Why this is safe to use
A URL shortener that blocks the dodgy stuff before it ever gets a short link.
- Bot-proofed front door. Every shortening request goes through a Cloudflare Turnstile bot check, AU/PH geo-fence, and an edge rate limiter.
- Phishing pattern blocking. Suspicious destinations are auto-rejected — high-abuse free hosts (web.app, freedynamicdns, ngrok, etc.), high-phishing TLDs (.tk .ml .top .xyz .shop and friends), and URLs containing telltale phishing keywords.
- No redirect chains. itsy.au URLs cannot themselves be shortened — kills the classic chain-shortener evasion.
- Per-IP rate limit. Five short-URL creations per IP per day from the public form. The internal API and admin (Google SSO'd CCM staff) are exempt.
- Audit log. Every create attempt — accepted or rejected — is logged with reason, so abuse patterns surface fast.
- Hardened headers. HSTS preload, strict CSP, cross-origin isolation (COOP/CORP), frame-ancestors none, no third-party scripts beyond Cloudflare Turnstile.
- CAA-pinned certs. Only specific Certificate Authorities can issue certificates for itsy.au — mis-issuance gets rejected at the CA level.
- Australian-hosted. Servers in Sydney. TLS 1.2+ enforced.