Fix guides
What to change, why it matters and the exact snippet, for your stack. Risky changes come in stages.
Security
- Renew the expired TLS certificate genericCloudflareCaddyVercelNetlifyShopify
- Fix a certificate that is not valid yet genericCloudflare
- Renew the certificate before it expires genericCloudflareCaddyVercelNetlify
- Install a certificate that covers this hostname genericCloudflarenginxApacheCaddyVercelNetlify
- Replace the self-signed certificate with a trusted one genericCloudflarenginxApacheCaddy
- Use a certificate from a publicly trusted authority genericnginxApache
- Serve the full certificate chain genericCloudflarenginxApacheCaddy
- Replace the expired intermediate certificate genericnginxApache
- Re-issue the certificate with a stronger key genericCloudflare
- Replace the certificate that uses a broken hash generic
- Fix the certificate that browsers reject genericnginxApache
- Cover both the www and the bare domain in the certificate genericCloudflarenginxApacheCaddyVercelNetlify
- Use a certificate with a standard validity period generic
- Turn off TLS 1.0 and 1.1 genericCloudflarenginxApacheCaddyVercelShopify
- Enable TLS 1.2 and TLS 1.3 genericCloudflarenginxApache
- Enable TLS 1.3 genericCloudflarenginxApacheCaddy
- Disable the RC4 cipher genericCloudflarenginxApacheCaddy
- Disable the 3DES cipher genericCloudflarenginxApacheCaddy
- Offer modern AEAD ciphers genericnginxApacheCaddy
- Require forward-secret ciphers genericCloudflarenginxApacheCaddy
- Retire the old TLS versions that use CBC ciphers generic
- Add the Strict-Transport-Security (HSTS) header genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Fix the malformed Strict-Transport-Security header genericCloudflarenginxApacheCaddy
- Re-enable HSTS (max-age is zero) genericCloudflarenginxApacheCaddy
- Raise the HSTS max-age genericCloudflarenginxApacheCaddyVercelNetlify
- Decide whether to add includeSubDomains genericCloudflarenginxApacheCaddy
- Meet the HSTS preload requirements or remove preload genericCloudflarenginxApacheCaddyVercelNetlify
- Consider submitting the domain to the HSTS preload list generic
- Serve the site over HTTPS genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Stop redirecting HTTPS to HTTP genericCloudflarenginxApacheVercelNetlifyWordPress
- Redirect HTTP to HTTPS genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Fix the broken HTTPS redirect chain genericCloudflarenginxApacheWordPress
- Shorten the redirect chain genericCloudflarenginxApacheWordPress
- Fix the HTTP redirect chain genericCloudflarenginxApache
- Redirect HTTP straight to HTTPS genericCloudflarenginxApacheWordPress
- Answer HTTP with a redirect to HTTPS genericnginx
- Redirect www and apex to one host genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Make the www or apex name work over HTTPS genericCloudflarenginxApacheCaddyVercelNetlifyShopify
- Add a Content-Security-Policy genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Enforce the report-only Content-Security-Policy genericCloudflarenginxApacheVercelNetlifyWordPressShopify
- Send the Content-Security-Policy as an HTTP header genericCloudflarenginxApacheWordPressShopify
- Restrict where scripts can load from genericCloudflarenginxApacheWordPressShopify
- Replace 'unsafe-inline' scripts with nonces or hashes genericCloudflarenginxWordPressShopify
- Remove 'unsafe-eval' from script-src genericCloudflareShopify
- Remove wildcard sources from script-src genericCloudflarenginxApacheWordPressShopify
- Set object-src to 'none' genericCloudflarenginxApacheShopify
- Add base-uri to the Content-Security-Policy genericCloudflarenginxApacheShopify
- Fix the Content-Security-Policy syntax genericCloudflareShopify
- Reduce reliance on inline styles generic
- Stop other sites from framing your pages genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Fix the X-Frame-Options value genericCloudflarenginxApacheCaddyWordPress
- Limit frame-ancestors to sites you trust genericCloudflarenginxApacheShopify
- Send X-Content-Type-Options nosniff genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Set X-Content-Type-Options to exactly nosniff genericCloudflarenginxApacheCaddyShopify
- Set a Referrer-Policy genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Set a valid Referrer-Policy genericCloudflarenginxApacheCaddyWordPressShopify
- Stop sending full URLs to other sites genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Add a Permissions-Policy genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Replace Feature-Policy with Permissions-Policy genericCloudflareShopify
- Fix the Permissions-Policy syntax genericCloudflareShopify
- Stop allowing powerful features for every origin genericCloudflareShopify
- Add the Secure flag to cookies genericnginxApacheWordPressShopify
- Make session cookies HttpOnly genericnginxApacheWordPressShopify
