Guides
In-depth guides
Longer walkthroughs for specific setups: real screenshots, code you can paste and the reason behind every step. The short fix page for each check lives under Learn.
All guides
206 guides, page 13 of 18.
- Security8 min read
Security headers from zero to A
Six HTTP headers decide whether your site gets an A or an F on any security scanner. This guide explains what each one does in plain terms, gives copy-paste configs for nginx, Apache, Caddy, Cloudflare and WordPress, and shows how to roll out a Content-Security-Policy without breaking the site.Updated 25 Sept 2026 - WordPress10 min read
Security headers in WordPress without a plugin
Where to set HSTS, CSP, X-Frame-Options and Referrer-Policy on a WordPress site: web server, Cloudflare, host panel or a ten-line mu-plugin, with values that keep wp-admin working.Updated 25 Sept 2026 - Security11 min read
security.txt: the contact file for security researchers
A security.txt file tells whoever finds a hole in your site where to report it. The required fields, the Expires trap, a complete sample, and hosting it on WordPress, Next.js and nginx.Updated 25 Sept 2026 - Checklists10 min read
Send the fixes to your developer: a checklist they can actually use
Turn a getReport report into a brief a developer can act on, with the fixes view, the Markdown and CSV exports, two sentences of context and an agreed order, then verify the result with a re-run.Updated 25 Sept 2026 - Security10 min read
Server and X-Powered-By headers: why version numbers matter
Apache/2.4.29, PHP/7.2.24, Express. Two response headers hand every scanner your exact software versions. What they reveal, what hiding them does and does not achieve, and the fix for each server.Updated 25 Sept 2026 - Speed13 min read
Server response time on shared hosting: options that cost nothing
A slow first byte on a €5 hosting plan is usually PHP, plugins and a missing cache, not the plan. The fixes that cost nothing, in the order that pays off, and when it really is time to move.Updated 25 Sept 2026 - Speed12 min read
Service workers and offline pages: the minimal safe version
A service worker does nothing for a first visit and can serve stale pages for weeks. The minimal recipe: network-first HTML, cached hashed assets, an offline page, a kill switch, and when to skip it.Updated 25 Sept 2026 - Platforms13 min read
Shopify: what you can fix, what you cannot, and what to ignore
A Shopify report has findings you control, findings Shopify controls and findings that do not matter on Shopify. This guide sorts them, shows where each fix lives in the admin, and tells you which apps to remove first.Updated 25 Sept 2026 - SEO14 min read
Site migration checklist: domain, https and CMS moves without losing traffic
A before, during and after checklist for moving a site to a new domain, to https or to a new CMS, with the redirect map, the staging checks, the launch-day order and the bulk URL verification that catches the classic mistakes.Updated 25 Sept 2026 - SEO11 min read
Sitemap index files: splitting large sitemaps the right way
A sitemap stops at 50,000 URLs or 50 MB. This guide shows how to split it into an index with child files by type, date or language, what to leave out, and how WordPress and other CMSs do it for you.Updated 25 Sept 2026 - SEO11 min read
Sitemap lastmod: when to set it and when it hurts
Google uses the lastmod date in your sitemap to decide what to recrawl, but only while it stays honest. Learn when to set it, which date to use, the format, and how to spot a generator that fakes it.Updated 25 Sept 2026 - SEO13 min read
Soft 404s: pages Google treats as missing even though they return 200
A soft 404 is a page that says "not found" or shows nothing while answering HTTP 200. Learn how Google spots them, how to find yours with Search Console and the report, and the fix for each cause.Updated 25 Sept 2026
Guides tell you how. Your report tells you what.
Run a free report to see which of these guides apply to your site.