Security
SiteOptima separates authentication, commercial entitlement and provider evidence so that a successful login or redirect cannot silently become authorization.
Passwords use one-way scrypt hashing with automatic upgrade of older hashes. Session, verification and password-reset secrets are stored only as hashes, never in raw form.
The public service uses HTTPS with HSTS and restrictive browser security headers including Content Security Policy, frame blocking, content-type protection and limited browser permissions.
Administrator sign-ins require the account password plus a short-lived, single-use verification code delivered by email. Administrative sessions are created only after the second factor succeeds and expire after 12 hours.
Signing in is not enough to open a paid workspace. SiteOptima evaluates persisted identity, organization and plan evidence before granting access.
Browser return URLs never grant workspace access. Stripe events require signature verification, exact subscription/customer/Price linkage and idempotent persisted provider evidence.
Audit targets are restricted to public HTTP/HTTPS destinations. Private, loopback and reserved network addresses are rejected and redirects are revalidated before connection.
PDF generation runs Chromium with its sandbox enabled, JavaScript disabled and outbound network requests blocked before audit-derived report HTML is loaded.
Persisted crawl headers use a bounded technical allowlist. Authentication cookies, authorization headers and arbitrary secret-like response headers are not retained in page snapshots.
Password-reset links are short-lived and single-use. A successful reset invalidates existing sessions, and authentication endpoints are rate-limited through Redis.
Customer-facing billing surfaces redact payment-provider customer, subscription and price identifiers, while private API responses are returned with no-store semantics where appropriate.
SiteOptima keeps technical conclusions evidence-based and bounded. It does not promise rankings, indexation, traffic, conversion or business outcomes.
This page describes product controls currently represented in SiteOptima source. It does not claim an external security certification, regulatory attestation, penetration-test result or service-level guarantee.