Fix guides · free

Fix it yourself

Every issue our free check can find, explained in plain language — with copy-paste fixes for Nginx, Apache, Cloudflare, Vercel, Netlify, WordPress and your DNS provider.

Run the free check

Transport

Enable HSTS (Strict-Transport-Security)5 min

Force browsers to always use HTTPS.

Fix mixed content15 min

Load every resource over HTTPS.

Serve your site over HTTPS15 min

A valid certificate on every page.

Renew your TLS certificate15 min

Your certificate is about to expire.

Web headers

Add a Content-Security-Policy1 hour

Limit which scripts can run on your pages.

Block clickjacking (framing)5 min

Stop other sites from embedding yours in a hidden frame.

Add X-Content-Type-Options: nosniff5 min

Stop browsers from guessing file types.

Set a Referrer-Policy5 min

Stop full URLs leaking to other sites.

Set a Permissions-Policy5 min

Switch off browser features you don’t use.

Secure your cookies15 min

Add Secure, HttpOnly and SameSite.

Disclosure

Hide server and framework versions15 min

Don’t advertise exact software versions.

Publish security.txt5 min

Give researchers a way to reach you.

Email

Publish a correct SPF record15 min

Say which servers may send your email.

Publish and enforce DMARC15 min

Tell receivers to reject forged email.

DNS

Add a CAA record5 min

Choose which certificate authorities may issue for you.

Enable DNSSEC15 min

Sign your DNS so it can’t be spoofed.

Exposure

Block exposed .git and .env files15 min

Source code or secrets are downloadable.