Security
Security principles
Watchtower is a security product, so it holds itself to a high bar. These are the principles it is built on. We keep the details that would help an attacker to ourselves.
-
Checked before it arrives
Watchtower decides before a request reaches your site, so refused traffic never touches your pages, logins or data.
-
Refuse what doesn't belong
Each site's rules describe what it should allow. Requests that don't fit are turned away, and the refusal gives nothing useful back.
-
Bad behavior has consequences
Probing for weaknesses leads to blocks that follow the offender across every protected site, and repeat offenders are blocked for longer.
-
No single gate
Watchtower runs separately for each site it protects, so a problem in one place can't take every site down at once.
-
Every change on the record
Rule changes are written to a tamper-evident history, with who made them and why, and can be rolled back.
-
Hardened responses
Responses carry strict browser security headers, including a content security policy, so pages can't be framed by other sites or made to load code from elsewhere.
-
Only what it needs
Watchtower records the details it needs to make and explain each decision, and keeps them for a limited time.
-
Nothing third-party here
This website runs no scripts and loads no fonts, trackers or images from other companies. Everything comes from this domain.
Where we are
Watchtower protects websites today. PC, network-share and server monitoring are in development or coming next, and these principles apply to them as they are built.
Report a vulnerability
Found a security issue in Watchtower or this website? Please tell us. Our contact details are in our security.txt file.
Please don't point scanners at sites Watchtower protects. It will treat them as an attack and block you.