Skip to main content
100 step-by-step fixes

Diagnose precisely. Fix confidently.

Every issue CheckFast surfaces, paired with exact commands, configuration and DNS records. Production-focused remediation without generic filler.

SSL, TLS, security headers

Certificate, TLS, security headers, mixed content. The kit you reach for after an SSL audit fails. · 25 fixes

Fix expired SSL certificate and restore HTTPS access

Your TLS certificate is past its notAfter date and browsers are blocking the page with NET::ERR_CERT_DATE_INVALID. Renew with certbot, ACM, or your CA and reload.

Read fix

Replace self-signed SSL certificate with a trusted CA cert

Browsers reject self-signed certs with NET::ERR_CERT_AUTHORITY_INVALID because no public CA chains them. Replace with Let's Encrypt, ZeroSSL, or your cloud provider's managed cert.

Read fix

Fix incomplete SSL certificate chain and intermediate errors

Your server sends only the leaf certificate, missing intermediates. Browsers may cache them, but mobile clients and curl fail with 'unable to get local issuer certificate'.

Read fix

Fix SSL certificate hostname mismatch errors in browsers

The certificate's Subject Alternative Name list does not include the requested hostname, so browsers throw NET::ERR_CERT_COMMON_NAME_INVALID. Reissue with the correct SAN.

Read fix

Disable weak SSL ciphers and enforce modern TLS suites

Your server still negotiates RC4, 3DES, or CBC ciphers that fail PCI scans and SSL Labs grades B or below. Enforce ECDHE-AES-GCM and ChaCha20-Poly1305 only.

Read fix

Fix mixed content warnings on HTTPS pages

Your HTTPS page loads scripts, images, or iframes over HTTP, triggering 'Mixed Content' console errors. Browsers block active content and downgrade the lock icon.

Read fix

Add HSTS header to enforce HTTPS and prevent SSL stripping

Without Strict-Transport-Security, attackers can SSL-strip the first request. Set max-age=63072000; includeSubDomains; preload and submit to hstspreload.org.

Read fix

Increase HSTS max-age to meet preload list requirements

Your HSTS max-age is below 31536000 seconds, leaving users vulnerable shortly after the first visit. Bump to 63072000 (2 years) and add preload.

Read fix

Deploy a Content-Security-Policy to mitigate XSS attacks

No CSP header means any injected script runs with full page privileges. Add a strict policy with nonce-based script-src, frame-ancestors, and upgrade-insecure-requests.

Read fix

Remove unsafe-inline from CSP and adopt nonce-based scripts

'unsafe-inline' negates most XSS protection a CSP would provide. Replace with per-request nonces or hashes plus 'strict-dynamic' for third-party scripts.

Read fix

Block clickjacking with X-Frame-Options or CSP frame-ancestors

Without X-Frame-Options or CSP frame-ancestors, attackers can iframe your site and overlay UI to trick clicks. Set frame-ancestors 'none' or 'self'.

Read fix

Add X-Content-Type-Options nosniff to block MIME sniffing

Without nosniff, browsers may sniff MIME types and execute uploaded files as scripts. Set X-Content-Type-Options: nosniff on every response.

Read fix

Set Referrer-Policy to control outbound Referer leakage

Without Referrer-Policy, Chrome leaks full URLs (including query strings) to third parties. Set strict-origin-when-cross-origin to keep paths private.

Read fix

Set Permissions-Policy to restrict browser feature access

Without Permissions-Policy, embedded iframes and scripts can use camera, mic, geolocation, and payment APIs. Disable unused features explicitly.

Read fix

Force HTTP-to-HTTPS redirects on every hostname you serve

Plain HTTP requests must 301 to HTTPS, including apex, www, and every subdomain. Pair with HSTS so browsers cache the upgrade.

Read fix

Disable TLS 1.0 and TLS 1.1 to meet PCI-DSS and modern standards

TLS 1.0 and 1.1 are deprecated since 2020 and fail PCI scans. Enforce TLS 1.2 minimum, prefer TLS 1.3, and remove SSLv3 entirely.

Read fix

Enable OCSP stapling to speed up TLS handshakes and improve privacy

Without OCSP stapling, browsers fetch revocation status from the CA themselves, slowing first connections and leaking visit data. Enable stapling on nginx, Apache, or your CDN.

Read fix

Replace weak Diffie-Hellman parameters with 2048-bit or larger

DH parameters under 2048 bits are vulnerable to Logjam. Generate fresh 2048-bit DH parameters or switch to ECDHE-only cipher suites.

Read fix

Mitigate the CRIME TLS compression attack on web servers

CRIME exploits TLS compression to recover session cookies. Disable TLS-level compression and the equivalent SPDY/HTTP-level compression of secrets.

