Security guide
Plain-language explanations of every check we run — what a finding actually means, the real-world impact of leaving it unfixed, and exactly how to fix it.
HTTP Security Headers
Missing Content-Security-Policy header
What a missing Content-Security-Policy header means for your site, the real-world risks of skipping it, and how to add one.
Missing Strict-Transport-Security (HSTS) header
Why a missing HSTS header leaves visitors exposed to connection downgrade attacks, and how to add Strict-Transport-Security to your site.
Missing X-Frame-Options header
How a missing X-Frame-Options header enables clickjacking attacks against your visitors, and how to add the header.
Missing X-Content-Type-Options header
Why a missing X-Content-Type-Options header turns file uploads into a security risk, and how to fix it with one header.
Missing Referrer-Policy header
What a missing Referrer-Policy header can leak to other sites, and how to add one to your server configuration.
Email Spoofing Protection
SPF record is missing
Without an SPF record, anyone can send email that looks like it's from your domain. Here's what that risks and how to fix it.
DMARC record is missing
Without DMARC, SPF and DKIM have no enforcement behind them. Here's what that means and how to add a DMARC record.
DMARC policy isn't enforced yet
A DMARC policy set to "none" collects reports but blocks nothing. Here's the risk of staying there and how to tighten it.
DKIM not detected
Without a DKIM signature, there's no proof your outgoing email wasn't altered or forged. Here's what that risks and how to fix it.
Your IP address is on a spam blacklist
Being blacklisted can silently break your outgoing email. Here's what it means, why it happens, and how to get delisted.
SSL/TLS Security
Certificate renewal is coming up
An SSL certificate close to expiring can take your site offline with a browser warning. Here's how to make sure renewal actually happens.
No valid SSL certificate detected
Serving your site over plain HTTP exposes everything visitors submit. Here's the real risk and how to enable HTTPS.
Domain Registration
CMS & Platform Security
Admin login page is publicly reachable
An exposed WordPress login page is a 24/7 target for automated attacks. Here's what's at risk and how to lock it down.
XML-RPC API is enabled
XML-RPC is rarely needed today and is frequently abused for brute-force and DDoS attacks. Here's what that risks and how to disable it.
One or more plugins are out of date
Plugin updates publish the exact vulnerability they fix, making outdated plugins an easy target. Here's the risk and how to update safely.