Glass box website
How secure is this website?
If you sell IT security, your own website should practise it. This page checks live in your browser what we promise – and you can verify everything yourself.
Last updated:
In short
How does solbytech protect its own website?
The website of solbytech gmbh is static – without CMS, database, login, cookies or tracking – and loads no content from third parties. A strict Content Security Policy with Trusted Types only allows our own scripts, HSTS enforces encrypted connections, and further security headers prevent clickjacking and data leaking to other sites.
Checked live, right now in your browser
Your browser determines the values below at this moment – not us. Without JavaScript there is no live check; the description still applies.
- 0cookies on this website
- 0requests to other servers while loading this page
- –of 9 security headers set
- –Content Security Policy
Defines where scripts, fonts and images may come from: only solbytech.at. Injected code (XSS) is blocked; Trusted Types additionally lock dangerous HTML assignments.
- –Strict-Transport-Security (HSTS)
For one year, your browser only connects to us encrypted – even if someone slips in an unencrypted address.
- –X-Frame-Options
Other sites cannot embed solbytech.at invisibly. This prevents clickjacking and fake forms in our name.
- –X-Content-Type-Options
The browser does not guess file types; an image file cannot be executed as a script.
- –Referrer-Policy
If you follow an external link, the target only learns “solbytech.at” – not which page you were reading.
- –Permissions-Policy
Camera, microphone, location, payment functions and advertising interfaces are switched off for this website.
- –Cross-Origin-Opener-Policy
Windows of other websites get no access to this window.
- –Cross-Origin-Resource-Policy
Our files may only be loaded by our own website.
- –Cross-Origin-Embedder-Policy
This page only embeds content that explicitly allows it. Together with the two entries above, this isolates the page against side-channel attacks.
What we deliberately do not do
- No tracking, no cookies, no cookie banner. Your visit is not analysed.
- No third parties. Fonts, images and scripts are on our server; no connection to Google, social media or advertising networks.
- No CMS, no database, no login. The website consists of finished files. What does not exist cannot be attacked.
- No input on other servers. Quick checks, the maturity check and the website assistant compute only in your browser.
- Verified building blocks. Dependencies are included with signature verification and without install scripts.
We are open about the limits: external links (such as booking via Microsoft Bookings) lead to websites with their own rules, and the web server itself is operated by our hosting provider.
Verify it yourself
Independent tools show the same – without having to trust us:
Frequently asked questions
- Is anything transmitted during the check?
- No. Your browser requests this page a second time from our own server and reads the response headers. No data goes to third parties and nothing is stored.
- Why is a static website more secure?
- There is no content management system, no database, no login and no plugins that could be attacked or forgotten in updates. Only finished files are delivered, so the attack surface is very small.
- How do I report a vulnerability?
- Confidentially by email to info@solbytech.at. The contact details are also available in machine-readable form in our security.txt according to RFC 9116.
As secure as this website?
We also assess your website, your servers and your cloud – in a free 30-minute intro call we discuss what makes sense.