This page documents the actual security posture of tek2serve.com — the hardening, headers, abuse protection and monitoring running right now. We sell cybersecurity, so our own house has to be in order. Audit us.
Multiple independent layers of protection on every endpoint. Every header set. Every log monitored. No third-party CDN doing the work — this is our own server, our own stack, our own responsibility.
Run any of these tests on this very domain. We score top marks because we earn them, not because we paid Cloudflare to score for us.
Industry-standard test for TLS configuration, cipher suites, certificate chain, HSTS, OCSP and known vulnerabilities. Target: A+.
Run test →Tests HTTP security headers, CSP, Subresource Integrity, cookies, redirects. Free, run by Mozilla.
Run test →Quick scan of HTTP response headers. Grades A-F based on best practices.
Run test →SPF, DKIM, DMARC, MX records, blacklist checks, reverse DNS, SMTP banner.
Run test →If you discover a vulnerability, see our security.txt for responsible disclosure contact and PGP details. We respond fast and credit reporters.
View security.txt →Most sites achieving these grades do so by hiding behind Cloudflare's CDN. We deliberately don't. Here's why.
If we put our own marketing site behind Cloudflare's WAF, we'd be selling cybersecurity services from behind someone else's firewall. That's a credibility problem. We harden our own server because the work is the proof.
Cloudflare terminates TLS at their edge, then re-encrypts to your origin. That's a legitimate trust handover most people accept — but it does mean a third party can see plaintext requests to your site. We don't ship that compromise.
Layered rate limiting, automated abuse blocking, application-level anomaly detection, and a hardened container runtime provide DDoS resilience and attack mitigation directly at the origin. It's harder to set up than clicking an orange cloud — that's the point.
Visitor IPs never touch a third-party CDN. No tracking pixels, no Google Fonts, no analytics scripts loading from external domains. Every byte is served from our own server. UK GDPR alignment is not lip service.
We welcome ethical security research. Please report vulnerabilities through the channels below — never via public disclosure first.
If you've found a vulnerability on this site, please report it responsibly. Don't post publicly first — give us a chance to fix it.
How to reach us: Email with details, reproduction steps, and impact. PGP available on request.
What we promise: Acknowledgement within 48 hours. Triage within 5 working days. Public credit if you want it. No legal action against good-faith research.
Scope: Anything served from this domain. Other client systems and our mail platform are separate scopes — please contact us first if you want to test elsewhere.
Please don't: Run automated scanners against production. Access data that isn't yours. Degrade availability for other users.