Public agencies
Security and hosting
How the websites we build are hosted, kept up to date and watched, in plain terms.
At a glance
HTTPS everywhereCertificates renew automatically.
Cloudflare's global networkYour site is built ahead of time into plain web pages and served from there.
Monitored every five minutesFrom outside our hosting.See our status page
Security fixes checked every six hoursAn automated check runs across every site we manage.
Every version keptAny earlier version can be restored.
Content Security PolicyEvery page carries one.
Where your site runs
Built ahead of time
Your site is built ahead of time into plain web pages and served from Cloudflare's global network. There's no database or admin login on the public site for anyone to break into.
HTTPS everywhere
Every page is served over HTTPS with certificates that renew automatically, and browsers are told to always use the secure connection.
Security updates
Checked before and after launch
Every change is checked for known high- and critical-severity vulnerabilities before it can merge, and each site is checked again weekly.
Fixes prepared automatically
An automated check runs across every site we manage every six hours and prepares fixes when a vulnerability is found.
A person approves every release
Only small patch releases that pass every check are merged automatically; anything bigger is reviewed by a person. A person approves every release to the live site.
Built-in protections
Every page tells browsers to:
- use HTTPS only
- refuse to run files disguised as another type
- block other sites from framing your pages
- limit what referring information is shared
- turn off camera, microphone, location and payment access the site doesn't use
Content Security Policy
Every page also carries a Content Security Policy, which tells browsers to run scripts only from the services the site actually uses, such as the spam check on forms and the analytics you've chosen, and to send data only to those services. Code injected from anywhere else is refused.
Monitoring and recovery
Monitoring
We check our sites every five minutes from outside our hosting, and an outage alerts us by email and phone. Anyone can see current status on our public status page.
Backups and recovery
Every version of your site's code and content is kept in version control. Any earlier version can be restored.
Your own hosting account
Run in your account
For a public agency, the site can run in its own Cloudflare account, ideally owned by the agency, with us added as a member. If you ever move on, the handover is simple: we transfer the code to you and remove our access.
Your domain stays put
Your domain stays with your current DNS provider; your IT adds a few records we provide.
Forms and privacy
Contact forms are protected from spam bots by Cloudflare Turnstile, and submissions are delivered to you by email through Postmark. Our privacy policy lists every service a site uses.
Accessibility
Scanned before and after launch
Every release is scanned against WCAG 2.2 AA with an automated tool before it goes live. After launch, the live site is scanned weekly against WCAG 2.2 AA, with dated records kept. Automated scans catch many common accessibility problems, but not all of them. So while your care plan is active, anything a resident or your staff reports is looked at within 2 business days and fixed within 10, at no extra charge.
No accessibility overlays
Overlay widgets add a toolbar on top of a website. They don't fix the site's underlying code, so the problems that block people stay in place, and screen-reader users often find the widget gets in the way. In 2025 the Federal Trade Commission fined the best-known overlay company for claiming its tool made websites compliant. We build accessibility into the site itself. Visitors can still enlarge text and use high-contrast settings, because the site respects the settings in their own browser and device.
Questions about security?
Need a security questionnaire filled in for a bid, or want to report a problem? Send it through the form, or write to contracts@pagesteady.com.