Public agencies
Security and hosting
How the websites we build are hosted, kept up to date and watched, in plain terms.
Where your site runs
Your site is built ahead of time into plain web pages and served from Cloudflare's global network. There's no database or admin login on the public site for anyone to break into.
Every page is served over HTTPS with certificates that renew automatically, and browsers are told to always use the secure connection.
Your own hosting account
For a public agency, the site can run in its own Cloudflare account, ideally owned by the agency, with us added as a member. If you ever move on, the handover is simple: we transfer the code to you and remove our access.
Monitoring
We check our sites every five minutes from outside our hosting, and an outage alerts us by email and phone. Anyone can see current status on our public status page.
See our status pageSecurity updates
Every change is checked for known high- and critical-severity vulnerabilities before it can merge, and each site is checked again weekly. An automated check runs across every site we manage every six hours and prepares fixes when a vulnerability is found.
Only small patch releases that pass every check are merged automatically; anything bigger is reviewed by a person. A person approves every release to the live site.
Built-in protections
Every page tells browsers to use HTTPS only, to refuse to run files disguised as another type, to block other sites from framing your pages, to limit what referring information is shared, and to turn off camera, microphone, location and payment access the site doesn't use.
Every page also carries a Content Security Policy, which tells browsers to run scripts only from the services the site actually uses, such as the spam check on forms and the analytics you've chosen, and to send data only to those services. Code injected from anywhere else is refused.
Backups and recovery
Every version of your site's code and content is kept in version control. Any earlier version can be put back live in minutes.
Forms
Contact forms are protected from spam bots by Cloudflare Turnstile, and submissions are delivered to you by email through Postmark. Our privacy policy lists every service a site uses.
Read our privacy policyAccessibility
Every release is scanned against WCAG 2.2 AA with an automated tool before it goes live. After launch, the live site is scanned weekly against WCAG 2.2 AA, with dated records kept.
Read our accessibility statementQuestions
Need a security questionnaire filled in for a bid, or want to report a problem? Email contracts@pagesteady.com or call 440-766-0979.
Email contracts@pagesteady.com