Nothing to log intoStatic build: no WordPress, no PHP, no database, no plugins, no login page. Most business websites are broken into through their own admin panel or an out of date plugin. That entire category of risk stops existing rather than being managed. Today the enquiry forms run on a plugin a full major version behind, missing two of the vendor's own security releases.
All six security headersContent security policy, strict transport security, clickjacking protection, referrer policy, permissions policy and content type protection, set at the edge. A firewall and bot rules that can tell a legitimate reader from an attacker. Hardened upload handling with file type and size gates. The current site has none of the six, and its edge protection returned an empty challenge page as HTTP 202, a success code, forty times over twenty minutes.
Licensed typefaces, self hostedBarlow Condensed and Barlow, licensed for web use and served from your own domain. Nothing loads a font, a script or an image from a third party host. The current stylesheet requests seven display families and delivers none: six are trial builds with the word Trial in the file name, one is another company's proprietary corporate face. It is a legal exposure and a design problem at once, and one change fixes both.
Staging that cannot be indexedEvery concept and preview build ships with indexing blocked in the page and blocked again in the robots file, and there is no deploy target for the concept until you approve one. The two controls come off together, deliberately, on launch day, as a single step on the written launch checklist.
Calculator verificationEvery constant is written on the page it is used on, sourced, and signed off by someone technical at Neumann Steel before the tool ships. Publishing a number a builder orders steel against is a serious act. If nobody will own the lap length coefficients, that tool does not ship and the page says why.
Hosting, documentedThe site runs in a dedicated Neumann group account that With Voss sets up and manages, built to carry every group website over time, with hosting on-charged as one line on the quarterly invoice. First year included. You own the work in full on final payment, everything is documented, and the account hands over intact whenever the group asks.
The short version for the board: the difference between a website that exists and a website that keeps its rankings, gets quoted by machines, publishes numbers people can order against, and cannot be broken into. None of it is on the current site. All of it is inside the fixed Phase 1 fee, and the security summary and launch checklist are handed over in writing.