Loading…
Security is fundamental to FixMyWeb. Here is how we protect your data and ensure safe scanning.
All data in transit is encrypted using TLS 1.3. We enforce HSTS with preload and automatic HTTPS redirection across all endpoints.
Scanned URLs and accessibility reports are processed in real-time. Free scans are not stored. Pro accounts can opt-in to scan history with data retention policies.
Our scanner validates all target URLs before processing. Internal network addresses, localhost, and private IP ranges are blocked to prevent Server-Side Request Forgery.
API and scan requests are rate-limited per IP and per account. Free tier: 3 scans/month. Vercel Edge provides automatic DDoS mitigation.
FixMyWeb is fully GDPR-compliant. We provide data export, deletion on request, and transparent data processing policies. We do not sell or share user data.
Strict Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers are set on all responses.
User accounts use bcrypt-hashed passwords and secure session tokens. API keys are randomly generated and can be revoked at any time from the dashboard.
Hosted on Vercel's edge network with global distribution, automatic failover, and SOC 2 Type II compliance. Monitored 24/7.
If you discover a security vulnerability, please report it via security@fixmyweb.dev. We respond to all reports within 48 hours.