SECURITY

## Site Security and Integrity

   Actions speak louder than words, and transparency is the act of choosing to be vulnerable and forthright.
This page is an act of transparency:  the site has been hardened where possible and is continuously monitored to ensure those protections stay active.

## Realtime Monitoring and Active Protection

Uptime Monitoring:  

Monitors: HTTPS connectivity, SSL certificate validity, Contact pages availability

Status updates automatically. No cookies or tracking involved.

Health Monitoring:  

Monitors: Availability, response time, 7 security headers

Status updates automatically. No cookies or tracking involved.

   This combination of layered shield defense and active protection fortifies the site against external threats and daily malware scanning protects against internal threats.  For a static poetry site, this level of defense is admittedly, overkill.  However, for the vulnerable viewer, they can rest assured that numerous precautions and protections are in place for their peace of mind.

## Protections In Place

Enabled: HTTPS Encryption — All connections force secure encryption; no unencrypted access allowed
Enabled: Clickjacking Prevention — X-Frame-Options blocks malicious embedding attempts
Enabled: Content-Type Validation — Prevents file-type confusion attacks
Enabled: Referrer Control — Sends no referrer data when clicking external links. (Other sites can’t see you came from this one.)
Enabled: Feature Restrictions — Disables intrusive browser APIs (geolocation, microphone, camera)
Enabled: HSTS Lock — Enforces HTTPS for one year minimum
Enabled: Cross-Origin-Opener-Policy — Isolates this page from other websites
Enabled: Cross-Origin-Resource-Policy — Protects this site's assets from being loaded or embedded by other websites.

Known Limitations

Disabled: Content-Security-Policy (CSP) — Would require constant maintenance as external resources change.
Disabled: Subresource Integrity (SRI) — Scripts verified via HTTPS-only loading.

   Note on Content-Security-Policy (CSP):
   We deliberately omit a strict CSP to preserve dynamic site features (audio players and embedded third-party tools). This caps our headers score at A rather than A+ and reduces defense-in-depth against cross-site scripting (XSS). We consider this an acceptable tradeoff for functionality; our remaining headers and full HTTPS encryption maintain a strong security baseline.

   Note on Subresource Integrity (SRI):
   Implementing SRI would break our privacy-focused analytics. This is a deliberate tradeoff: we accept reduced runtime script verification in order to preserve viewer anonymity. Third-party scripts load over HTTPS, which mitigates in-transit interception, though the additional end-to-end integrity checks that SRI provides are forgone.

## Verifiable Audits

Cookieserve scan results as of 09/08/26: 0 cookies detected

Clicking link will take you to a 3rd party verfification service

This confirms our site does not store tracking data in visitors' browsers.
All analytics are processed server-side with no persistent identifiers retained.

## Scheduled Self Audits

Continuous: SSL certificate expiry monitoring via StatusPulse, security headers and response time via Utilshed

Quarterly: Re-run security scans, verify grades stay current, zero cookies

Annually: Full infrastructure audit review

Annual Full Infrastructure Self-Audit Last Completed On: September 8, 2026

## Note on Security

For anyone who explores this site (and actually reads the Privacy Policy), you’ll notice a common theme throughout protecting my viewers where I reasonably can. The entire site’s structure is built upon a foundation of privacy, security and safety. There are transparent disclaimers and warnings throughout the site itself, a Caring Resources page (found in the footer) for viewers who are struggling or hurting, the primary contact form is end-to-end encrypted, the backup form sends an email to an encrypted server and the backend stuff (like analytics) utilizes aggregated data so that any viewers are unable to be specifically tracked.

I have built the site this way because—though it may not be the most robust—it does feature poems that are emotionally heavy, and the trauma section specifically, may bring forward some unpleasant memories or feelings. Those viewers may feel seen or heard for possibly the first time and I wish to honor their privacy and respect any request to reach out to say, “thank you; that was me”, or anything they may share.

For this: not just the services used, but the site itself is carefully constructed to respect privacy.
This page isn't about impressing anyone. It's about proving I take your safety seriously enough to let you verify it yourself.