Security

Strict-Transport-Security with a one-year max-age, subdomain inclusion, and preload eligibility ensures browsers will only connect over HTTPS, even if someone types http:// manually. This eliminates man-in-the-middle attacksAttacks that intercept unencrypted HTTP traffic to inject malicious content or steal dataAttacks that intercept unencrypted HTTP traffic to inject malicious content or steal data on the initial connection.

X-Content-Type-Options: nosniff prevents browsers from guessing file types (MIME sniffing), which attackers exploit to execute scripts disguised as other file types. X-Frame-Options: DENY provides a second layer of clickjacking protection alongside our CSP frame-ancestors directive. Cross-Origin-Opener-Policy: same-origin isolates your site's browsing context, preventing cross-origin windows from accessing it.

Referrer-Policy: strict-origin-when-cross-origin limits what URL information is shared when users click outbound links. This protects your page structure from leaking to third parties. And our Permissions-Policy explicitly disables camera, microphone, geolocation, and payment APIs. A marketing website should never ask for hardware access.

Every client gets enterprise-grade DDoS mitigation and Web Application Firewall protection at the platform level. Cloudflare absorbs volumetric attacks before they consume any of your resources, and its WAF rules filter out SQL injection, cross-site scripting, and other common attack vectors automatically.

Bot management runs pre-request filtering, blocking scrapers, credential stuffers, and automated abuse before your application code ever executes. Because your site is statically pre-rendered, there's no origin server to overwhelm. The edge serves cached HTML directly, making traditional DDoS against your infrastructure effectively impossible.

Take the database. Multi-tenant setups rely on a single application-level query filter (like RLSRow Level Security: database policies that filter query results by tenant IDRow Level Security: database policies that filter query results by tenant ID) to keep tenants apart; if that filter has a bug, every tenant's data is exposed to every other tenant. We eliminate that risk entirely: your content lives in its own PostgreSQL instance on Supabase for blogging, and your store in its own SQLite database on Turso for e-commerce, each with its own credentials, its own backups, and its own network boundary.

The same principle runs through the whole stack. Your edge and hosting are your own Cloudflare account, your CMS is your own Strapi Cloud project, your search runs on a dedicated single-tenant Typesense cluster in your name, and your store is your own BigCommerce account. You can demonstrate data isolation at the infrastructure level, not just the application level, which is what auditors actually want to see.

And every one of those accounts is in your name from day one. We're added as administrators to run Workers, DNS, caching, and WAF rules on your behalf, never as the owner; billing, API tokens, and account ownership stay entirely yours, with full visibility into your infrastructure at any time. If you ever leave TechTailors, you revoke our access and keep everything, with no migration and nothing to negotiate. The isolation is permanent because the accounts were never ours to begin with.

HTML pages use Cache-Control: public, no-cache. Browsers may cache the page but must revalidate with the server before displaying it. This means returning visitors get fast 304 Not Modified responses while always seeing the latest deploy.

Hashed static assets (CSS, JS) get max-age=31536000, immutable (one year, no revalidation) because the filename changes on every build. Images and videos get a 30-day cache with the same immutable directive. This three-tier strategy ensures zero stale content while eliminating unnecessary round trips for assets that genuinely haven't changed.