- Set SameSite on session cookies genericnginxWordPressShopify
- Add Secure to SameSite=None cookies genericnginxWordPressShopify
- Replace CORS origin reflection with an allow-list genericCloudflarenginxApacheWordPressShopify
- Never allow the null origin in CORS genericCloudflarenginxApacheShopify
- Drop credentials or the wildcard from CORS genericCloudflarenginxApacheShopify
- Limit CORS to the origins that need it genericCloudflarenginxApacheWordPressShopify
- Load scripts, styles and frames over HTTPS genericCloudflareWordPressShopify
- Load images and media over HTTPS genericCloudflareWordPressShopify
- Make forms submit over HTTPS genericWordPressShopify
- Add Subresource Integrity to third-party scripts genericWordPressShopify
- Hide the server version number genericnginxApacheCaddyWordPress
- Remove the version from X-Powered-By genericCloudflarenginxApacheCaddyWordPress
- Remove framework version headers genericCloudflarenginxApacheCaddy
- Update the vulnerable JavaScript library genericWordPressShopify
- Update the CMS or application to a patched release genericWordPress
- Patch the exploited vulnerability in your CMS or application genericWordPress
- Keep the software named in the finding up to date generic
- Clean the site and ask Google to review the listing genericWordPressShopify
- Publish an SPF record genericCloudflare
- Merge the SPF records into one genericCloudflare
- Fix the syntax error in the SPF record genericCloudflare
- Replace +all in the SPF record with ~all genericCloudflare
- Narrow the very large address range in the SPF record genericCloudflare
- Change ?all in the SPF record to ~all genericCloudflare
- Choose the right SPF ending for this domain genericCloudflare
- End the SPF record with ~all or -all genericCloudflare
- Bring the SPF record under 10 DNS lookups genericCloudflare
- Leave room under the SPF lookup limit generic
- Remove SPF terms that point at names that no longer exist genericCloudflare
- Fix the SPF include that has no SPF record genericCloudflare
- Break the loop in the SPF includes genericCloudflare
- Replace the include that has several SPF records genericCloudflare
- Replace the ptr mechanism in the SPF record genericCloudflare
- Check the SPF terms that use macros generic
- Re-run the scan if part of the SPF record could not be read generic
- Publish a DMARC record, starting in monitoring mode genericCloudflare
- Keep only one DMARC record genericCloudflare
- Fix the invalid DMARC record genericCloudflare
- Move DMARC from monitoring to quarantine, then reject genericCloudflare
- Move DMARC from quarantine to reject genericCloudflare
- Remove the pct tag from the DMARC record genericCloudflare
- Remove the t=y test flag from the DMARC record genericCloudflare
- Make the DMARC subdomain policy match the main policy genericCloudflare
- Add a report address to the DMARC record genericCloudflare
- Remove or fix the invalid tags in the DMARC record genericCloudflare
- Replace the weak DKIM key with a 2048-bit key genericCloudflare
- Rotate the 1024-bit DKIM key to 2048 bits genericCloudflare
- Fix the unusable DKIM key record genericCloudflare
- Take the DKIM selector out of testing mode genericCloudflare
- Check that your mail is signed with DKIM genericCloudflare
- Check that revoked DKIM selectors are meant to be revoked generic
- Publish an MTA-STS policy, starting in testing mode genericCloudflare
- Fix the MTA-STS TXT record genericCloudflare
- Make the MTA-STS policy file reachable genericCloudflare
- Fix the certificate on the MTA-STS policy host genericCloudflare
- Fix the MTA-STS policy file genericCloudflare
- Switch MTA-STS from testing to enforce genericCloudflare
- Turn MTA-STS back on genericCloudflare
- Make the MTA-STS policy cover every MX host genericCloudflare
- Raise the MTA-STS max_age genericCloudflare
- Nothing to do for MTA-STS on a domain that accepts no mail generic
- Publish a TLS-RPT record genericCloudflare
- Fix the TLS-RPT record genericCloudflare
- Point the BIMI record at an https logo URL generic
DNS
- Delegate the domain to working nameservers genericCloudflare
- Add a second nameserver genericCloudflare
- Spread nameservers across more than one network genericCloudflare
- Fix nameservers that do not answer for the domain genericCloudflare
- Make unreachable nameservers answer, or remove them generic
- Give each nameserver name an IP address generic
- Point nameserver names at public IP addresses generic
- Point nameserver names at A or AAAA records, not CNAMEs generic
- Make the registrar's nameservers match the zone's NS records genericCloudflare
- Make all nameservers publish the same NS records generic
- Add glue records for nameservers inside your own domain generic
- Update glue records to match the nameserver's real address generic
- Check that nameservers are in sync generic
