How this site is secured.
Everything below can be checked from outside, and most items link to a public tool that checks it. None of it needs to be taken on trust.
In transit
HTTPS only
Plain-HTTP and www requests get a permanent (308) redirect to https://arian747.com. HSTS tells browsers to use HTTPS for two years, subdomains included, and the header is preload-ready.
Check it: SSL Labs (opens a public checking tool)
In your browser
A strict content security policy
Scripts load only from this site and from Cloudflare's Turnstile bot check on the contact form. No other page can frame this one, which rules out clickjacking.
Check it: Mozilla HTTP Observatory (opens a public checking tool)The rest of the header set
No MIME sniffing, a strict referrer policy, camera, microphone and location switched off, and pages this site opens cannot reach back into it.
Check it: securityheaders.com (opens a public checking tool)No cookies, no trackers
Visitors get no cookies at all: no analytics, advertising or tracking cookies, and no consent banner, because there is nothing to consent to.
Domain and email
Signed DNS
The domain is DNSSEC-signed, so an answer about where arian747.com lives can be verified rather than trusted.
Check it: DNSViz (opens a public checking tool)Email that pretends to be this domain is refused
SPF names no other senders and DMARC is set to reject with strict alignment, so receiving servers are told to refuse mail that claims to come from arian747.com without this domain's signature.
Check it: internet.nl mail test (opens a public checking tool)
The contact form
Checked before it is stored
A message passes the Turnstile bot check, a hidden field that only bots fill in, and a per-address rate limit before it is kept.
Kept here, not with a form service
Messages go to this site's own database, where row-level security keeps them out of reach of the public key the pages use.
The admin
No password to steal
Signing in takes a one-time link emailed to an allowlisted address. The database itself refuses changes from anyone else, so a bug in a page cannot become a write.
Found a problem?
Report it privately. The address is in /.well-known/security.txt, and you will get an answer. How visitor data is handled is in the privacy notice.