Owner tools

Fixes that improve your score

Security

• HIGHAdd the missing security response headers
  Missing 5 of 6 standard browser headers. Start with Referrer-Policy, X-Content-Type-Options, and X-Frame-Options (one line each), then roll out CSP in Report-Only mode.
  WhyEach header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place.
  WhereMost are one line each in your server config, reverse proxy, CDN, or framework headers.
  Learn more

  Why this matters & sources

  Per-header consequence:

  • Content-Security-Policy: Controls which scripts, styles, and fonts are allowed to run on your pages. Without it, an injected <script> tag runs with full access to your users' sessions and cookies.
  • X-Frame-Options: Stops other sites loading yours inside an invisible iframe to trick users into clicking buttons they can't see (clickjacking).
  • X-Content-Type-Options: Tells browsers not to guess file types. Without it, a user-uploaded image can be sniffed as JavaScript and executed.
  • Referrer-Policy: Controls how much of the current URL is sent to third-party sites and analytics. The default leaks the full path, including query strings that may contain tokens or user IDs.
  • Permissions-Policy: Turns off browser features your site doesn't use (camera, microphone, geolocation, payment) so an injected script can't trigger them.

  CSP rollout: Content-Security-Policy is the hardest to get right. Start with Content-Security-Policy-Report-Only, which logs violations without blocking. Open DevTools Console, reload each page, and relax the policy until the console is clean. Rename the header to Content-Security-Policy to enforce. For real-user monitoring, point a report-to directive at a free collector (report-uri.com, Sentry, or a /api/csp-report route).

Legal & compliance

• MEDIUMAdd a privacy policy page
  WhyDocuments what personal data you collect and how you use it. Without one, it's hard to demonstrate basic GDPR / CCPA compliance to regulators or users.
  WhereUse a free generator like Termly or Iubenda to produce one in minutes, then link from your footer.
  Learn more

Discoverability

• MEDIUMAdd a robots.txt file
  WhyTells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs.
  WhereCreate /robots.txt at the site root. Most frameworks have a built-in path (Next.js app/robots.ts, Astro public/robots.txt).
  Learn more

Optional improvements

These don't change your StackScope score but cover SEO, agent-readiness, security-researcher discoverability, and compliance items worth addressing.

Security

• LOWAdd /.well-known/security.txt
  WhyLets security researchers report vulnerabilities responsibly through a published contact channel.
  WhereCreate /.well-known/security.txt with a Contact: email and Expires: date.
  Learn more

Email security

• HIGHAdd an SPF record
  No SPF TXT record found at the apex domain.
  WhyWithout SPF and DMARC, receiving servers have fewer signals to reject spoofed mail using your domain.
  WherePublish a TXT record at the apex like v=spf1 include:_spf.google.com ~all (replace the include: with your real sender, then end with ~all for soft-fail or -all for strict).
  Learn more
• HIGHAdd a DMARC record
  No DMARC record at _dmarc.{your-domain}.
  WhyDMARC tells receivers what to do when mail fails SPF or DKIM. Without one, they fall back to permissive defaults and your domain is more easily spoofed.
  WhereAdd a TXT record at _dmarc.{your-domain}. Start with v=DMARC1; p=none; rua=mailto:[email protected] (monitoring), then move to p=quarantine and p=reject once you're sure your real mail passes.
  Learn more
• MEDIUMConfigure DKIM with your email provider
  No DKIM record found at the common selectors we check.
  WhyDKIM signs your outbound mail with a cryptographic key receivers can verify. Without it, receivers can't tell your real mail from a spoof.
  WhereAsk your email provider for their DKIM setup. It's usually one TXT record at {selector}._domainkey.{your-domain}.
  Learn more

  Why this matters & sources

  Selectors we probe: Resend, SendGrid, Postmark, Mailchimp, Brevo, Mailgun, HubSpot, Customer.io, ConvertKit, Cloudflare Email. If you use Google Workspace, Microsoft 365, or self-hosted email with a custom selector, you may already have DKIM published and we just don't see it.

• LOWAdd MTA-STS
  No MTA-STS DNS record published.
  WhyPrevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks.
  WherePublish a TXT record at _mta-sts.{your-domain} plus a policy file at https://mta-sts.{your-domain}/.well-known/mta-sts.txt.
  Learn more
• LOWAdd a TLS-RPT record
  No TLS-RPT record at _smtp._tls.{domain}.
  WhyReceivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible.
  WherePublish one TXT record at _smtp._tls.{your-domain} like v=TLSRPTv1; rua=mailto:[email protected].
  Learn more

Agent / AI

• LOWAdd an llms.txt file
  WhyHelps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption.
  WhereCreate /llms.txt at the site root with a brief overview and key URLs.
  Learn more
• LOWDeclare a Content-Signal in robots.txt
  WhyStates how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies.
  WhereAdd a Content-Signal: line to your robots.txt.
  Learn more
• LOWAdd Link response headers
  WhyLets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip.
  WhereSet Link: response headers in your server config or framework middleware.
  Learn more