01 / Transport
HTTPS · TLS 1.3 enforced
1.0 / 1.1 refused. Modern cipher suites only. Valid cert in date with auto-renewal monitored.
SSL/TLS primer →
Website security
HTTPS done right, TLS 1.3 enforced, HSTS preloaded, CSP that survives review.
A working SSL cert is the start, not the finish line. YesGov configures the full transport-security stack — TLS 1.2+ enforcement, HSTS preload, modern cipher suites, security headers, subresource integrity — and hosts the site on infrastructure we control.
What we configure
Eight controls per site, every site, every renewal.
Each one is verifiable from outside — the same checks our open-data scanner runs against every U.S. government agency, nightly.
02 / HSTS
HSTS preload eligibility
Browsers refuse plain HTTP for your domain — preload list submission included so it works on first visit too.
HSTS guide →03 / Headers
Security headers
CSP, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy — all set, all sane defaults.
Security headers →04 / SRI
Subresource integrity
Every third-party script loaded with an integrity hash. Tampering at the CDN doesn’t silently inject code on your pages.
SRI →05 / Patches
Patch & CMS hardening
WordPress / Drupal / static-site renderer patched on a documented cadence. Plugin inventory reviewed each quarter.
WordPress security →06 / Hosting
Containerized, hardened hosting
No consumer hosting. Sites run in isolated containers on hardware we operate — segmented network, scoped credentials.
Infrastructure →
Why it matters
Real attack classes blocked by a properly configured site.
Downgrade & session hijack
Attacker on hotel Wi-Fi or a compromised router forces the citizen’s browser to http://, intercepts forms and logins.
Blocked by: HSTS preload + full TLS 1.3
Hidden iframe overlay
Your page is iframed inside a hostile site, citizens click controls they can’t see, actions execute under their session.
Blocked by: X-Frame-Options + frame-ancestors
XSS via stored input
An attacker posts content that runs JavaScript in other visitors’ browsers, exfiltrating sessions or scraping form data.
Blocked by: Content-Security-Policy
Compromised third-party script
A widget vendor gets hacked, the JS they ship gets replaced, your site silently runs the attacker’s code.
Blocked by: subresource integrity hashes
Learn more
Free guides for every transport-security control.
SSL / TLS
How modern HTTPS works, what your cert chain has to look like, and how to renew automatically.
HTTPS & HSTS
Forced HTTPS, the preload list, and what happens on a citizen’s first visit.
Security headers
CSP, X-Frame, X-Content-Type, Referrer-Policy, Permissions-Policy — what to set and why.
WordPress hardening
Plugin hygiene, login lockdown, file-system permissions, and the attack surface to monitor.
Website scanning
What an external scan tells you about a site — and what it can’t see from outside.
TLS configuration
Cipher suites, protocol versions, OCSP stapling, and the modern Mozilla profile.
Next step
Get a hardened site without hiring an agency.
Custom design included. We rebuild or migrate the site, configure every transport-security control, host it on hardware we control, and document every step.