Fix guides
Plain-English fixes for the problems our checkup finds most, with the exact config for the platform your site runs on.
| Guide | Covers |
|---|---|
| How to add security headers to your website | HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, CSP |
| How to make your whole site use HTTPS | HTTPS redirect, mixed content, insecure forms, old TLS |
| Stop scammers sending email as your domain | SPF, DKIM, DMARC, domains that never send email |
| Exposed .env or .git file? What to do now | .env, .git, .DS_Store, directory listings, debug pages |
| WordPress security: the five fixes that matter most | Updates, PHP version, XML-RPC, user list, version number |
| Guide | Covers |
|---|---|
| Securing a site on Netlify | _headers file, HTTPS, secret keys, deployed files, email |
| Securing a site on Vercel | vercel.json headers, HTTPS, NEXT_PUBLIC_ keys, files, email |
| Securing a WordPress site | .htaccess headers, HTTPS, mixed content, files, cookies, email |
| Securing a Squarespace site | SSL and HSTS settings, headers, email records, added scripts |
| Tool | Gives you |
|---|---|
| Security headers generator | Ready-to-paste header config for your platform |
| Content Security Policy generator and checker | Build a CSP for the services you use, or check the one you have |
| SPF and DMARC record generator | The two DNS records that stop email spoofing |
| DMARC checker | Look up a domain's DMARC record, or paste one, and see what it does |
| security.txt generator | The file that tells researchers how to report a problem |
Find out which of these your site needs
The free checkup shows how many results are flagged and how serious. The $1 report says which guide applies to each one.