Does your website look legitimate? Trust and security checks
Does the site look and behave like a legitimate business? 27 checks · 8% of the overall score.
Customers and browsers judge legitimacy in seconds: a padlock, a current copyright year, a privacy policy, no scary warnings. Attackers judge it too — exposed configuration files, outdated CMS versions and missing headers are how small-business sites get defaced or used for phishing. This chapter covers both audiences.
The 27 checks
| Check | Why it matters |
|---|---|
| HTTPS | Browsers mark plain http:// sites “Not secure”. |
| Certificate valid | An expired or mismatched certificate is a full-page browser warning. |
| Certificate expiry | We warn at 14 days so renewals never lapse. |
| Modern TLS protocol | TLS 1.0/1.1 are deprecated and flagged by browsers and scanners. |
| HSTS | Forces HTTPS on repeat visits, preventing downgrade attacks. |
| Content-Security-Policy | The strongest defence against injected scripts. |
| Clickjacking protection | X-Frame-Options / frame-ancestors stops your site being framed by attackers. |
| X-Content-Type-Options | Prevents MIME-sniffing attacks; one line to add. |
| Referrer-Policy | Controls what URLs leak to third parties. |
| Permissions-Policy | Restricts camera, microphone and other powerful features. |
| No mixed content | HTTP assets on an HTTPS page break the padlock. |
| Sensitive files not exposed | .env, .git, backups and config files must never be publicly readable. |
| Server software version hidden | Version banners hand attackers a shopping list. |
| CMS version hidden | Same principle for WordPress and friends. |
| WordPress hardening | xmlrpc, user enumeration and readable wp-config are the usual entry points. |
| jQuery version | Old jQuery carries known XSS vulnerabilities. |
| Privacy policy | Legally required in most jurisdictions and expected by customers. |
| Terms of service | Sets expectations and protects the business. |
| Cookie consent banner | Required where GDPR/CCPA-style laws apply and analytics are used. |
| Copyright year current | A stale year is the cheapest signal of an abandoned site. |
| Favicon | Missing favicons look unfinished in tabs and search results. |
| Domain registration | We read the registry (RDAP) for registrar, creation and expiry. |
| Registrar transfer lock | Locked domains cannot be hijacked by a forged transfer. |
| DNSSEC | Cryptographically signs DNS answers against spoofing. |
| CAA record | Restricts which certificate authorities may issue for the domain. |
| Accessibility statement | Signals inclusion and reduces legal exposure. |
| Lighthouse accessibility & best practices | Google's automated accessibility and hygiene audits. |
Most common fixes
- Add HSTS, X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy and Permissions-Policy headers — five lines at the host or CDN.
- Block public access to .env, .git and backup files; keep the CMS and plugins updated.
- Publish a privacy policy and terms page and link them in the footer.
- Turn on registrar lock and auto-renew; consider DNSSEC if your DNS host supports it.
Questions
Do security headers affect SEO?
Not directly, but HTTPS does, and the headers protect you from the compromises that get sites flagged by Safe Browsing — which removes you from search results instantly.
Why does my site say Not Secure?
Either there is no TLS certificate, it expired, it is for a different hostname, or the page loads some assets over plain http (mixed content). The Trust chapter identifies which.