Security fix guides

Fix your website security, step by step

Plain-language guides to the most common gaps we find. Not sure what applies to you? Run a free scan first.

Scan your site free

Encryption & transport

How to enable HTTPS on your website
Serve your site over HTTPS so traffic is encrypted and browsers stop flagging it as Not Secure.
How to fix an expired or untrusted TLS certificate
Renew and correctly install your TLS certificate so browsers trust your site instead of showing a full-page warning.
How to redirect HTTP to HTTPS
Force every visitor onto the encrypted version of your site with a permanent redirect.
How to add a strong HSTS header
Tell browsers to only ever connect to your site over HTTPS, closing the gap before the redirect.

Web application headers

How to add a Content-Security-Policy (and avoid unsafe-inline)
Lock down which scripts can run so a single injection can't take over your page.
How to prevent clickjacking (X-Frame-Options / frame-ancestors)
Stop attackers from embedding your site in a hidden frame to trick users into clicking.
How to stop MIME-sniffing with X-Content-Type-Options
Prevent browsers from guessing (and mis-executing) file types.
How to set a Referrer-Policy
Stop full URLs (and any tokens in them) leaking to third-party sites.
How to set a Permissions-Policy
Control which powerful browser features (camera, mic, geolocation) your site and its embeds can use.
How to set Secure, HttpOnly, and SameSite cookie flags
Harden your cookies so they can't be stolen over plain HTTP, read by scripts, or replayed cross-site.
How to stop leaking your server/framework version
Remove version banners so attackers can't shortlist exploits for your exact stack.

Email spoofing & delivery

How to add an SPF record
Publish which servers may send email as your domain so spoofed mail gets rejected.
How to add and enforce a DMARC record
Tell receiving servers what to do with mail that fails SPF/DKIM — and get reports.
How to set up MTA-STS
Force other mail servers to use encrypted, authenticated TLS when delivering to you.
How to add SMTP TLS reporting (TLS-RPT)
Get notified when mail delivery to your domain fails to encrypt.

Governance & disclosure

How to add a CAA record
Restrict which certificate authorities are allowed to issue certificates for your domain.
How to add a security.txt file
Give security researchers a clear, standard way to report vulnerabilities to you.

Privacy and cookie preferences

We use strictly necessary cookies to run the site. Analytics, marketing, and AI assistant telemetry are optional and disabled until you choose. You can update consent any time in Cookie Settings.

Some infrastructure cookies, such as load balancer routing cookies, are essential for service delivery. Details: Cookie Policy