Security
Security with every release, protection in use
A secure website starts with how it is built and needs ongoing attention after launch. That is why we combine custom development with security checks on every new release and Cloudflare as an additional protection layer for web traffic.
Why maintenance alone is not enough
The PHP security problems of October 2026 show that even properly maintained websites can become vulnerable. A flaw in the underlying PHP software can hit many websites at once, regardless of the quality of their own code. As soon as a fix is available, administrators must act quickly.
Our websites do not use PHP as an application layer. They are therefore not directly exposed to these specific PHP vulnerabilities. That is a concrete advantage of our architecture.
Our technology also uses shared software components in which new vulnerabilities can be found. That is why we combine our architecture with security checks on every new release and Cloudflare as an additional protection layer for web traffic.
So we limit risk through our technical choices and through recurring checks. The most recent scans found no security issues.
Sources
Custom built, with checks on the components used
We build every website to measure, with its own structure, functionality and data model, using modern frameworks and software libraries. Those components are checked too: custom work does not relieve us of the responsibility to keep shared software secure and up to date.
Our security approach rests on verifiable measures: correct access rights, safe data handling, code review and protection of web traffic.
Security checks on every new release
On every new release we run automated security scans. They examine the application code, the software libraries used and relevant database settings, so possible issues are found before a new version goes live. The checks cover, among others:
- Access rights: can users only view and change data they are allowed to?
- Database rules: is data shielded, with the right restrictions per user or role?
- Input handling: is data from forms and other input fields processed safely?
- Secret keys: is public code free of confidential API keys and other credentials?
- Sign-in flows: are there signs of errors in login, account recovery or token checks?
- Publicly reachable functions: can functions be called or abused unintentionally?
- Software libraries: do the versions used contain known vulnerabilities?
- Data exposure: can error messages, logs or functions leak personal or internal information?
Which checks apply depends on the website's functionality. An informational site has different concerns than a platform with user accounts, payments or confidential documents.
Code analysis and settings review
Static code analysis searches the source code for risky patterns and application-logic errors. For example a server function that checks whether someone is logged in, but not whether that person may open the requested file.
Library checks compare the packages and versions used against information on known vulnerabilities, so the software the custom work builds on is included.
Configuration and permission checks examine how access to data is set up. Good code and correct access rules must together prevent information reaching the wrong person.
These checks complement each other. Results are tied to the examined version, so every new release is judged on current scans.
Cloudflare protection on every website
On every website we implement the applicable security features of the free Cloudflare plan as standard, tuned to the site's functionality and use. This protection includes:
- DDoS protection: helps absorb attacks that try to overload the site with large volumes of traffic.
- Filtering of malicious requests: the available firewall rules help stop known attack patterns.
- Bot protection: Bot Fight Mode helps recognise and challenge simple unwanted bots and automated browsers.
This traffic protection complements application security. A firewall can stop unwanted requests; the website itself must then correctly decide which data and actions a visitor is allowed. Directly reachable backend services, such as an external database API, therefore keep their own access control.
Security stays part of maintenance
Every change can affect security. A new form, an extra user role or a link to an external service can introduce new concerns. That is why we repeat the security checks on every new release.
The most recent scans found no security issues. That result applies to the versions examined and the checks performed on them.
No scan or firewall can guarantee complete security. Our approach aims to limit risk, detect issues early and make security a fixed part of developing and maintaining our websites.
Measured with real visitors
Live from our own measurements, 75th percentile. We promise 90+ on mobile and 95+ on desktop.
Onafhankelijk digitaal advies
Start with the numbers, not with a quote.
Send a short description of your situation. Within 24 hours you will know whether an assessment makes sense in your case — and if it does not, I will say so.
- Reply within 24 hours
- Report with a source behind every finding
- Two to three weeks from access to report
- Maximum 3 cases per month, handled personally
Mark Lens
Who you get at the table