Security
Security, in layers.
A managed host, a WordPress firewall, and Cloudflare in front of every site we run. Updates every month, and access you can see and revoke.
Updated
Sample data for a fictional organization.
What every site needs.
We take on a site only with all three in place. Each is billed by its provider at its published rates. Hosting is recurring, depends on your traffic, and you choose the plan size.
- A managed hostSuch as Kinsta, in your organization’s name. Hosting is a recurring cost at the host’s published rates, it depends on your traffic, and you choose the plan size. The host runs the servers, their uptime, and infrastructure backups, with 24/7 support of its own.
- A WordPress firewallWordfence Premium, licensed for your site. It blocks many known attacks between releases, including attacks on a plugin flaw made public before its fix.
- CloudflareYour domain on Cloudflare, with its web application firewall and DDoS mitigation turned on, in front of the host.
We also recommend
An activity log
A record of who changed what inside WordPress, and when. Combined with your host’s server access logs, those breadcrumbs let us piece together what happened after an incident.
The activity log in LFW MonitorHow we look after it.
As the retainer schedule and the services agreement set out. Response times are good-faith targets in business hours, not guarantees.
- Updates every monthWordPress, themes, and plugins, deployed from version control with automated checks after each release. Between updates, the firewalls block known attacks.
- Individual, limited accessAccounts you grant us, each limited to what the work needs, with multifactor authentication where it is offered. You can see and revoke exactly what we reach.
- Backups we checkYour host’s automatic backups. We check periodically that they run, and restore from them when needed. Your host’s plan sets how often and how long they are kept.
- If the site is compromisedTell us in the Client Portal at any hour. We begin restoring from your host’s backup by the next business day. Deeper investigation and cleanup are quoted first.
- Our mistakes, fixed firstIf one of our releases breaks something, fixing it is our highest-priority task in business hours, at no charge.
- Business hoursMonday to Friday, 9 a.m. to 5 p.m. Eastern (6 a.m. to 2 p.m. Pacific), excluding federal holidays. We generally do not offer after-hours or on-call coverage unless it is negotiated separately.
For your security review.
Government agencies can also have their public sites checked for vulnerabilities at no cost through CISA’s Cyber Hygiene services. Send us the reports, and fixes follow the monthly updates or a fixed-price quote.
- Security questionnairesOur answers to the HECVAT’s critical questions are published, and we fill in your institution’s own form from them. Read the answers
- Background checksCompleted before we have access, where your contract requires one.
- SubcontractorsWe stay responsible for the work. Under an agency’s contract, none works on your site without your written approval.
- SOC 2Your host’s own reports, such as SOC 2, cover its servers. LFW holds no SOC 2 report.
The Client Portal and LFW.com
Our own systems.
- Where the data is storedThe Client Portal, LFW.com’s forms, and the free audit run on LFW’s own server, hosted by Hetzner in Ashburn, Virginia. It is backed up every day, and each encrypted backup is copied to Cloudflare R2.
- No passwordsYou sign in with an emailed link that works once and expires after 15 minutes, or with a passkey. Requests for links are rate limited, and LFW’s own staff sign in the same way. There is no password to change.
- People at LFWLeland Fiegel, LFW’s founder and its one staff member as of September 27, 2026.
- RecordingSession recording (Replay) has been off on LFW.com since October 6, 2026. If it ever returns, it will be announced in the privacy policy first, and it is never added to a client’s site without the client’s written approval. It never records the Client Portal, sign-in pages, or anything you type.
- AI toolsWe use AI tools, including Claude, to draft and check work. Client data is never used to train models, and a person reviews every output before it reaches you.
Sample screen. The address is fictional.
Service providers.
LFW’s subprocessors, the companies that process data for it. The privacy policy names the same companies and what each receives.
- HetznerLFW’s server and database, in Ashburn, Virginia.
- CloudflareContent delivery and security for LFW.com, and storage for LFW’s encrypted backups.
- Google WorkspaceEmail and calendar.
- Amazon SESSending LFW’s email, such as sign-in links, audit reports, receipts and the LFW Weekly Recap.
- OpenAI and AnthropicAI assistance with research, drafting, software development, and administrative work.
Vulnerability disclosure
Report a vulnerability.
Found a security problem in LFW.com? Email the page or address involved, what you did, and what you saw. A screenshot or the exact request helps. If it is sensitive, say so in the first line, and we move to a private channel first.
- Two business daysA person repliesTo confirm we have your report.
- NextWe tell you the planWhether we can reproduce it, and what we intend to do.
- Usually within daysWe fix itConfirmed problems ship as normal operations work. We tell you when the fix is live.
- If you want itWe credit youNamed here once the fix is live, or anonymous if you prefer. We do not pay bounties.
- In scope
- LFW.com
- The Client Portal
- The free audit and the forms
- What we ask
- Do not read, change, or download data that is not yours. If you reach it by accident, stop and tell us.
- No denial-of-service tests, form spam, or brute-forcing of sign-in links.
- No social engineering, phishing, or physical access.
- Give us time to fix it before you publish. Two weeks after our confirmation is usually enough.
- What we promise
- If you follow these rules in good faith, we will not take legal action against you for the research, or report you to law enforcement for it.
- If someone else raises a claim about your research on this site, we will say publicly that you had our permission.
- Out of scope
- Findings that need an outdated browser or an already compromised device
- Automated scanner reports with no working demonstration
- Missing best-practice headers with no shown effect, rate-limit observations, and version disclosures on their own
- Problems in third-party services we use, such as our DNS or email providers
Send us your security questionnaire.
Or any question about this page. We reply within one business day.