How this site is built

This site makes claims about what a well-kept website looks like. Here is what that means for the site itself — with the date of measurement, so you can check.

What this site does not do

• No resources from third-party servers. No web font from Google, no script from a CDN, no embedded video, no tracking pixel.
• No executable JavaScript. Two script blocks exist, both application/ld+json: structured data for search engines, which is not executed. The mobile menu uses <details>, an HTML element.
• No cookies, and therefore no consent banner.
• No analytics.

What is set

Measured on 26 September 2026 against the response headers of https://conct.de/: Strict-Transport-Security (one year, including every subdomain — even those that send no such header themselves), Content-Security-Policy with default-src 'self', X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy, plus a security.txt under RFC 9116 with an expiry date.

The reading layout

Above a certain text size this page rearranges itself: the header stops sticking to the top — at large text it costs a quarter of the screen — lines get more leading, headings break more evenly, and long German compounds are hyphenated instead of squeezed.

It is triggered by your own setting, not by a button. Behind it is a breakpoint in em rather than pixels: a pixel breakpoint only sees the window, an em breakpoint sees the ratio of window to text. Set your browser's default font to 200 % and you get the reading layout even on a wide screen.

That is why there is no font-size widget here. Such a widget is almost always a sign that the layout breaks under the browser's own zoom, so a second path was built. It would need JavaScript and browser storage — both deliberately absent. And your browser setting applies to every site; ours would apply only to ours.

What was measured

• Reflow at 320 pixels: no horizontal scrolling, no overflowing element.
• Text at 200 % on 1024 pixels: no content outside the window. scrollWidth reports 18 pixels more than the window width, but that is a measurement artefact — scrollX stays at 0.
• 320 pixels and 200 % at the same time: a real defect. The menu button extended to 483 pixels, four were visible, and the page could not be scrolled. Fixed on 23 September 2026. Recorded in the accessibility statement.
• Dark mode: follows your device setting, without a switch and without storage.
• Motion: anyone who chose "reduce motion" gets no fade-ins.

If you find conct in your log

The service requests third-party sites — commissioned, or at the request of their operator. If you find the identification in your server log, Scan traffic explains what the request was, why it happened and how to object.

No AI in the audit path

The checks are a rule set, not a trained model. That is not a preference but a precondition: a finding we stand behind has to be justifiable — and an assessment whose grounds nobody can reconstruct is worthless in a dispute.

• Every finding comes from a rule. Each one carries the check that raised it and the measurement it rests on.
• The wording is fixed in advance. Description and remedy are held in the check itself, not written afresh on each run. Two firms with the same defect read the same text.
• No AI service in the program. The audit depends on seven libraries — for HTTP, the browser, HTML, YAML, templates, DNS and domain names. None of them calls a model, and there is no access to a provider that could.

What can still differ between two runs: the state of your site, the vulnerability database it is matched against, and the weight of a check — a hit rate is kept for each. What does not change is the rule the decision rests on.

Check it yourself

Enter conct.de in the form on the home page.