Iris Bridge Therapy

A counseling practice site that almost shipped a broken security policy.

Iris Bridge Therapy needed a calm, trustworthy site for a real counseling practice, with accurate medical-business schema so search engines and AI crawlers represent it correctly. But the build also surfaced a serious near-miss: a static script-src 'self' Content Security Policy was nearly shipped to production, and that exact policy would have blocked Next.js's own hydration script from running at all.

Catching that before it went live meant the site needed a different security model entirely, not just a tweak to the existing one.

A per-request nonce CSP, verified against real response headers.

• Per-request nonce CSP: implemented via proxy.ts (Next 16's renamed middleware.ts), generating a fresh nonce on every request instead of a static allowlist that would have broken the app.
• Fully dynamic rendering: the site runs force-dynamic site-wide, a direct consequence of nonces requiring per-request rendering rather than static generation.
• Real schema markup: MedicalBusiness JSON-LD on the main site plus a Person schema on the About page, not a generic LocalBusiness stand-in.
• Resend contact form: the same Zod-validated, Resend-backed pattern used across the rest of the portfolio.
• Header-and-body nonce verification: the fix was confirmed by matching the nonce in the response header against the nonce actually rendered in the page body on the same real request, not just a curl check for expected header strings.

Live since August 2026, with a CSP that actually works.

irisbridgetherapy.com has been live since 2026-08-13 on Vercel, with a security policy that's been verified against real production responses rather than assumed correct. The near-miss here became a standing rule: never trust a header check alone for anything touching script execution, always verify against a real build.