For MSPs and Web Agencies
Remediation guidance your developers can apply
Every finding includes why it matters, its potential business impact and configuration examples for the platform the website runs on.
Platforms covered
- Nginx: add_header directives with the always flag.
- Apache HTTP Server: mod_headers rules.
- Microsoft IIS: web.config customHeaders and native HSTS.
- Cloudflare: Transform Rules and edge certificate settings.
- WordPress: a send_headers hook for theme or plugin code.
- AWS CloudFront: response headers policies.
Only where it applies
Examples appear only when they are technically appropriate. Cookie flags, for example, are set by the application or web server, so no CDN example is offered for them.
Test before production
Every example carries a reminder to test the change in a staging environment first. A wrong header or policy can break pages, sign-in or payments.
Frequently asked questions
Do I get remediation on the free plan?
Yes, for up to three medium-severity findings per scan. High and critical findings show their title, severity and why they matter; their evidence and fixes need Pro. Low and informational findings are listed too. Pro shows remediation for every finding.
Are the examples copy-and-paste ready?
They are starting points with a copy button. Review values such as max-age and allowed sources for each website before deploying.