrators can read.
Files checked at the door
Every uploaded file is checked by its content, not its name: a renamed program is refused. Private files are only served to people allowed to open them.
Forms that cannot be forged
Protection against forged requests and a strict content policy on every page stop another site from acting in your name or injecting code into ours.
Statistics without tracking
Our website statistics use no cookies and keep no addresses: a visitor is counted, never followed.
Fixes reach every customer
All our projects share one foundation. A security fix made there reaches every project with its next update, so nobody stays behind.
We scan our own servers.
Before we call a server protected, we scan it from outside the way an attacker would: every TCP port and the common UDP ports, and we check that its firewall closes IPv6 as firmly as IPv4. On our new servers, an outside scan finds nothing to connect to.
- Every protection on this page was tested before it was listed here
- Hosted by us, or installed on your own servers: the same edge can protect both, without opening a port in your firewall
Want your systems behind the same protection?
Tell us what you run today: websites, business applications, phone systems. We'll tell you how to put it behind the same edge, and what stays to be done.