Set up years ago? See how your website looks from outside today.

Your web host or website developer (3)

• !Medium www.example.com does not redirect HTTP to HTTPS

  Redirect every plain-HTTP request to the same address over HTTPS.

  Configuration examples

  nginx

  server {
      listen 80;
      server_name example.com www.example.com;
      return 301 https://$host$request_uri;
  }

  Apache

  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  Cloudflare

  SSL/TLS → Edge Certificates → Always Use HTTPS: On.

• !Low https://example.com/ has no Content-Security-Policy

  Start with a Content-Security-Policy in report-only mode, check the reports, then enforce it. Report-only violations only appear in the browser's developer console unless a report-to or report-uri endpoint is added to receive them. A good policy needs tailoring to the site; the example is a starting point, not a drop-in.

  Configuration examples

  nginx

  add_header Content-Security-Policy-Report-Only "default-src 'self'" always;

  Apache

  Header always set Content-Security-Policy-Report-Only "default-src 'self'"

• !Low https://example.com/ has no Strict-Transport-Security header

  Add the Strict-Transport-Security header with a max-age of at least six months (a year is common). Add includeSubDomains or preload only once every subdomain serves HTTPS.

  Configuration examples

  nginx

  add_header Strict-Transport-Security "max-age=31536000" always;

  Apache

  Header always set Strict-Transport-Security "max-age=31536000"

  Cloudflare

  SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS): enable, with a max-age of 12 months.

Your email provider (1)

The records themselves are added at your DNS provider.

• !Medium example.com has no DMARC record

  Publish a DMARC record, starting at p=none while reports are reviewed.

  Configuration examples

  DNS record

  _dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:<reports address>"