Digital Break Risk | Free version

Complete and standardize the HTTP-to-HTTPS redirect configuration.

Recommended checks:

1. Identify the incomplete case

   • Check whether the issue affects:
     • Apex domain.
     • www domain.
     • Specific paths.
     • Trailing slash variants.
     • Query strings.
     • Subdomains.
     • Redirect status codes.

2. Use permanent redirects

   • Use 301 redirects for production canonical URLs.
   • Avoid temporary 302 redirects unless there is a specific operational reason.

3. Preserve URL structure

   • Keep the same path and query string after redirect.
   • Avoid sending all HTTP requests to the homepage.

4. Remove redirect chains

   • Configure a direct redirect from HTTP to the final HTTPS canonical URL.
   • Minimize multiple hops across www, non-www, language paths, or trailing slash variants.

5. Apply rules consistently

   • Configure the redirect at CDN, proxy, load balancer, or web server level.
   • Avoid conflicting redirect rules between application, CMS plugins, hosting panel, and CDN.

6. Test common entry points

   • http://domain.com
   • http://www.domain.com
   • Important landing pages.
   • Key content/category pages.
   • Login and account pages.

7. Review HSTS only after fixing redirects

   • HSTS should be considered only when HTTPS works reliably across the intended hostnames.

Configure the following header on all relevant responses:

X-Content-Type-Options: nosniff

Technical checks:

• Ensure JavaScript files are served with a valid JavaScript MIME type.
• Ensure CSS files are served as text/css.
• Ensure JSON, images, fonts and downloadable files have correct Content-Type values.
• Apply the header consistently through the web server, CDN or reverse proxy.
• Re-test static assets and API responses after deployment.

Configure an explicit Referrer-Policy header.

Recommended balanced option:

Referrer-Policy: strict-origin-when-cross-origin

Stricter option:

Referrer-Policy: no-referrer

Technical guidance:

• Use strict-origin-when-cross-origin for most commercial websites.
• Use no-referrer where maximum privacy is required.
• Avoid unsafe-url, because it can disclose full URLs to external destinations.
• Avoid placing sensitive data, tokens, emails or identifiers in URLs.
• Validate analytics, attribution and affiliate tracking before choosing a stricter policy.

Publish a security.txt file with a clear vulnerability reporting process.

Recommended actions:

1. Create the file at the standard location:

   https://example.com/.well-known/security.txt
   

2. Include at least a valid contact method.

   Example:

   Contact: mailto:security@example.com
   Preferred-Languages: en, es
   Canonical: https://example.com/.well-known/security.txt
   

3. Optional but recommended fields:

   Policy: https://example.com/security-policy
   Acknowledgments: https://example.com/security-acknowledgments
   Expires: 2027-12-31T23:59:59Z
   

4. Make sure the contact mailbox is monitored.

5. Define an internal triage process:

   • Who receives the report
   • Who validates the issue
   • Expected response time
   • Escalation path for critical vulnerabilities
   • Criteria for coordinated disclosure

6. Verify publication:

   curl -I https://example.com/.well-known/security.txt
   curl https://example.com/.well-known/security.txt
   

Add resource hints for external font origins that participate in the initial page load.

Technical recommendations:

• Identify the real origin from which the font files are downloaded.
• Add preconnect in the <head> for critical font origins:

  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  

• If the provider uses separate domains for CSS and font files, review both origins.
• For Google Fonts, the usual configuration is:

  <link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  

• As a lighter alternative, use dns-prefetch:

  <link rel="dns-prefetch" href="https://fonts.gstatic.com">
  

• Place the hints as early as possible inside the <head>.
• Avoid adding preconnect to too many domains. Use it only for origins that are genuinely required during the initial load.
• Review whether external fonts can be self-hosted to reduce third-party dependency.
• Use font-display: swap or an equivalent strategy to avoid invisible text while fonts are loading.
• Validate the result by measuring FCP, LCP, and visual text behavior during page load.

Add a descriptive meta description inside the document <head>.

Recommended implementation:

<meta name="description" content="Concise description of the page, its value and its relevant context for users.">

Technical checks:

• Write a unique description for each important page.
• Keep it aligned with the visible page content.
• Avoid keyword stuffing or misleading claims.
• Avoid duplicate descriptions across many pages.
• Ensure it is present in the initial HTML response.
• For website pages, describe the content, category or commercial intent clearly.
• Re-test after deployment and cache purge.

Add the core Open Graph tags inside the document <head>.

Recommended implementation:

<meta property="og:title" content="Page title for social sharing">
<meta property="og:description" content="Short, compelling description for social sharing">
<meta property="og:image" content="https://example.com/path/to/image.jpg">

Technical checks:

• Use an absolute URL for og:image.
• Recommended image size: at least 1200x630 px.
• Ensure the image URL returns HTTP 200.
• Ensure the image is not blocked by authentication, hotlink protection or robots rules.
• Use page-specific metadata for content pages, categories, blog posts and campaigns.
• Keep Open Graph values consistent with the page title, meta description and visible content.
• Ensure the tags are present in the initial HTML response.
• Re-test link previews after deployment and cache purge.

Add relevant Schema.org structured data using JSON-LD.

Recommended implementation:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Brand Name",
  "url": "https://example.com"
}
</script>

Recommended schema types by page:

• Homepage: Organization, WebSite.
• Detail page: use schema types only when the corresponding data is real and visible.
• Category page: BreadcrumbList, optionally ItemList if appropriate.
• Blog or guide page: Article or BlogPosting.
• FAQ section: FAQPage only if the questions and answers are visible to users.
• Local business page: LocalBusiness when the business has a real physical presence.

Technical checks:

• Use JSON-LD where possible.
• Choose schema types that match the actual page content.
• Keep structured data consistent with visible content.
• Do not mark up fake reviews, unavailable items or hidden content.
• Validate the markup before deployment.
• Check eligibility with rich result testing tools where applicable.
• Ensure the JSON-LD is present in the initial HTML or reliably rendered for crawlers.
• Re-test after deployment and monitor Search Console for structured data errors.

Enable DNSSEC signing for the domain.

Recommended technical actions:

1. Confirm DNSSEC support with the current DNS hosting provider or registrar.
2. Enable DNSSEC signing on the authoritative DNS zone.
3. Publish the resulting DS record with the domain registrar so the parent zone can delegate trust.
4. Verify propagation and validate the chain of trust with an external DNSSEC validation tool.
5. Monitor key rotation schedules if the provider does not automate them.