Encrypted (TLS)

This page was served over an encrypted TLS connection, so traffic between your browser and the site cannot be read in transit.

Valid certificate

Not checked yet — run the certificate check from Admin → Settings → Security.

HSTS enforced

Strict-Transport-Security is sent on HTTPS responses, so browsers refuse to fall back to unencrypted HTTP for six months after their first visit.

Data store sealed

Not checked yet — run the self-check from Admin → Settings → Security.

Hashed passwords

Passwords are stored as bcrypt hashes and never in readable form. Nobody — including the site operator — can retrieve your password; it can only be reset.

CSRF protected

Every form that changes data carries a single-use token tied to your session, so another site cannot make your browser act on your behalf.

XSS filtered

All member-supplied text is HTML-escaped before display, and rich formatting is rebuilt from a fixed whitelist rather than passed through — raw HTML from a post can never execute.

Hardened headers

Responses set X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and a Content-Security-Policy, limiting sniffing, clickjacking, referrer leakage and unexpected camera or microphone access.

Secure sessions

Session cookies are HttpOnly and SameSite, marked Secure on HTTPS, and can be revoked per device from your account settings.

Abuse limits

Logins, registrations and other sensitive actions are rate limited per address to blunt brute-force and automated abuse.

Screened uploads

Uploaded files are checked by inspecting their actual contents rather than trusting the filename, restricted to a small image whitelist, and stored under a newly generated random name.

Two-factor available

Accounts can enable app-based two-step verification (TOTP) from account settings.

Automatic backups

Every data file is snapshotted automatically on a daily schedule, before any maintenance task is allowed to touch it.