I can enter “pricing” and “contact” and get to at least the next step. I haven’t tried actually registering them. You should probably ban such things, maybe some others you’d like to reserve too.

I haven’t tried circumventing the client-side restrictions on which characters are allowed at all, but the content shown at pages like https://eagledial.com/robots.txt makes me wonder. I don’t imagine it lets me put just anything into the page, so it’s probably not an attack vector (e.g. being able to register .well-known/acme-challenge things and get a TLS certificate for the domain, or convincing Google that you own the site via a site verification page at /google*.html), but something to think about and be careful of.

All of your “Follow Us” links have an empty href.

Angular favicon.ico.