example.com

1. Keep your current p=reject enforcement and edit the existing record in place — do not replace it with p=none.
2. Add rua=mailto:… to the existing record so you receive aggregate reports. Nothing else changes.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com"

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. Your domain already enforces DMARC. Edit the record in place; never roll back to p=none.

1. Set up a permanent (301) redirect from every HTTP request to HTTPS on the server or CDN.
2. Then add an HSTS header.

server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

Safety: This change is made on your server. Make sure HTTPS works first, otherwise the site won't load.

1. Start with a short max-age (300 seconds) and make sure every subdomain works over HTTPS.
2. Gradually raise it to 31536000 (one year) and add includeSubDomains.
3. Consider preload only once the policy is stable — removal from the preload list is slow.

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Safety: This change is made in your server/CDN settings. Test on staging before production. HSTS is cached in the visitor's browser — a long max-age on a site without working HTTPS will block access.

1. First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
2. Collect violations for a week or two and tune the policy to your legitimate sources.
3. Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.

1. Add X-Frame-Options: SAMEORIGIN (or DENY if the site is never embedded anywhere).
2. Also set frame-ancestors in the CSP — the modern alternative.

/*
  X-Frame-Options: SAMEORIGIN

Safety: This change is made in your server/CDN settings. Test on staging before production. If partners embed the site in an iframe, add them to frame-ancestors instead of using DENY.

1. Add X-Content-Type-Options: nosniff to every response.

/*
  X-Content-Type-Options: nosniff

Safety: This change is made in your server/CDN settings. Test on staging before production.

1. Set Referrer-Policy: strict-origin-when-cross-origin.

/*
  Referrer-Policy: strict-origin-when-cross-origin

Safety: This change is made in your server/CDN settings. Test on staging before production.

1. Disable browser features the site doesn't need (camera, microphone, geolocation).

/*
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.

1. Identify which certificate authority issued your current certificate (see the certificate check).
2. Publish CAA for that authority only, and add iodef to receive alerts.

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 iodef "mailto:security@example.com"

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. If your CDN issues certificates on your behalf, include it too — otherwise certificate renewal will fail.