Every guide is mapped 1:1 to an active check key so you can move from warning to fix without guesswork.
When attackers can see you're running WordPress 6.3 or Apache 2.4.51, they can check public CVE databases for known exploits specific to your exact version. Removing version disclosure is simple server hardening — it doesn't fix vulnerabilities, but it removes the signpost that tells attackers exactly where to look.
Open guide
The FTC fined Avast $16.5M in 2024 for collecting and selling browsing data that contradicted their privacy policy promises (FTC enforcement action). Privacy policies and terms must be easily discoverable — not just present, but findable. Most legal frameworks (GDPR, CCPA, FTC Act) require clear, accessible disclosure. A footer link is the minimum standard.
Open guide
Without a declared charset, browsers use heuristics to guess the encoding. This frequently garbles accented characters (é becomes é), em dashes, curly quotes, and any non-ASCII text. For multilingual sites, this is catastrophic. The fix is one meta tag: <meta charset="UTF-8"> before any other content in the head.
Open guide
DNS A record changes redirect your traffic to a different server. This is expected during hosting migrations, but an unexpected change could mean your domain has been compromised or your hosting provider changed infrastructure without notice. Monitor A record changes to catch problems before users experience downtime or are redirected to malicious servers.
Open guide
A lapsed domain takes your entire site offline instantly, and recovery can take days even after renewal due to DNS propagation. Worse, expired domains are actively targeted by squatters and spammers who register them within hours. Your search rankings, email delivery, and brand reputation all depend on keeping your domain active. Set auto-renewal and monitor expiry dates.
Open guide
Only 18% of the top 10 million domains publish a valid DMARC record, and just 4% enforce a reject policy (Valimail, 2024). Fully authenticated senders are 2.7x more likely to reach the inbox than unauthenticated ones. Meanwhile, an estimated 3.4 billion phishing emails are sent daily, with domain spoofing as the primary vector. Without SPF, DKIM, and DMARC, anyone can send emails that appear to come from your domain.
Open guide
A favicon appears in browser tabs, bookmarks, browser history, and Google's search results. Without one, your site looks unfinished and is harder for users to find among open tabs. It's also a trust signal — professional sites have favicons, and their absence can make visitors question legitimacy.
Open guide
Without <!DOCTYPE html> at the top of your HTML, browsers enter "quirks mode" — applying legacy rendering rules from the IE5 era that break modern CSS features like box-sizing, flexbox behaviour, and font rendering. This causes layouts to look different across browsers and makes debugging CSS issues significantly harder.
Open guide
Screen readers use the lang attribute to select the correct pronunciation engine — without it, they apply default language rules that mispronounce words and ignore language-specific grammar. Browser translation tools also rely on lang to detect when to offer translation. It's a single attribute on the html element that takes 5 seconds to add.
Open guide
Without a viewport meta tag, mobile browsers assume your page is designed for desktop and zoom out to fit the full width on a small screen. Everything becomes unreadably small. This is a single line of HTML (meta name="viewport" content="width=device-width, initial-scale=1") that every mobile-friendly site needs.
Open guide
Horizontal scrolling on mobile is one of the strongest negative UX signals. Users expect vertical-only scrolling, and content that overflows the viewport looks broken. Common causes: fixed-width elements, unresponsive images, tables without scroll wrappers, or absolute-positioned elements that extend beyond the screen edge.
Open guide
Nameserver changes control where your domain's traffic is routed. An unauthorized change means someone can intercept all your traffic, email, and subdomains. If you didn't initiate this change, investigate immediately — check your domain registrar account for unauthorized access. Legitimate causes include hosting migrations or CDN changes.
Open guide