Security
HTTPS, headers, cookies and certificates — the checks that keep visitors and rankings safe.
Guides
All 25 Security guides →- Security13 min read
Backups that actually restore: a small-site backup plan you can test
A backup you have never restored is a hope. Decide what to copy, how often and where, script it with wp-cli and rclone or a plugin, keep it out of the web root, and test the restore once a quarter.Updated 25 Sept 2026 - Security10 min read
Certificate chain errors: why it works in Chrome and fails elsewhere
A missing intermediate certificate hides in desktop browsers and breaks apps, curl, webhooks and crawlers. Read the chain, match the error to its cause and install the full chain on any server.Updated 25 Sept 2026 - Security13 min read
Certificate expiry: automate renewal, then monitor it
Public TLS certificates now last 200 days at most and 47 by 2029, so renewal has to be automatic. How each renewal stack works, the five ways it fails silently, and how to hear about it first.Updated 25 Sept 2026
Fix pages
HTTPS and certificates
4 of 5- How to enforce HTTPSHigh impact.Fixes
https-enforced+11 min - How to enable HSTS (Strict-Transport-Security)Medium impact.Fixes
hsts+11 min - How to disable TLS 1.0 and 1.1High impact.Fixes
tls-version-min-1-21 min - How to fix certificate expiry and chain errorsHigh impact.Fixes
cert-chain-valid+11 min
Show 1 moreShow fewer
Security headers and cookies
4 of 7- How to add a Content-Security-PolicyMedium impact.Fixes
csp-present+11 min - Security headers explainedMedium impact.Fixes
x-content-type-options1 min - How to prevent clickjacking (X-Frame-Options, frame-ancestors)Medium impact.Fixes
x-frame-options-or-frame-ancestors1 min - How to set a Referrer-PolicyMedium impact.Fixes
referrer-policy1 min
Exposed files and information
4 of 5- How to keep staging and dev sites out of GoogleHigh impact.Fixes
wp-staging-indexable1 min - How to hide server and framework versionsMedium impact.Fixes
server-header-leak+11 min - How to publish a security.txtFor information.Fixes
security-txt1 min - How to disable directory listingsHigh impact.Fixes
directory-listing1 min
Hacks, malware and updates
4 of 4- How to find and update vulnerable JavaScript librariesHigh impact.Fixes
js-library-vulnerable1 min - Why CMS updates matter for securityMedium impact.Fixes
outdated-cms-version1 min - Is my site hacked? Cloaking, spam links and conditional redirectsHigh impact.Fixes
hack-cloaking+32 min - What to do when Google flags your site as unsafeHigh impact.Fixes
web-risk-flag1 min
Email and DNS
4 of 7- How to set up MX records for your domain's emailHigh impact.Fixes
email-mx-present1 min - How to set up an SPF record (and stay under 10 lookups)High impact.Fixes
email-spf-present+21 min - How to set up DMARC, from p=none to p=rejectHigh impact.Fixes
email-dmarc-present+21 min - How to turn on DKIM signing for your domainFor information.Fixes
email-dkim-found1 min
Check all 43 at once
The Security headers runs every check on this page against your site.