Security — built for blowback
You fight scammers; some will look back. FightScammers is engineered to be the boring, locked-down target they skip.
Human verification everywhere it matters
Server-generated SVG captcha (rotated, noised, single-use), honeypot field and a timing trap on registration, sign-in, password reset and contact. Bots bounce before they touch your data.
Two-factor authentication
Optional 6-digit emailed code on every member sign-in; mandatory for admin logins. Codes are HMAC-hashed at rest, single-use, attempt-limited and expire in minutes.
Brute-force lockout + rate limiting
Sliding-window rate limits per IP and per account, plus 15-minute account lockout after 5 failed attempts. Sensitive endpoints (intake, submissions) are throttled too.
Session hardening
HttpOnly + SameSite cookies (Secure in production), strict session mode, ID regeneration at every privilege change, admin sessions expire after 45 minutes idle, forced logout supported per account.
CSRF on every state change
Every form and admin action carries a per-session token; mismatches are rejected with 403 before any database write.
Strict security headers
Content-Security-Policy, X-Frame-Options: DENY, nosniff, Referrer-Policy, Permissions-Policy, HSTS in production.
Hashed IPs, full audit trail
Visitor IPs are stored only as HMAC-SHA256 hashes (privacy-preserving but abusable-pattern-visible). Every security event — login, lockout, 2FA, admin action, payment — is written to an append-only audit log.
Least-privilege data access
Prepared statements everywhere (no SQL injection), output escaped (no XSS), admin back office isolated behind role + 2FA + separate idle timeout.
Payments without exposure
Card data never touches our servers — Stripe Checkout and signed, replay-guarded webhooks.
Blocked-IP shield
Admin can block hostile IPs in one click; blocked visitors get a hard 403 on every page.
Maintenance lock
A single switch takes the whole site behind a maintenance wall in an emergency, while admins retain access.
Found a security issue? Email csr@fightscammers.com — we treat reports as priority one.