Protecting forms and data, legal transparency and the trust signals customers and search engines look for.
The minimum: server-side validation (not only in the browser), HTTPS, rate limiting per IP, a hidden honeypot field for bots, a fill-time check and, under attack, a CAPTCHA such as Cloudflare Turnstile. Send emails via SMTP with SPF and DKIM so they do not land in spam. Keep logs with IP addresses for a limited time.
A WAF (web application firewall) filters common attacks — SQL injection, password brute-forcing, malicious bots — before requests reach the site. For sites with a CMS and forms it is useful. But configure exceptions: aggressive protection modes block search and AI crawlers. Check that robots.txt, sitemap.xml and pages return 200 to bots, not a CAPTCHA.
Multi-factor authentication is a password plus a second factor: an authenticator-app code, a hardware key or a push confirmation. For a website it is essential on the CMS admin, hosting, domain registrar, Search Console and email: compromising any of these accounts lets an attacker replace the site or hijack the domain. SMS is the weakest second factor.
A backup lets you restore the site after a hack, a failed update or a hosting outage. The 3-2-1 rule: three copies, on two different media, one outside the main hosting. Back up both files and the database. Most importantly, test restoration regularly: a backup you cannot restore from is useless.
You must not publish invented reviews and present them as real — that is misleading advertising, and search engines can detect it. Real reviews with a name, photo, company name or project results are published with the client's written consent. The safe approach is to agree the text and attribution and keep proof of consent.
Company details — the legal entity's name, registration number (TIN, BIN, etc.) and address — show customers who they are signing with and where to send claims. For Yandex they are part of commercial factors; for Google, a trust signal (E-E-A-T). In some countries, such as Russia, sellers are legally required to publish them on their website.
A document in which a site explains what personal data it collects, why, on what legal basis, how long it keeps it, whom it shares it with and how a person can have it deleted or withdraw consent. It must be linked from forms and the footer. In Russia publishing one is mandatory (152-FZ), and Kazakhstan has a similar personal data law.
No. Data in the browser's localStorage or cookies stays on the visitor's device — you never receive it, and it disappears when the browser is cleared. A lead must be sent to the server over HTTPS and delivered to email or a CRM with restricted access. Store only the fields you actually need to reply.
Combined measures work better than any single one: a honeypot field, a minimum form-fill time, per-IP limits, link and stop-word filters, and a CAPTCHA only on suspicious activity so it does not get in people's way. Pre-moderate comments. Review logs regularly: a spike in requests to one form signals an attack.
No. Security is a process of reducing risk: CMS and plugin updates, least-privilege access, MFA, backups, monitoring and an incident response plan. Even large companies suffer breaches. An honest contractor describes the measures they take and how they act in an incident rather than promising that a breach is impossible.
Nothing found.
