Security
A guestbook holds other people's words and your e-mail address, and it deserves the same care as any other account. This page lists what UltraGuest does, in plain terms; the Privacy Policy has the formal version.
Encrypted, and behind Cloudflare
Every page, guestbook pages included, is served over HTTPS, and plain http addresses are redirected. Cloudflare sits in front of the site for protection and delivery, and the server accepts web traffic only from Cloudflare's network. The server runs at DigitalOcean in New York on current software, with the security updates that come with it.
Your account
Passwords are stored as bcrypt hashes; nobody at UltraGuest can read yours, and we never send a password by e-mail. A forgotten password is replaced through a link that works once and expires within the hour, and your e-mail address is confirmed through a signed link in the same way. Ten wrong passwords for an address within fifteen minutes lock it for the rest of that quarter hour, and thirty attempts from one IP address in the same time are refused outright, which makes guessing impractical. Changing your e-mail address or deleting the account asks for your password again.
Forms that bots cannot abuse
The sign form, the signup form, the support form and the lost-password form all carry a Cloudflare Turnstile check, and every form is protected against forged submissions. Messages are stored as plain text: whatever a visitor types is shown as text, never run as HTML or script. Your own header text may contain HTML, but scripts and event handlers are removed from it, so nothing a guestbook shows can act on your visitors' browsers.
Content that must not be there
Every post is checked at once against rules for illegal material, fraud, hate propaganda and the usual spam; recent posts are re-checked every six hours and everything once a week. Material that sexually exploits children, and advertising for it, is removed and reported to the National Center for Missing & Exploited Children, as United States law requires. Every guestbook page carries a "Report abuse" link that reaches a person. The no spam page describes the rest of the protection.
Controls in your hands
You can block an IP address from posting, approve messages before they appear, switch on the word filter, and edit or remove anything: see manage messages. And you can leave at any time with a full copy of your data: see privacy.