Fix It: Security Fixes by Platform

	WordPress	Shopify	Wix	Squarespace	BigCommerce	Webflow	A custom site
Security headers HSTS, CSP, X-Frame-Options and friends	You can do this How to →	Not possible How to →	Limited How to →	Not possible How to →	Limited How to →	Limited How to →	You can do this How to →
SPF record Stop others sending email as your domain	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →
DMARC record Tell inboxes what to do with fakes	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →
SSL certificate Encrypt the connection, fix HTTPS	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →	You can do this How to →
security.txt Publish a way to report problems	You can do this How to →	Not possible How to →	Not possible How to →	Not possible How to →	You can do this How to →	You can do this How to →	You can do this How to →

You can do this Fully possible Limited Possible with real limits Not possible Your platform will not allow it

Verified against each platform's own documentation in July 2026. Platforms change, so check the current docs before making a change you cannot undo.

Find out what needs fixing.

Run a free check on your site and see exactly which of these you pass, in seconds.