A privacy product can't ship a marketing site stuffed with trackers. This site is static, carries no analytics or advertising cookies, locks down a strict Content-Security-Policy, and the holder waitlist proves eligibility with a read-only signature that can never move your funds.
There's no application server rendering pages and no third-party script running in your browser. The hardening is enforced at the edge with HTTP response headers — here's what's actually set.
The site ships no analytics SDKs and no advertising cookies — fitting, given where Searxly stands on surveillance advertising. Nothing here profiles you.
A Content-Security-Policy restricts scripts and styles to the site's own origin, forbids plugins and framing, and upgrades any insecure request — shrinking the attack surface for injection.
frame-ancestors 'none' and X-Frame-Options: DENY mean the site can't be embedded in an iframe to trick you into clicking something you didn't mean to.
X-Content-Type-Options: nosniff stops content-type confusion, and a strict referrer policy keeps your navigation from leaking across origins.
A Permissions-Policy disables camera, microphone, geolocation, USB, payment and ad-topics APIs — the site never asks, so they can't be abused.
Cross-Origin-Opener-Policy: same-origin isolates the browsing context from other origins, closing a class of cross-window attacks.
default-src 'self'; object-src 'none'; script-src 'self'; frame-ancestors 'none'; upgrade-insecure-requests (connect limited to the site + the Base RPC)DENYnosniffstrict-origin-when-cross-origincamera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()same-originEarly access is gated to $SEARXLY holders, so the waitlist has to confirm you control a wallet with a balance. It does that with the two safest operations in crypto: reading a public balance and asking for a one-time signature. No transaction is ever created, no funds move, and your private keys never leave your wallet.
Read-only and fund-safe by design — confirm the contract address against @Searxly first.