Security score 58 → 84
We hardened a live recruitment website from "Sufficient" to "Good Health" on Singapore's government cyber-hygiene check — in about a day, zero downtime, zero added cost.
A working site that was quietly under-protected.
Singapore's Cyber Security Agency runs a free public tool — the Internet Hygiene Portal — that scores any website on its real security posture: HTTPS/TLS, security headers, HSTS, DNSSEC and more. Run against a live recruitment site (JTE Recruit), it came back 58% — "Sufficient" (orange). HTTPS was on, but the deeper protections weren't: no security headers, no HSTS, no DNSSEC. Nothing "broken" — just quietly exposed, the way most SME sites are.
Hardened, layer by layer — no redesign, no downtime.
No new site, no disruption to anyone using it. Just the security layers the check looks for, added properly and re-scanned until it read green:
Security headers + CSP
Added the HTTP security headers browsers look for — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — closing the common clickjacking and content-injection gaps.
HSTS + TLS 1.3
Forced HTTPS for every visit with HSTS, and confirmed modern TLS 1.3 encryption end to end — so the connection can't be silently downgraded.
DNSSEC
Enabled DNSSEC so the domain's DNS answers are cryptographically signed — protecting visitors from being quietly redirected to a fake copy of the site.
Re-scan to green
Re-ran the government check after each change — 58 → 63 → 68 → 84 — until it read "Good Health", so the result is independently verified, not self-reported.
Security is trust — and it's the floor under PDPA.
A "Not fully secure" site quietly costs you: browser warnings, lower trust, and a weak answer when a client or insurer asks about your data protection. And if your site collects any personal data — a contact form, a booking, an enquiry — this exact security baseline (encryption, headers, safe DNS) is what PDPA expects you to have in place. Hardening the site isn't just hygiene; it's the technical half of being compliant.
The same hands that build your site can prove it's secure.
Most studios build and walk away. HeyAda builds, hardens, and hands you a government-verified score you can show anyone — then keeps you covered on the data-protection side too.
Free check first. Fix only if it needs it.
No jargon, no scare tactics. I run the government check on your site, show you exactly where you stand, and only if it's worth fixing do we harden it — same result, independently verified.
Cyber health check
I run your site through the CSA Internet Hygiene Portal and send you the score + a plain-English list of what's exposed. No cost, no obligation.
Done-for-you hardening
If it needs work, I add the security layers and re-scan until it reads "Good Health" — a one-off fixed fee, zero downtime. Pairs naturally with a website refresh or DPO retainer.
Is your site actually secure?
Most aren't — and you can't tell from the outside. Let me run the free government check and show you.
Get my free security check →