Growth · Web design and build · 08
Security hardening of the marketing stack
Security hardening of the marketing stack applies the assurance side of the firm to the website and the tools around it: security headers and content security policy, TLS and DNS configuration, email authentication with SPF, DKIM and DMARC, dependency and third-party tag inventory, form handling, account and access control on the platforms marketing uses, and a launch review before anything goes live. It is needed because marketing sites and tools are attacked, because a compromised site damages trust faster than any campaign builds it, because a leaking tag is a compliance failure, and because the organization’s growth stack is production infrastructure whether or not it is treated as one. The work produces the launch security review, the hardened configuration, the access and account review, and, on higher plans, annual review and monitoring.
Scope
What the review covers.
- Security headers and content security policy
- TLS, DNS, domain and email authentication: SPF, DKIM, DMARC
- Dependency, script and third-party tag inventory with removal or justification
- Form handling, spam protection and data handling
- Account, access and MFA review on marketing platforms
- Launch review and, where included, annual review and monitoring
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Launch security review | Findings and fixes before go-live |
| Hardened configuration | Headers, policy, TLS, DNS, email authentication |
| Stack inventory | Tags, dependencies, platforms, accounts |
| Access review | Accounts, roles and MFA on marketing platforms |
Prerequisites
What we need from you.
- Access to the site, DNS, email and the marketing platforms in use
- The list of agencies and vendors with access to those platforms
- Agreement on the content security policy’s allowed sources
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Why would a security firm review a marketing site?
Because it is where attackers go to impersonate, inject and skim, and because the same firm that assures your controls should not leave your public face unexamined.
Will a content security policy break our tools?
Each tool is listed and allowed explicitly. Tools that cannot be justified are removed, which is usually an improvement.
Is monitoring included?
On higher plans, annual review and monitoring are included. Every plan includes the launch review.