Security
HTTPS, headers, cookies and certificates: the checks that keep visitors and rankings safe.
Guides
All 54 Security guides →- Security17 min read
"This Connection Is Not Private" in Safari: the fix on iPhone, iPad and Mac
"This Connection Is Not Private" is Safari's warning when a site's certificate fails a check: expired, issued for another name, or from an issuer your device does not trust. Here is the fix on iPhone, iPad and Mac, then how a site owner finds which problem it is.Updated 13 Nov 2026 - Security16 min read
PR_END_OF_FILE_ERROR: what it means and how to fix it
PR_END_OF_FILE_ERROR is Firefox's message when the other end closed the connection before the secure handshake finished. Here is the visitor fix in order of likelihood, then how a site owner proves whose side drops it.Updated 12 Nov 2026 - Security13 min read
SSL_ERROR_RX_RECORD_TOO_LONG: why Firefox says it and how to fix it
SSL_ERROR_RX_RECORD_TOO_LONG is Firefox's error when a server answers an HTTPS request in plain HTTP. Here is the visitor fix, the bytes that make Firefox say "record too long", one curl test that proves it, and the fix for nginx, Apache, app servers and Cloudflare.Updated 11 Nov 2026
Fix pages
HTTPS and certificates
4 of 5- How to enforce HTTPSHigh impact.Fixes
https-enforced+11 min - How to enable HSTS (Strict-Transport-Security)Medium impact.Fixes
hsts+11 min - How to disable TLS 1.0 and 1.1High impact.Fixes
tls-version-min-1-21 min - How to fix certificate expiry and chain errorsHigh impact.Fixes
cert-chain-valid+11 min
Show 1 moreShow fewer
Security headers and cookies
4 of 7- How to add a Content-Security-PolicyMedium impact.Fixes
csp-present+11 min - Security headers explainedMedium impact.Fixes
x-content-type-options1 min - How to prevent clickjacking (X-Frame-Options, frame-ancestors)Medium impact.Fixes
x-frame-options-or-frame-ancestors1 min - How to set a Referrer-PolicyMedium impact.Fixes
referrer-policy1 min
Exposed files and information
4 of 5- How to keep staging and dev sites out of GoogleHigh impact.Fixes
wp-staging-indexable1 min - How to hide server and framework versionsMedium impact.Fixes
server-header-leak+11 min - How to publish a security.txtFor information.Fixes
security-txt1 min - How to disable directory listingsHigh impact.Fixes
directory-listing+11 min
Hacks, malware and updates
4 of 4- How to find and update vulnerable JavaScript librariesHigh impact.Fixes
js-library-vulnerable1 min - Why CMS updates matter for securityMedium impact.Fixes
outdated-cms-version1 min - Is my site hacked? Cloaking, spam links and conditional redirectsHigh impact.Fixes
hack-cloaking+32 min - What to do when Google flags your site as unsafeHigh impact.Fixes
web-risk-flag1 min
Email and DNS
4 of 9- How to set up MX records for your domain's emailHigh impact.Fixes
email-mx-present1 min - How to set up an SPF record (and stay under 10 lookups)High impact.Fixes
email-spf-present+21 min - How to set up DMARC, from p=none to p=rejectHigh impact.Fixes
email-dmarc-present+21 min - How to turn on DKIM signing for your domainFor information.Fixes
email-dkim-found1 min
Show 5 moreShow fewer
- How to set up MTA-STS and TLS reportingFor information.Fixes
email-mta-sts+11 min - How to show your logo in inboxes with BIMIFor information.Fixes
email-bimi1 min - How to check if your mail server is on an email blacklistHigh impact.Fixes
email-dnsbl-clear1 min - How to set up reverse DNS (PTR) for your mail serverMedium impact.Fixes
email-reverse-dns1 min - How to turn on DNSSECMedium impact.Fixes
dnssec-enabled1 min
Check all 48 at once
The Security headers checker runs every check on this page against your site.