It’s been a few months since the last update — mostly because we’ve been heads-down on two big pieces of work rather than lots of small ones. One is a top-to-bottom security review of the platform. The other is a new kind of site we can now build for you, with sign-in that fits the people using it.
A Full Security Review
We put the whole platform through a detailed security review this month — every service, every login path, every connection between the moving parts. It turned up a list of things worth tightening, and we’ve spent September working through it rather than letting it sit in a document.
What this means for you:
- Stricter checks on admin access. Every request to the management dashboard is now cryptographically verified, not just trusted because it looks right.
- Your site is walled off from everyone else’s. Sites can no longer reach the platform’s internal services, or each other, even in principle.
- Modern encryption only. We’ve retired support for outdated versions of TLS across every site we host.
- Tighter internal permissions. Our own tools now have access to exactly what they need to do their job, and nothing beyond it.
- Better protection against abusive traffic. More of the platform now sits behind filtering that catches automated attacks and floods before they reach your site.
None of this changes anything you’ll see day to day — which is rather the point. It’s the sort of work that only becomes visible when it hasn’t been done.
Custom Apps, With the Right Sign-In for Each Audience
Alongside WordPress and static sites, we now build custom web apps — and the interesting part is how people log into them. A single site can have public pages anyone can read, a portal where your customers sign in with a one-time code sent to their email or phone, and a staff area behind a proper Google sign-in. Three audiences, three levels of access, one site.
It suits anything with an “inside” and an “outside”: members’ areas, customer portals, booking systems, anywhere you need to show different people different things without making them all create yet another password.
What this means for you:
- One-time code sign-in for customers and members — no password to forget, no account to set up.
- Google sign-in for your own staff, using accounts you already manage.
- Public, private and staff-only areas living together on one domain.
The first of these are already running for a school and a hire business. If you’ve been putting off a project because “it needs a login bit”, it’s worth a conversation.
Private Areas on Static Sites
The same idea now works on our static sites. You can publish documentation, downloads or release notes openly, and keep a section — firmware, pricing, internal docs — behind a sign-in that only the people you’ve listed can get past. Fast, cheap hosting for the public half; a locked door on the rest.
Email From Your Own Domain
We’ve added a proper mail relay for customers who want to send email as you@yourdomain rather than through a generic address. It’s wired up so the big providers trust it — messages arrive in inboxes rather than spam folders, and pass the checks Gmail and Outlook increasingly insist on.
Steadier Underneath
Back in August we traced a run of brief site wobbles to the cheaper “spot” servers we’d been using for some background work — the sort that can be reclaimed at a moment’s notice. We’ve moved the affected pieces onto dedicated capacity and added protections so nothing important can be evicted mid-request. The wobbles stopped.
We also fixed the Clear Cache button in your dashboard, which had been clearing one layer of cache but not the other. It now does what it says.
Coming Soon
More on the custom app side — we’re building out the payments and reminders pieces now. As always, if there’s something you’d like to see, just ask.