Owner tools

Fixes that improve your score

Security

• HIGHAdd the missing security response headers
  Missing: Content-Security-Policy
  WhyEach header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place.
  WhereMost are one line each in your server config, reverse proxy, CDN, or framework headers.
  Learn more

  Why this matters & sources

  Per-header consequence:

  • Content-Security-Policy: Controls which scripts, styles, and fonts are allowed to run on your pages. Without it, an injected <script> tag runs with full access to your users' sessions and cookies.

  CSP rollout: Content-Security-Policy is the hardest to get right. Start with Content-Security-Policy-Report-Only, which logs violations without blocking. Open DevTools Console, reload each page, and relax the policy until the console is clean. Rename the header to Content-Security-Policy to enforce. For real-user monitoring, point a report-to directive at a free collector (report-uri.com, Sentry, or a /api/csp-report route).

Content-Security-Policy-Report-Only:
default-src 'self';
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com;
frame-ancestors 'none';
base-uri 'self';
form-action 'self';

Optional improvements

These don't change your StackScope score but cover SEO, agent-readiness, security-researcher discoverability, and compliance items worth addressing.

Security

• LOWAdd /.well-known/security.txt
  WhyLets security researchers report vulnerabilities responsibly through a published contact channel.
  WhereCreate /.well-known/security.txt with a Contact: email and Expires: date.
  Learn more

Email security

• HIGHAdd a DMARC record
  No DMARC record at _dmarc.{your-domain}.
  WhyDMARC tells receivers what to do when mail fails SPF or DKIM. Without one, they fall back to permissive defaults and your domain is more easily spoofed.
  WhereAdd a TXT record at _dmarc.{your-domain}. Start with v=DMARC1; p=none; rua=mailto:[email protected] (monitoring), then move to p=quarantine and p=reject once you're sure your real mail passes.
  Learn more
• MEDIUMTighten SPF: replace ?all
  SPF record uses ?all (neutral).
  WhyNeutral SPF lets receivers log spoofing attempts but won't reject them, so it's close to no protection in practice.
  WhereMove to ~all (soft-fail) once you're confident in your sender list, then to -all (strict) for the strongest protection.
  Learn more
• LOWAdd MTA-STS
  No MTA-STS DNS record published.
  WhyPrevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks.
  WherePublish a TXT record at _mta-sts.{your-domain} plus a policy file at https://mta-sts.{your-domain}/.well-known/mta-sts.txt.
  Learn more
• LOWAdd a TLS-RPT record
  No TLS-RPT record at _smtp._tls.{domain}.
  WhyReceivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible.
  WherePublish one TXT record at _smtp._tls.{your-domain} like v=TLSRPTv1; rua=mailto:[email protected].
  Learn more

Agent / AI

• LOWAdd an llms.txt file
  WhyHelps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption.
  WhereCreate /llms.txt at the site root with a brief overview and key URLs.
  Learn more
• LOWDeclare a Content-Signal in robots.txt
  WhyStates how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies.
  WhereAdd a Content-Signal: line to your robots.txt.
  Learn more
• LOWAdd Link response headers
  WhyLets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip.
  WhereSet Link: response headers in your server config or framework middleware.
  Learn more