Security
HTTPS, headers, cookies and certificates — the checks that keep visitors and rankings safe.
Fix pages
HTTPS and certificates
4 of 5- How to enforce HTTPSHigh impact.Fixes
https-enforced+11 min - How to enable HSTS (Strict-Transport-Security)Medium impact.Fixes
hsts+11 min - How to disable TLS 1.0 and 1.1High impact.Fixes
tls-version-min-1-21 min - How to fix certificate expiry and chain errorsHigh impact.Fixes
cert-chain-valid+11 min
Show 1 moreShow fewer
Security headers and cookies
4 of 7- How to add a Content-Security-PolicyMedium impact.Fixes
csp-present+11 min - Security headers explainedMedium impact.Fixes
x-content-type-options1 min - How to prevent clickjacking (X-Frame-Options, frame-ancestors)Medium impact.Fixes
x-frame-options-or-frame-ancestors1 min - How to set a Referrer-PolicyMedium impact.Fixes
referrer-policy1 min
Exposed files and information
4 of 5- How to keep staging and dev sites out of GoogleHigh impact.Fixes
wp-staging-indexable1 min - How to hide server and framework versionsMedium impact.Fixes
server-header-leak+11 min - How to publish a security.txtFor information.Fixes
security-txt1 min - How to disable directory listingsHigh impact.Fixes
directory-listing1 min
Hacks, malware and updates
4 of 4- How to find and update vulnerable JavaScript librariesHigh impact.Fixes
js-library-vulnerable1 min - Why CMS updates matter for securityMedium impact.Fixes
outdated-cms-version1 min - Is my site hacked? Cloaking, spam links and conditional redirectsHigh impact.Fixes
hack-cloaking+32 min - What to do when Google flags your site as unsafeHigh impact.Fixes
web-risk-flag1 min
Email and DNS
4 of 7- How to set up MX records for your domain's emailHigh impact.Fixes
email-mx-present1 min - How to set up an SPF record (and stay under 10 lookups)High impact.Fixes
email-spf-present+21 min - How to set up DMARC, from p=none to p=rejectHigh impact.Fixes
email-dmarc-present+21 min - How to turn on DKIM signing for your domainFor information.Fixes
email-dkim-found1 min
Check all 43 at once
The Security headers runs every check on this page against your site.