This site — built and secured in-house

Anyone who wants to see how a security engineer builds a public site when nobody is forcing shortcuts.

• Content Security Policy with no third-party scripts; HSTS, frame denial, referrer and permissions policies on every response
• Honeypot routes (.env, wp-login, xmlrpc) that return harmless bait and record the scanner — real attacker traffic shows up in the console
• Console behind a non-obvious path with bcrypt, rate limiting, lockout and constant-time login checks
• First-party visitor intelligence without cookies: sessions, organizations by network, referrers, clicks on the things that matter — no banner needed
• Bilingual content modeled as data; a security.txt for responsible disclosure

A company site or client portal built this way costs little more than a template and tells a very different story to the security-minded customer reading it.