Security Solutions
If your site takes logins or payments, security is not an optional extra.
Why this
matters.
Most small business sites are not attacked by anyone clever. They are found by automated scanners looking for the same handful of well-known holes, and they fall over because nobody closed them.
I build the basics in from the start rather than bolting them on later: proper authentication, validated inputs, sensible headers, and no customer data sitting somewhere it should not be. POPIA is also a real obligation now, not a nice-to-have.
The important bits.
01
Authentication done properly
Sessions, hashed passwords and access control that actually holds, rather than a login that only looks like one.
02
Inputs never trusted
Everything a user submits gets validated and escaped, which closes off injection and cross-site scripting attacks.
03
Headers and HTTPS
The security headers most sites skip, plus SSL configured correctly so browsers stop warning your customers.
04
Data kept sensibly
Only what you need, stored properly, with POPIA obligations taken seriously rather than ignored.
What I do
- Secure authentication and sessions
- HTTPS and SSL configuration
- Input validation and sanitisation
- Security headers implementation
- Rate limiting to stop abuse
- Cross-site scripting protection
- SQL injection prevention
- Dependency audits and updates
- Secure password hashing
Start to finish.
Review what exists
I go through how data flows through your site and where the actual risks are, not a generic checklist.
Close the gaps
Fixes prioritised by real risk, starting with anything that exposes customer data or lets someone in.
Keep it current
Dependencies get updated and things get rechecked, because security is not a job you finish once.
Handling customer data?
If your site has logins, payments or personal information on it, it is worth having someone actually look.