Security fix guides
Fix your website security, step by step
Plain-language guides to the most common gaps we find. Not sure what applies to you? Run a free scan first.
Encryption & transport
How to enable HTTPS on your website
Serve your site over HTTPS so traffic is encrypted and browsers stop flagging it as Not Secure.
How to fix an expired or untrusted TLS certificate
Renew and correctly install your TLS certificate so browsers trust your site instead of showing a full-page warning.
How to redirect HTTP to HTTPS
Force every visitor onto the encrypted version of your site with a permanent redirect.
How to add a strong HSTS header
Tell browsers to only ever connect to your site over HTTPS, closing the gap before the redirect.
Web application headers
How to add a Content-Security-Policy (and avoid unsafe-inline)
Lock down which scripts can run so a single injection can't take over your page.
How to prevent clickjacking (X-Frame-Options / frame-ancestors)
Stop attackers from embedding your site in a hidden frame to trick users into clicking.
How to stop MIME-sniffing with X-Content-Type-Options
Prevent browsers from guessing (and mis-executing) file types.
How to set a Referrer-Policy
Stop full URLs (and any tokens in them) leaking to third-party sites.
How to set a Permissions-Policy
Control which powerful browser features (camera, mic, geolocation) your site and its embeds can use.
How to set Secure, HttpOnly, and SameSite cookie flags
Harden your cookies so they can't be stolen over plain HTTP, read by scripts, or replayed cross-site.
How to stop leaking your server/framework version
Remove version banners so attackers can't shortlist exploits for your exact stack.
Email spoofing & delivery
How to add an SPF record
Publish which servers may send email as your domain so spoofed mail gets rejected.
How to add and enforce a DMARC record
Tell receiving servers what to do with mail that fails SPF/DKIM — and get reports.
How to set up MTA-STS
Force other mail servers to use encrypted, authenticated TLS when delivering to you.
How to add SMTP TLS reporting (TLS-RPT)
Get notified when mail delivery to your domain fails to encrypt.