HTTPS, SPF and DMARC: three acronyms your company's trust depends on
The padlock in the browser and emails nobody can fake. What the acronyms mean and how to find out whether you have them.
A customer opens your website and the browser says “Not secure”. Or they get an email “from you” with an invoice to pay – except you never sent it. Both can be prevented with three settings that take a few minutes.
HTTPS – the padlock in the browser
HTTPS encrypts the connection between the visitor and your site. Without it browsers mark the site as insecure, forms can be intercepted and Google ranks the site lower. A certificate is usually free today – you just switch it on and redirect http to https.
SPF – who may send email for you
SPF is a record in your domain settings that says: “Email for company.com may only be sent by these servers.” Without it anyone can send an email that looks like it's from you.
DMARC – what to do with spoofed email
DMARC tells mail servers what to do with an email that fails the checks: nothing, send it to spam, or reject it outright. Only with DMARC set to quarantine or reject are you really protected against spoofed email.
How to find out where you stand
On the security check page, enter your website's address. In a few seconds you'll see HTTPS, security headers, SPF and DMARC – free, no sign-up.
If something shows red, don't worry. Most fixes take a few minutes – and I'm happy to do them for you.