Missing HSTS Header: What It Does and How to Add It Without Locking Yourself Out
HSTS tells browsers to use HTTPS only for your site. Learn the safe way to roll it out, with config for nginx, Apache and Cloudflare, and why preload is hard to undo.
HSTS tells browsers to use HTTPS only for your site. Learn the safe way to roll it out, with config for nginx, Apache and Cloudflare, and why preload is hard to undo.
Images without alt text are silent to screen reader users and invisible to search engines. Learn when an image needs alt text, how to write it, and how to find the gaps.
Every page needs a unique title and description. Find pages with missing, duplicate or vague metadata, and write titles and descriptions that match what searchers need.
Without a viewport tag, phones render the page at desktop width and shrink it to fit. Add one line to the head, then fix anything that still overflows the screen.
An HTTPS page that loads images, scripts or styles over HTTP loses its padlock, and browsers block some of those files. Find each HTTP URL and switch it to HTTPS.
A site that works on desktop can overlap, overflow and hide its menu on phones. Test at real widths, fix overflowing elements and tap targets, and check menus and forms.
Two SPF records on one domain makes SPF fail with a permanent error. See how it happens, how to spot it in seconds, and how to merge the records safely.
A new domain shows nothing until its nameservers and records point to your host. Check registration, nameservers, A records and propagation in that order.
Without compression and cache headers, every visit downloads everything again. Turn on Gzip or Brotli, set cache lifetimes, add page caching, then minify.
Browsers mark HTTP sites as 'Not secure'. Get a free certificate from your host or Let's Encrypt, install it, redirect HTTP to HTTPS, and update internal links.