Security for the public site and the managed platform
Public pages are delivered as static files. Publishing and form handling run through separate services, with platform maintenance and security controls managed by Steadwatch.
Static pages on the public site
Visitors do not access a CMS login or plugin-based application at the public site address. Content changes use the managed publishing workflow. This reduces the software exposed through public pages while the platform and connected services still need security controls and maintenance.
- Static public pages
- Publishing through a separate workflow
- Separate form-processing services
Updates are ours, continuously
Dependencies are watched and updated on the platform rather than on your schedule, and every update goes through the same checks a content change does. You are told what happened in the monthly record.
- Advisories are tracked against everything the site ships.
- Updates run through publishing checks before release.
- Platform rollback can rebuild current content against an earlier platform version; compatibility and recovery checks still apply.
Browser security controls
Content Security Policy restricts permitted scripts and resource connections. Other response headers control transport, framing and referrer behavior. The policies and headers are checked as part of publishing and monitoring.
These controls reduce risk alongside code review, dependency maintenance and platform access controls.
- Strict transport security, frame refusal, and referrer limits are response headers, verified from outside.
- The policy is checked on every change, so anything that would weaken it stops there.
Records you receive
- A monthly record naming open advisories, updates applied, and certificate expiry.
- A header scan run from outside the network, dated.
- Security-questionnaire assistance where included in your plan or agreement.