Network and privacy review
Prepared August 24, 2026 · Print or save this page as PDF for a school technology review.
Service summary
PurposeIndependent ASVAB and AFQT test preparation for students.
Primary URLhttps://asvabforge.com
Recommended categoryEducation, Test Preparation, or Training.
AdvertisingNo advertising networks and no targeted advertising.
DownloadsNo executable downloads, extensions, pop-ups, or URL shorteners required.
Network allowlist
Requiredasvabforge.com — application pages, account access, and study progress.
Required for signupchallenges.cloudflare.com — Cloudflare Turnstile bot-prevention challenge.
Not required for core studystatic.cloudflareinsights.com and cloudflareinsights.com — aggregate performance analytics; blocking these should not prevent core study use.
Do not allowlist the shared hosting address in place of the custom domain. Schools should keep their normal malware inspection, DNS controls, and acceptable-use policies enabled.
Student information
RequiredUsername, verified email address, and password hash.
Study recordsAnswers, response times, mistakes, goals, paused sessions, and progress.
Not requestedDate of birth, home address, phone number, Social Security number, military record, payment information, or precise location.
Student controlsAuthenticated users can download their data and permanently delete their account and learner records.
Security controls
- HTTPS encryption in transit and strict transport security.
- Salted password hashing; readable passwords are not stored.
- Secure, HTTP-only session cookies with inactivity expiration.
- Email verification and expiring password-recovery links.
- Session revocation after password reset.
- Bot protection, request throttling, cross-site mutation blocking, size limits, anti-framing controls, and restrictive browser permissions.
Retention and school-use boundary
The public service currently retains verified accounts and study records until the user deletes the account. It does not yet provide district-managed retention windows or bulk school deletion. Self-service registration is limited to people age 13 or older. A district-wide or under-13 deployment should not begin until the school and ASVAB Forge establish written terms covering authorization, retention, deletion, incident response, and school-controlled provisioning.
Third-party services
CloudflareHosting, security challenge, and aggregate web analytics.
ResendAccount verification and password-recovery email delivery.
Sales or targeted adsASVAB Forge states that student information is not sold or used for targeted advertising.
Administrator review checklist
- □ Confirm the site is categorized as Education/Test Preparation.
- □ Test the primary domain and signup challenge on the student network.
- □ Review the Privacy Policy and Terms of Use.
- □ Decide whether student email accounts may be used.
- □ Do not assign the public service to students under 13 without an authorized arrangement.
- □ Establish written retention and incident-response terms before a district-wide rollout.