FmindWebsite security guides
Choose a check to understand why it matters, who can help and what to verify after a change.
Website, domain and email
- Security certificate (HTTPS)
- Certificate expiry (HTTPS)
- Send visitors to the secure site (HTTPS redirect)
- Always use HTTPS (HSTS)
- Protection against malicious scripts (CSP)
- File type protection (X-Content-Type-Options)
- Cookie protection (Secure, HttpOnly)
- Allowed certificate providers (CAA)
- Security contact file (security.txt)
- Email receiving servers (MX)
- Authorized email senders (SPF)
- Email spoofing protection (DMARC)
- Email signing (DKIM)
Checks needing a separate review
This passive check does not verify these protections. Use the guide to prepare a review with the person responsible.