Guides
In-depth guides
Longer walkthroughs for specific setups: real screenshots, code you can paste and the reason behind every step. The short fix page for each check lives under Learn.
All guides
54 guides, page 3 of 5.
- Security10 min read
X-Frame-Options, frame-ancestors and nosniff: stop clickjacking
X-Frame-Options and CSP frame-ancestors stop other sites framing your pages for clickjacking; X-Content-Type-Options nosniff stops MIME sniffing. What to send and where to set it.Updated 27 Sept 2026 - Security13 min read
"This site may be hacked": why Google shows it and how to remove it
"This site may be hacked" is a label Google adds under a search result when it believes someone changed the site or added spam pages. It goes away once the site is clean and Google has checked it. Here is how to confirm the cause, clean up and ask for the review.Updated 26 Sept 2026 - Security13 min read
554 5.7.5 permanent error evaluating DMARC policy: what it means and how to fix it
A "554 5.7.5 permanent error evaluating DMARC policy" bounce means the receiving server could not get a usable DMARC result for your domain. What causes it, how to tell the causes apart, and how to fix DMARC and DKIM fail results.Updated 26 Sept 2026 - Security11 min read
Cloudflare error 525 and 526: fix the SSL handshake to your server
Error 525 "SSL handshake failed" means Cloudflare could not set up HTTPS with your origin server; error 526 means the origin's certificate is invalid in Full (strict) mode. Both are fixed on your server, usually in ten minutes.Updated 26 Sept 2026 - Security11 min read
DMARC policy: moving from p=none to quarantine and reject
Your DMARC policy decides what happens to mail that forges your domain. What none, quarantine and reject do, how to fix "DMARC policy not enabled", and a safe path to p=reject.Updated 26 Sept 2026 - Security10 min read
DMARC reports: how to read aggregate (rua) reports and what to act on
A DMARC report is the daily XML summary that Gmail, Outlook, Yahoo and other receivers send you about every server that used your domain. How to receive them, how to read each part, and which rows need action.Updated 26 Sept 2026 - Security12 min read
ERR_SSL_PROTOCOL_ERROR: what it means and how to fix it
ERR_SSL_PROTOCOL_ERROR means the browser and the server could not agree on a secure connection, so the handshake stopped before any page loaded. Here is the quick fix for visitors and the server-side causes for site owners.Updated 26 Sept 2026 - Security9 min read
Gmail, Yahoo and Outlook bulk-sender requirements: the DMARC rule and the rest
Google's DMARC requirement, and the rest of the Gmail, Yahoo and Outlook rules for bulk senders: SPF and DKIM, an aligned DMARC record, one-click unsubscribe and a spam rate under 0.3%. Who counts as a bulk sender and how to check you comply.Updated 26 Sept 2026 - Security10 min read
Google Workspace SPF record, DKIM and DMARC: the complete setup
The Google Workspace SPF record is v=spf1 include:_spf.google.com ~all. How to publish it, turn on Google Workspace DKIM in the Admin console, and set up DMARC, with the exact records and the mistakes that break them.Updated 26 Sept 2026 - Security23 min read
Hacked website? The signs, how to confirm it, and how to recover
A hacked website rarely looks hacked to its owner. Learn the signs, see your site the way Google does, confirm what you find and clean it so the spam does not come back.Updated 26 Sept 2026 - Security12 min read
HTTPS vs HTTP: the difference, and why your site says "Not secure"
HTTPS is HTTP sent through an encrypted TLS connection, so nobody on the network can read or change it; plain HTTP is readable text. Here is what the difference means for visitors and search, and how to fix a "Not secure" label.Updated 26 Sept 2026 - Security11 min read
Let's Encrypt: get a free SSL certificate and keep it renewing
Let's Encrypt is a non-profit certificate authority that issues free SSL certificates, trusted by every browser and renewed automatically. This guide shows how to get one on your host, your own server or WordPress, and when a paid certificate is still worth it.Updated 26 Sept 2026
Guides tell you how. Your report tells you what.
Run a free report to see which of these guides apply to your site.