Owner tools

Fixes that improve your score

Security

• HIGHAdd the missing security response headers
  Missing: Content-Security-Policy
  WhyEach header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place.
  WhereMost are one line each in your server config, reverse proxy, CDN, or framework headers.
  Learn more

  Why this matters & sources

  Per-header consequence:

  • Content-Security-Policy: Controls which scripts, styles, and fonts are allowed to run on your pages. Without it, an injected <script> tag runs with full access to your users' sessions and cookies.

  CSP rollout: Content-Security-Policy is the hardest to get right. Start with Content-Security-Policy-Report-Only, which logs violations without blocking. Open DevTools Console, reload each page, and relax the policy until the console is clean. Rename the header to Content-Security-Policy to enforce. For real-user monitoring, point a report-to directive at a free collector (report-uri.com, Sentry, or a /api/csp-report route).

Content-Security-Policy-Report-Only:
default-src 'self';
script-src 'self' 'unsafe-inline' https://www.googletagmanager.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
img-src 'self' data: https://www.googletagmanager.com;
font-src 'self' https://fonts.gstatic.com;
frame-ancestors 'none';
base-uri 'self';
form-action 'self';

Optional improvements

These don't change your StackScope score but cover SEO, agent-readiness, security-researcher discoverability, and compliance items worth addressing.

Security

• LOWAdd /.well-known/security.txt
  WhyLets security researchers report vulnerabilities responsibly through a published contact channel.
  WhereCreate /.well-known/security.txt with a Contact: email and Expires: date.
  Learn more

Email security

• MEDIUMConfigure DKIM with your email provider
  No DKIM record found at the common selectors we check.
  WhyDKIM signs your outbound mail with a cryptographic key receivers can verify. Without it, receivers can't tell your real mail from a spoof.
  WhereAsk your email provider for their DKIM setup. It's usually one TXT record at {selector}._domainkey.{your-domain}.
  Learn more

  Why this matters & sources

  Selectors we probe: Resend, SendGrid, Postmark, Mailchimp, Brevo, Mailgun, HubSpot, Customer.io, ConvertKit, Cloudflare Email. If you use Google Workspace, Microsoft 365, or self-hosted email with a custom selector, you may already have DKIM published and we just don't see it.

• LOWAdd MTA-STS
  No MTA-STS DNS record published.
  WhyPrevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks.
  WherePublish a TXT record at _mta-sts.{your-domain} plus a policy file at https://mta-sts.{your-domain}/.well-known/mta-sts.txt.
  Learn more
• LOWAdd a TLS-RPT record
  No TLS-RPT record at _smtp._tls.{domain}.
  WhyReceivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible.
  WherePublish one TXT record at _smtp._tls.{your-domain} like v=TLSRPTv1; rua=mailto:[email protected].
  Learn more

Page basics & SEO

• LOWTrim your meta description to under 160 characters
  Currently 1740 characters: "Stella Chatbot is a WordPress chatbot plugin built to give website owners full control over how automated replies are delivered. It uses a practical FAQ-first approach: you define the chatbot name, avatar, categories, keywords, and answers from the admin panel, and the widget responds consistently on the frontend. Visitors can start from guided category suggestions, ask direct questions, and receive instant replies when keyword matches are found. This makes Stella Chatbot especially useful for support pages, service businesses, product sites, and any website that needs faster response handling without adding complex setup.The free version focuses on reliable core chatbot functionality for everyday use. You can manually manage up to 100 Q&A entries, assign unique keywords, organize content by category, set welcome messaging, and display category suggestions to help visitors navigate common topics. It is intentionally streamlined so non-technical admins can configure and run the bot quickly while still maintaining structured responses and clear fallback behavior when exact matches are not found.The pro version expands Stella Chatbot into a complete customer interaction system. It removes FAQ limits, adds advanced import workflows, enables AI fallback with provider/model selection (OpenAI ChatGPT, Anthropic Claude, Google Gemini, Groq, OpenRouter), supports lead capture, and includes session-based logging and analytics for performance tracking. Pro users can export chat data, tune AI behavior, and manage a more scalable chatbot operation suitable for higher traffic websites, sales funnels, and support teams. This gives businesses a single plugin path from basic FAQ automation to advanced AI-assisted conversations."
  WhyGoogle truncates around 155-160 characters on desktop SERPs (less on mobile), so anything past that won't appear in the snippet.
  WhereEdit your <meta name="description"> tag. Put the most click-worthy phrase first.
  Learn more

Agent / AI

• LOWDeclare a Content-Signal in robots.txt
  WhyStates how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies.
  WhereAdd a Content-Signal: line to your robots.txt.
  Learn more
• LOWAdd Link response headers
  WhyLets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip.
  WhereSet Link: response headers in your server config or framework middleware.
  Learn more