Infrastructure
A small stack, locked down.
Cal West and Patriot are simple sites: pages, not a system someone has to log into. The working copy lives in Git on the machine I build from. A private GitHub repository keeps that history off the laptop. Visitors see the finished site. They do not see the files behind it.
01 · Local Git
Every change has a history before it is public.
A website edited in a browser theme has no useful memory. Someone changes a phone number, a heading, or a project date, and the previous version is gone. When the new line is wrong, the company cannot see what it replaced or put the old one back. That is how a public page drifts away from the yard.
How I use it
The site is a Git repository on the machine I work from. Each change is a commit with a note about why it was made: a redirect, a headline, a service page, a security header. I can compare the file to the last version before anything is published. The company gets a site that can be corrected precisely, and a record of what the public page used to say.
02 · GitHub
The code stays in a private repository.
The laptop is not the archive. A drive fails, a file is overwritten, and a site that lived only on one machine is a rebuild. A public repository would also hand a stranger the drafts, the form notes, and the path of every fix. The source of a contractor’s public face should not be browseable.
How I use it
Cal West and Patriot each have a private GitHub repository. Local Git is pushed there, so the history exists off the machine and is not on the open internet. Netlify publishes from that repository. What visitors get is the built site. What they do not get is the repository, the commit history, or an account that can edit the pages.
03 · The browser policy
The page is allowed to load only itself.
Most compromised small-business sites are not broken into through clever code. A script is pulled from another website, an old add-on is still running, or the page is placed inside someone else’s frame. The browser will allow that unless the site tells it not to. A contractor’s name on a poisoned page is a problem for bids, hiring, and the inbox.
How I use it
Both sites send the same rules with every page. Scripts, fonts, and images have to come from the site itself, and a form stays on the site. Another website cannot place the page inside its own frame. The browser will not guess what a file is, will not share the camera, microphone, or location, and keeps the connection on a secure address. No outside advertising or tracking tag is sitting in the page.
04 · The publish gate
A broken page does not go out.
A fast edit is how a heading gets duplicated, a project link dies, or the business details stop matching the phone number on the page. If that ships, search and the map listing disagree with the site, and the company looks unfinished. Security here is also quality: the public version should be the checked version.
How I use it
Patriot’s publish does two things before the files go live. The shared header and footer are written into every page, so the menu cannot drift. Then a check reads every page: one title, one description, one main heading, and every link on the site pointing at a page that exists. The business details that search reads have to be valid. If the check fails, the site does not update. Cal West follows the same browser rules.
05 · What is not on the server
Nothing on the public site can log in.
A login address is an invitation. Password resets, add-on updates, and database logins are the ordinary way a small company site gets taken over. The attacker does not need the yard. They need the login. Once they have it, the company’s own domain sends the mail.
How I use it
The published site has no database, no folder of add-ons, and no login page. Inquiry forms include a hidden field that catches automated spam, and they limit how much text can be sent. They go to the host, not to a script on another website. Fonts and photographs are files in the same folder as the pages. What the company gets is a public presence with very little to break into, and a private record of the code when something does need to change.