Marketing sites are not exempt from attacks
Marketing sites are dismissed as “just static” yet still handle forms, scripts, and CMS tokens. A baseline belongs in every delivery: transport, headers, deps, secrets, permissions, backups, incident contacts. We put security beside SEO on the launch list. Below is a minimal executable set—not a pentest substitute. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Transport and hosts
Force HTTPS, HSTS when ready, canonical host, staging auth. Monitor cert expiry. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Security headers
CSP (tighten gradually), Referrer-Policy, X-Content-Type-Options, Permissions-Policy per stack. Document script exceptions. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Dependencies and supply chain
Lock versions, vuln scan, cut unused client libs. Third-party tags via consent and SRI where applicable. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Forms and anti-abuse
Server validation, rate limits, spam controls, minimize sensitive fields. Prevent success-page replay where needed. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
CMS and secrets
Least-privilege tokens, rotation, never in frontend bundles. Expiring preview links. Offboard accounts. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Content and impersonation
Official announcement channels, brand asset protection, official domain lists. Comms templates if cloned. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Minimal incident response
Who responds in one hour, how to rotate secrets, how to roll back. Contacts in delivery docs. Fold this into KSX discover→design→build→launch checks on staging so verbal alignment does not drop the requirement. Fold this into KSX Studio discover→design→build→launch: named owner, Definition of Done, staging proof, and rollback so verbal alignment does not drift.
Checklist
- 1HTTPS/host/staging auth confirmed
- 2Security header baseline deployed
- 3Dependency scanning in CI
- 4Form server validation + rate limits
- 5Secrets and CMS permission audit
Key takeaways
- Marketing sites need a written security baseline.
- Third-party scripts and forms are high-frequency risk surfaces.
- Response contacts and rollback are deliverables.
FAQ
- Need a WAF?
- Depends on threat/compliance; baseline and rate limits first, then WAF by risk.
- Is static export safe enough?
- Reduces server surface; supply chain, DNS, console, and form backends remain.
- Client wants many trackers?
- Use tag governance and CSP exception lists; explain performance and security cost.