Home · Policy
Security
Effective 16 August 2026
This page describes how the website is built and protected. It is written to be checkable rather than reassuring: where something is a plan and not yet live, it says so.
1Encryption in transit
The site is served over HTTPS with TLS provided at the hosting edge. Plain-HTTP requests are redirected to HTTPS.
2A deliberately small attack surface
- The public pages carry no third-party scripts: no analytics, no ad tags, no CDN JavaScript. What runs in your browser was written for this site.
- There are no visitor accounts, no passwords to steal and no payment processing anywhere on the site.
- Fonts and images are served from our own domain.
3The enquiry form
The only thing a visitor can send us is the enquiry form, so it carries the site's abuse controls: a honeypot field invisible to people, a minimum-time check, and a proof-of-work challenge the browser solves before sending. It is cheap for one message and expensive for thousands. These checks are verified again on the server; the browser's word alone is not trusted. Submissions travel over HTTPS to our business mailbox.
4Software and updates
The site runs on WordPress with a deliberately short plugin list, on a current PHP version, with core and plugin updates applied on a schedule. The editing interface is restricted to our own staff with strong credentials.
5Backups
The site and its content are backed up on the hosting provider's schedule, and a working copy of the whole site is kept off the server, so it can be restored or moved independently of any one provider.
6What we do not do
- We do not run trackers, so there is no tracking data to breach.
- We do not store visitor passwords or payment details, because none exist.
- We do not sell or share data. See the Privacy page.
7No system is perfect
We keep the surface small precisely because any software can fail. If something does go wrong that affects information you sent us, we will tell you what happened and what we did about it.
8Reporting a security issue
If you believe you have found a vulnerability in this website, write to info@mahadevmetaliks.com with SECURITY in the subject line. Tell us what you found and how to reproduce it. We read these ourselves and will reply. Please do not test against the site in ways that degrade it for others.