Is my website’s SSL certificate valid? How to check and fix it
Check whether your site’s HTTPS certificate is trusted, close to expiring, or missing a redirect, and fix it on Nginx, Apache, Cloudflare or any host.
What we check, and how to fix it
Each guide explains one part of your grade: what it is, why attackers care, and copy-paste fixes for common hosting.
How to turn off TLS 1.0 and TLS 1.1 on your website
TLS 1.0 and 1.1 are retired. Learn how to check whether your server still accepts them and switch to TLS 1.2 and 1.3 in minutes.
Security headers explained: HSTS, CSP, X-Frame-Options and cookies
Plain-English guide to the HTTP security headers every website should send, with copy-paste settings for Nginx, Apache and Cloudflare.
Stop email spoofing: how to set up SPF and DMARC
Stop criminals sending email that looks like it came from your business. Set up SPF and DMARC records step by step.
Is your .git folder or .env file public? How to check and block it
Exposed .git folders and .env files leak source code and passwords. Learn why it happens and how to block them on any server.
Outdated JavaScript libraries and version leaks: what to fix first
Find out whether your site runs an outdated jQuery or reveals its server and CMS versions, and how to fix both.
What is security.txt and does my website need one?
security.txt tells people how to report a security problem on your site. Here is what to put in it and where it goes.