Accessibility (WCAG 2.1 AA), Security Headers & Cookie-Free Privacy Audit

2. Four Privacy, Security & Accessibility Guardrails

• 1. Cookie-Free & Zero-Pixel Intake Architecture (HHS OCR HIPAA Tracking-Pixel Guidance + ADA Title III (WCAG 2.1 AA)): Eliminates third-party retargeting pixels on appointment and enquiry pages so sensitive visitor intent is never broadcast to ad networks.
• 2. Hardened HTTP Security Header Suite: Enforces HSTS (max-age=63072000; includeSubDomains), Content-Security-Policy, X-Content-Type-Options: nosniff, and Frame-Ancestors protection.
• 3. WCAG 2.1 AA Semantic XHTML Forms: Every input uses explicit <label for="..."> associations, high-contrast focus rings (>= 4.5:1), and native keyboard navigation without inaccessible JS dropdowns.
• 4. CAPTCHA-Free CSRF & Honeypot Defense: Replaces frustrating image-grid CAPTCHAs with cryptographic double-submit CSRF cookies and hidden honeypot fields—preserving both accessibility and conversion rates.

# Hardened NGINX / Edge Security Headers for apexclimate.com (Healthcare, Dental & MedSpa Patient Websites)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(self)" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://checkout.stripe.com;" always;

Replaces inaccessible CAPTCHA puzzles and unlabelled inputs with semantic labels, CSRF tokens, and a screen-reader-safe honeypot:

<!-- WCAG 2.1 AA + CSRF-Hardened Enquiry Form (apexclimate.com) -->
<form action="https://apexclimate.com/contact" method="post" aria-labelledby="enquiry-heading">
  <h2 id="enquiry-heading">Request a Confidential Consultation</h2>
  <input type="hidden" name="csrf_token" value="{{.CSRFToken}}" />
  <div style="position:absolute; left:-9999px;" aria-hidden="true">
    <label for="hp-company-fax">Leave this field blank</label>
    <input type="text" id="hp-company-fax" name="company_fax" tabindex="-1" autocomplete="off" />
  </div>
  <div>
    <label for="client-name">Full Name (Required)</label>
    <input type="text" id="client-name" name="name" autocomplete="name" required="required" />
  </div>
  <div>
    <label for="client-email">Work or Personal Email (Required)</label>
    <input type="email" id="client-email" name="email" autocomplete="email" required="required" />
  </div>
  <button type="submit">Submit Secure Enquiry</button>
</form>

Verify Your Website TLS, Headers & Forms ($148)

Activate a 30-day OnBits Monitor pilot for apexclimate.com ($148 via Stripe) to verify HTTPS headers, TLS certificate expiration, and weekly synthetic enquiry form delivery.

Deploy 8-Second Missed-Call SMS Recovery ($1,500)

Add A2P 10DLC compliant missed-call SMS follow-up and instant calendar booking for apexclimate.com in 24 hours without adding third-party tracking scripts to your website.