Security score 58 → 84
We hardened a live recruitment website from "Sufficient" to "Good Health" on Singapore's government cyber-hygiene check — in about a day, zero downtime, zero added cost.
Lock down your site too
Tell us what you need and we'll send you a plain-English quote. Free, no obligation, and no sales call unless you ask.
A working site that was quietly under-protected.
Singapore's Cyber Security Agency runs a free public tool — the Internet Hygiene Portal — that scores any website on its real security posture: HTTPS/TLS, security headers, HSTS, DNSSEC and more. Run against a live recruitment site (JTE Recruit), it came back 58% — "Sufficient" (orange). HTTPS was on, but the deeper protections weren't: no security headers, no HSTS, no DNSSEC. Nothing "broken" — just quietly exposed, the way most SME sites are.
Hardened, layer by layer — no redesign, no downtime.
No new site, no disruption to anyone using it. Just the security layers the check looks for, added properly and re-scanned until it read green:
Security headers + CSP
Added the HTTP security headers browsers look for — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — closing the common clickjacking and content-injection gaps.
HSTS + TLS 1.3
Forced HTTPS for every visit with HSTS, and confirmed modern TLS 1.3 encryption end to end — so the connection can't be silently downgraded.
DNSSEC
Enabled DNSSEC so the domain's DNS answers are cryptographically signed — protecting visitors from being quietly redirected to a fake copy of the site.
Re-scan to green
Re-ran the government check after each change — 58 → 63 → 68 → 84 — until it read "Good Health", so the result is independently verified, not self-reported.
Security is trust — and it's the floor under PDPA.
A "Not fully secure" site quietly costs you: browser warnings, lower trust, and a weak answer when a client or insurer asks about your data protection. And if your site collects any personal data — a contact form, a booking, an enquiry — this exact security baseline (encryption, headers, safe DNS) is what PDPA expects you to have in place. Hardening the site isn't just hygiene; it's the technical half of being compliant.
The same hands that build your site can prove it's secure.
Most studios build and walk away. HeyAda builds, hardens, and hands you a government-verified score you can show anyone — then keeps you covered on the data-protection side too.
Free check first. Fix only if it needs it.
No jargon, no scare tactics. we run the government check on your site, show you exactly where you stand, and only if it's worth fixing do we harden it — same result, independently verified.
Cyber health check
we run your site through the CSA Internet Hygiene Portal and send you the score + a plain-English list of what's exposed. No cost, no obligation.
Done-for-you hardening
If it needs work, I add the security layers and re-scan until it reads "Good Health" — a one-off fixed fee, zero downtime. Pairs naturally with a website refresh or DPO retainer.
Is your site actually secure?
Most aren't — and you can't tell from the outside. Let me run the free government check and show you.
Get my free security check →