Connection and Edge Protection

Overview

From the moment you hit "Publish" to make your website live, Kanorio automatically applies multiple layers of security across network connections, edge nodes, and content storage. You don't need to purchase SSL certificates, rent firewalls, or install security plugins; every website on every plan enjoys the same level of foundational edge protection.

(To learn how our Cloudflare edge network and server-side architecture make your website faster, please refer to the previous guide: .)

1. The Browser Padlock: Fully Automated HTTPS and SSL Certificates

When visitors open your Kanorio website, the URL will always start with https://, and the browser address bar will display a padlock icon (or security settings indicator) representing a secure connection:

• HTTPS Encrypted Transmission: Think of HTTPS as replacing a postcard that anyone can read with a sealed envelope that only the sender and recipient can open. When visitors browse your site or fill out forms, the data in transit cannot be easily intercepted or tampered with by third parties.
• Automated SSL Certificate Issuance and Renewal: An SSL certificate is like a digital ID for your website. Whether you are using a free .kanorio.com domain or have connected your own custom domain, once DNS verification is complete, the system automatically requests, configures, and renews the certificate before it expires—zero manual maintenance required.
• Forced Secure Connection (HSTS): Public websites automatically redirect visitors who enter http:// to the encrypted https:// version and use browser security headers to ensure that all subsequent connections are encrypted.

If you have just connected a custom domain and don't see the padlock yet, it is usually because the DNS records were recently updated, global propagation is ongoing, or certificate issuance is still in progress. Please refer to for assistance.

2. The First Line of Defense: DDoS Mitigation and WAF

All published websites are served via the Cloudflare global edge network. When network traffic reaches your site, it passes through three automated checks at the perimeter:

DDoS Mitigation

DDoS attacks are like someone intentionally sending thousands of fake customers to crowd your storefront at the same time to prevent real customers from entering. Cloudflare's global network automatically identifies and absorbs these abnormal traffic spikes at the edge, protecting your site from being overwhelmed by malicious traffic.

Web Application Firewall (WAF)

The WAF acts like a professional security guard at your website's entrance. It monitors for known attack patterns 24/7 (such as attempts to inject malicious code, probe system vulnerabilities, or tamper with database queries) and intercepts them before they ever reach your website server.

Automated Bot Filtering

There are countless automated scanners roaming the internet, probing public websites. The edge network automatically challenges or blocks abnormal requests that are clearly not from human browsers, while allowing real visitors and legitimate search engine crawlers like Google and Bing to pass through. You can view how many suspicious requests have been blocked in your dashboard under .

3. Content Storage, File Uploads, and Browser Security

Beyond perimeter network defenses, Kanorio builds rigorous cleaning and isolation mechanisms into the core of how content is stored and rendered:

• Automatic Text and Link Sanitization: All module text and form inputs are automatically filtered for malicious scripts before storage (preventing XSS attacks). All button and link URLs are strictly checked against a protocol whitelist (allowing only https:, http:, mailto:, tel:, and internal paths), automatically rejecting dangerous link formats that might carry malicious code.
• File Integrity Checks, SVG Sanitization, and Photo Privacy: When you upload images, digital products, or archives, the server doesn't just look at the file extension; it inspects the internal file format and scans the archive structure to block embedded executables or system scripts. For SVG uploads, the system automatically strips out hidden dangerous scripts and event attributes. Additionally, when visitors download images from your public site, the system automatically removes GPS coordinates and camera metadata (see ).
• Third-Party Embed Whitelisting and Browser Security Headers: Public websites automatically include strict browser security headers (including Content Security Policy (CSP) and frame protection to prevent clickjacking). This limits the page to loading embedded content only from trusted sources (such as YouTube, Google Maps, Spotify, and other supported platforms) and prevents your site from being secretly embedded by malicious phishing sites.

(For information on how online forms and checkout pages prevent bots from spamming contact lists, please read the next guide: .)

4. Zero-Plugin Architecture, Unified Updates, and No "Site Infection" Maintenance

Traditional plugin-based site builders (like self-hosted or managed WordPress) often suffer from outdated third-party plugins, compatibility conflicts, or exposed login paths, leading to site infections or defacement that require manual cleanup and troubleshooting.

Kanorio eliminates these risks at the architectural level:

• Native Built-in Features, Zero Third-Party Plugins: All modules, forms, store features, and SEO tools are developed and maintained natively by the platform. No third-party plugins are ever required.
• Controlled Rendering, No Arbitrary Server-Side Code: The public site rendering service is decoupled from the core backend and database. We do not allow the upload or execution of arbitrary server-side scripts, fundamentally preventing remote code execution and backdoor injections.
• Unified Platform Security Updates and Patch Management: Our engineering team performs automated code security scans, secret detection, and regular dependency vulnerability patching before every deployment. We update the global edge nodes and core backend simultaneously. You never have to click "update" yourself, and you never have to worry about your site breaking after an update.

Related Documentation