← HeyAda Say hi 👋
Case study · Website security

Security score 58 → 84

We hardened a live recruitment website from "Sufficient" to "Good Health" on Singapore's government cyber-hygiene check — in about a day, zero downtime, zero added cost.

CSA-verifiedSecurity headersHSTSDNSSECTLS 1.3
Before · 18 Aug
58%
Sufficient
no security headers · no HSTS · no DNSSEC
After · 19 Aug
84%
Good Health
headers · HSTS · CSP · DNSSEC · TLS 1.3
The climb — 4 scans, ~1 day
58636884
Verified by CSA Internet Hygiene Portal · Cyber Security Agency of Singapore
See the actual government reports: before · 58% (PDF)  ·  after · 84% (PDF)
+26points · 58 → 84
~1 day4 scans to Good Health
0downtime · 0 added cost
Govtool · independently verified
Where it started

A working site that was quietly under-protected.

Singapore's Cyber Security Agency runs a free public tool — the Internet Hygiene Portal — that scores any website on its real security posture: HTTPS/TLS, security headers, HSTS, DNSSEC and more. Run against a live recruitment site (JTE Recruit), it came back 58% — "Sufficient" (orange). HTTPS was on, but the deeper protections weren't: no security headers, no HSTS, no DNSSEC. Nothing "broken" — just quietly exposed, the way most SME sites are.

Most business owners have no idea this score exists — until a client, an insurer, or a compliance check asks for it. It's the government's own yardstick, so you can't argue with it.
Cyber Health CheckBefore hardening · 18 Aug
HTTPS / encryption on
Security headers
HSTS (forced HTTPS)
DNSSEC
58%Sufficient
What I actually did

Hardened, layer by layer — no redesign, no downtime.

No new site, no disruption to anyone using it. Just the security layers the check looks for, added properly and re-scanned until it read green:

🧱

Security headers + CSP

Added the HTTP security headers browsers look for — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — closing the common clickjacking and content-injection gaps.

🔒

HSTS + TLS 1.3

Forced HTTPS for every visit with HSTS, and confirmed modern TLS 1.3 encryption end to end — so the connection can't be silently downgraded.

🌐

DNSSEC

Enabled DNSSEC so the domain's DNS answers are cryptographically signed — protecting visitors from being quietly redirected to a fake copy of the site.

Re-scan to green

Re-ran the government check after each change — 58 → 63 → 68 → 84 — until it read "Good Health", so the result is independently verified, not self-reported.

This is a website security score (HTTPS/TLS, headers, HSTS, DNSSEC) — not a speed, PageSpeed or Lighthouse score. No performance claims are made.
Why it matters

Security is trust — and it's the floor under PDPA.

A "Not fully secure" site quietly costs you: browser warnings, lower trust, and a weak answer when a client or insurer asks about your data protection. And if your site collects any personal data — a contact form, a booking, an enquiry — this exact security baseline (encryption, headers, safe DNS) is what PDPA expects you to have in place. Hardening the site isn't just hygiene; it's the technical half of being compliant.

The same hands that build your site can prove it's secure.

Most studios build and walk away. HeyAda builds, hardens, and hands you a government-verified score you can show anyone — then keeps you covered on the data-protection side too.

Want your score?

Free check first. Fix only if it needs it.

No jargon, no scare tactics. I run the government check on your site, show you exactly where you stand, and only if it's worth fixing do we harden it — same result, independently verified.

Step 1 · Free

Cyber health check

I run your site through the CSA Internet Hygiene Portal and send you the score + a plain-English list of what's exposed. No cost, no obligation.

Step 2 · Fixed fee

Done-for-you hardening

If it needs work, I add the security layers and re-scan until it reads "Good Health" — a one-off fixed fee, zero downtime. Pairs naturally with a website refresh or DPO retainer.

Is your site actually secure?

Most aren't — and you can't tell from the outside. Let me run the free government check and show you.

Get my free security check →