- Repair broken DNSSEC so validating resolvers can resolve the domain genericCloudflare
- Make your DNSSEC signatures something resolvers can validate genericCloudflare
- Publish the DS record at your registrar genericCloudflare
- Find out why resolvers disagree about your DNSSEC generic
- Turn on DNSSEC genericCloudflare
- Move DNSSEC to a stronger signing algorithm genericCloudflare
- Add a SHA-256 DS record genericCloudflare
- Add a CAA record that names your certificate authority genericCloudflare
- Add an issue tag to your CAA record genericCloudflare
- Fix the misspelled CAA tag generic
- Fix the unreadable CAA record genericCloudflare
- Renew the expired domain registration now generic
- Renew the domain registration before it expires generic
- Clear the hold on the domain generic
- Contact your registrar now to restore the domain generic
- Turn on the registrar transfer lock generic
- Delete the CNAME that points at an unregistered domain genericCloudflare
- Remove or reclaim the CNAME to a deprovisioned service genericCloudflare
- Move the CNAME to an internal name out of public DNS genericCloudflare
- Delete the CNAME that points at a name that does not exist genericCloudflare
- Fix the wildcard CNAME that points at a missing name genericCloudflare
Performance
- Make the largest element on the page load faster genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Make the largest element on the page load faster genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Stop the page layout from jumping while it loads genericWordPressShopify
- Stop the page layout from jumping while it loads genericWordPressShopify
- Make the page respond faster to clicks and taps genericWordPressShopify
- Make the page respond faster to clicks and taps genericWordPressShopify
- Reduce the JavaScript that blocks the page while it loads genericWordPressShopify
- Reduce the JavaScript that blocks the page while it loads genericWordPressShopify
- Collect real-user speed data for your site genericWordPress
SEO
- Add a title to the homepage genericWordPressShopify
- Add a meta description to the homepage genericWordPressShopify
- Add a canonical link to the homepage genericWordPressShopify
- Fix the canonical link on the homepage genericWordPressShopify
- Point the canonical link at your own domain genericWordPressShopify
- Add Open Graph tags for link previews genericWordPressShopify
- Complete the Open Graph tags genericWordPressShopify
- Add a viewport meta tag genericWordPressShopify
- Remove the noindex tag from the homepage genericWordPressShopify
- Remove the noindex header from the homepage genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Let search engines crawl the homepage genericWordPressShopify
- Resolve the noindex that robots.txt hides genericWordPress
- Find out why Google cannot index the homepage generic
- Fix the error status on the homepage genericCloudflarenginxApacheWordPress
- Remove the nofollow instruction from the homepage genericWordPressShopify
- Add structured data to the homepage genericWordPressShopify
- Fix the broken structured data on the homepage genericWordPressShopify
Accessibility
Hygiene
- Publish a security.txt file genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Serve security.txt from /.well-known/ genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Serve security.txt over https genericCloudflarenginxApacheCaddy
- Serve security.txt as text/plain with utf-8 genericCloudflarenginxApacheCaddyVercelNetlifyWordPressShopify
- Add a Contact line to security.txt genericCloudflare
- Fix the Contact value in security.txt genericCloudflare
- Add an Expires line to security.txt genericCloudflare
- Use an RFC 3339 date in the Expires line genericCloudflare
- Renew the expired security.txt genericCloudflare
- Renew security.txt before it expires genericCloudflare
- Shorten the security.txt Expires date genericCloudflare
- Fix repeated or insecure fields in security.txt genericCloudflare
- Make the Canonical line match where the file is served genericCloudflare
- Add a robots.txt file genericWordPressShopify
- Fix the server error on robots.txt genericnginxWordPress
- Fix the syntax of robots.txt genericVercelNetlifyWordPressShopify
- Shrink the robots.txt file genericWordPress
- Allow search engines in robots.txt genericWordPressShopify
- Publish an XML sitemap genericWordPressShopify
- List the sitemap in robots.txt genericWordPressShopify
- Make the sitemap reachable genericWordPressShopify
- Fix the sitemap format genericWordPress
- Put URLs into the sitemap genericWordPressShopify
- Split the sitemap into several files genericWordPress
- Remove URLs from other domains in the sitemap genericWordPressShopify
- Decide your policy for AI crawlers genericCloudflareWordPressShopify
- Consider adding an llms.txt file genericWordPressShopify