Fix guides

Each guide explains one problem a website audit can flag: what it means, why it matters, how to check it, and how to fix it.

Security headers

Content-Security-Policy headerA Content-Security-Policy (CSP) header tells the browser which sources it may load scripts, styles, images and frames from. Anything not on the list is blocked.
HSTS (Strict-Transport-Security) headerThe Strict-Transport-Security (HSTS) header tells browsers to only ever connect to your site over HTTPS for a set period, even if someone types http:// or follows an old link.
X-Frame-Options headerX-Frame-Options controls whether other websites may embed your pages in an iframe. The modern equivalent is the frame-ancestors directive in a Content-Security-Policy.
X-Content-Type-Options headerX-Content-Type-Options: nosniff tells the browser to trust the Content-Type your server sends instead of guessing a file's type from its contents.
Referrer-Policy headerReferrer-Policy controls how much of the current page's URL is sent to other sites in the Referer header when a visitor clicks a link or loads a resource.
Permissions-Policy headerPermissions-Policy lets you switch off browser features, such as the camera, microphone or geolocation, for your pages and any third-party content embedded in them.

Email security

HTTPS & cookies

SEO basics

Performance