1dollar.website

Securing a Squarespace site

Squarespace runs the servers, so you can't add security headers or block files yourself. What you can do: turn on Secure and HSTS in the SSL settings, set up your domain's email records, and keep the scripts you've added through Code Injection to a minimum.

Last updated October 26, 2026

Prefer to fill in a form? Use the free SPF and DMARC record generator.

Not sure whether your site has this?

Paste your address. The checkup is free and shows what's flagged.

What our checkup looks for

Our free checkup reads your site's headers, checks HTTPS, and checks your domain's email records. On Squarespace, some of what it flags is Squarespace's to fix, and we say so in the report.

Turn on Secure and HSTS

Squarespace's SSL settings have a 'Secure (preferred)' option, which redirects everyone to HTTPS, and an 'HSTS Secure' option, which adds the HSTS header for you. Choose both.

How to fix it on Squarespace

  1. In Squarespace go to Settings > Website > SSL and choose 'Secure (preferred)' and 'HSTS Secure'.
  2. If your domain's DNS points somewhere else (an old host), update it to the records your platform shows.

Other security headers: ask Squarespace

Squarespace doesn't let you set other response headers. You can send the request below to their support. If headers matter for your business, say for a compliance review, putting Cloudflare in front of your domain lets you add them there.

This is the honest answer: on a hosted platform, a few flags may stay open, and that's not something you did wrong.

How to fix it on Squarespace

  1. Squarespace controls your site's server, so you can't add these headers directly.
  2. Send the request below to Squarespace support. If this matters for your business (e.g. a compliance review), a proxy such as Cloudflare in front of your domain can add them.
  3. The Content-Security-Policy-Report-Only line changes nothing for visitors yet. After a week with no broken features (check your browser's console), rename it to Content-Security-Policy to switch it on.
Copy this
Hi Squarespace support, a security scan of my store/site flagged missing security headers. Could you confirm whether Squarespace can set these, or whether they're planned?

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy-Report-Only: default-src 'self' https:; img-src 'self' https: data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; upgrade-insecure-requests
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Your domain's email records

This is the biggest thing a Squarespace owner can fix. If your domain is registered with Squarespace, add these in the domain's DNS settings; otherwise add them at your registrar. Use your email provider's SPF include, for example Google Workspace's. Our email guide explains each record.

How to fix it

  1. Log in to wherever you manage your domain's DNS (your registrar, Cloudflare, etc.).
  2. Add both records below to example.com. If there's already a TXT record starting with v=spf1, replace it: a domain must have only one.
  3. Replace the <...> part with your email provider's SPF include: Google Workspace is _spf.google.com, Microsoft 365 is spf.protection.outlook.com. Add one for each service that sends email as you.
  4. If you're not sure every service that sends email as you is listed, start with p=none for two weeks and read the reports, then change it to p=quarantine.
dns
Type: TXT
Name: @
Value: v=spf1 include:<your email provider's SPF domain> -all

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

Keep added scripts to a minimum

Scripts you paste into Code Injection, or that come with extensions, run on every page with full access. Old ones are a common source of outdated-library flags. Remove what you no longer use.

How to fix it on Squarespace

  1. Remove scripts you no longer use (old analytics, chat widgets, A/B testing tools).
  2. For the ones you keep, prefer official copies and add integrity checks (the integrity= attribute) where the provider supports them.

How to check it worked

After changing the SSL setting, this should show a strict-transport-security line. Or run our free checkup again.

bash
curl -sI https://example.com | grep -i strict-transport

Common mistakes

  • Leaving SSL on 'Insecure' or forgetting the HSTS option.
  • Assuming Squarespace handles your email records. Unless you set up email through them, it doesn't.
  • Pasting tracking or chat scripts into Code Injection and never removing them.

What this can't tell you

On Squarespace, the server side is Squarespace's responsibility. Our checkup shows which flags are theirs, so you don't chase fixes you can't make.

Check your own site, free

The free checkup shows how many results are flagged and how serious. For $1, the report picks the ones that matter for your site and writes each fix for your platform, with your own domain filled in.