Read fix

Patch Heartbleed by upgrading OpenSSL and rotating keys

Heartbleed (CVE-2014-0160) leaks server memory including private keys. Upgrade OpenSSL to a patched version, then reissue certificates and rotate session secrets.

Read fix

Eliminate POODLE risk by disabling SSLv3 and CBC fallback

POODLE exploits SSLv3's CBC padding to recover bytes from encrypted traffic. Disable SSLv3 outright and add TLS_FALLBACK_SCSV support.

Read fix

Renew SSL certificates before they expire and break HTTPS

Your certificate expires in under 30 days. Automate renewal with certbot, ACM, or Caddy and add monitoring so it never reaches the wire.

Read fix

Limit wildcard SSL certificate scope to reduce blast radius

A single wildcard cert covering all subdomains becomes a master key if compromised. Use named SAN certs per service and reserve wildcards for ephemeral routes.

Read fix

Add CAA DNS records to control which CAs may issue certificates

Without a CAA record, any public CA can issue a certificate for your domain. Publish CAA records limiting issuance to your chosen CAs.

Read fix

Verify SSL certificate appears in Certificate Transparency logs

Browsers reject certificates not logged in CT. Confirm SCTs are embedded or stapled, and monitor logs for unauthorized issuances against your domains.

Read fix

Email deliverability, DNS, SPF/DKIM/DMARC

SPF, DKIM, DMARC, BIMI, MTA-STS — every reason inbox providers send your mail to spam. · 25 fixes

Fix Missing SPF Record on Your Sending Domain

No SPF record means Gmail and Outlook cannot verify which servers can send for your domain. Publish a v=spf1 TXT record to stop spam-folder placement.

Read fix

Fix SPF Too Many DNS Lookups (PermError 10-Limit)

RFC 7208 caps SPF at 10 DNS lookups. Once you exceed it the record returns PermError and every receiver fails authentication. Flatten or split to fix.

Read fix

Fix SPF PermError on Inbound Authentication Checks

PermError means your SPF record is permanently invalid — too many lookups, syntax error, or duplicate records. Receivers reject the mail immediately.

Read fix

Fix SPF TempError on Outbound Mail Authentication

TempError signals a transient DNS lookup failure during SPF evaluation. Receivers retry but flaky DNS hurts deliverability. Diagnose your nameserver path.

Read fix

Fix Multiple SPF Records Causing PermError on Receivers

RFC 7208 forbids more than one v=spf1 TXT record at the apex. Two or more produces PermError on every check. Merge into one record to fix.

Read fix

Fix SPF Syntax Error in Your TXT Record

Typos, missing colons, smart quotes, or unknown mechanisms break SPF parsing and produce PermError. Validate syntax before republishing the TXT record.

Read fix

Fix Missing DKIM Signature on Outbound Email

No DKIM signature means receivers cannot cryptographically verify your mail. Publish a DKIM TXT record at the selector and enable signing in your ESP.

Read fix

Fix Invalid DKIM Key in DNS TXT Record

Truncated, malformed, or mismatched DKIM keys produce dkim=permfail at every receiver. Republish the public key exactly as the ESP supplies it.

Read fix

Fix DKIM Key Too Short Warning (1024-bit Deprecated)

RFC 8301 deprecates 1024-bit DKIM keys. Receivers warn or fail short keys. Rotate to 2048-bit RSA at every sending vendor.

Read fix

Fix DKIM Not Aligned with From Domain (DMARC Failing)

DKIM passes but the d= signing domain does not match the From header, so DMARC alignment fails. Sign with your domain, not the ESP's.

Read fix

Fix Missing DMARC Record on Sender Domain

No DMARC record means receivers have no policy to enforce on auth failures. Publish _dmarc TXT with p=none to start monitoring, then ramp to enforcement.

Read fix

Fix DMARC Policy Stuck at p=none (No Enforcement)

p=none monitors but does not protect. Once authentication is clean, ramp to p=quarantine and p=reject to actually block spoofing.

Read fix

Fix DMARC Misalignment Between From and Authenticated Domain

DMARC fails because SPF or DKIM authenticate a different domain than the From header. Configure aligned authentication or accept enforcement bouncing mail.

Read fix

Fix Missing DMARC rua Reporting Address

Without rua= you have no visibility into authentication failures or domain spoofing. Add a reports mailbox to your DMARC record immediately.

Read fix

Fix Missing MX Record on Domain (No Inbound Mail)

Without an MX record receivers cannot deliver mail to your domain. Publish MX pointing to your inbound mail provider with the correct priority.

Read fix

Fix MX Priority Misconfigured (Wrong Failover Order)

Sending MTAs prefer lower-priority MX records first. Wrong priorities route mail to backup or unintended servers. Reorder by provider documentation.

Read fix

Fix Missing PTR (Reverse DNS) Record on Sending IP

Receivers require a PTR record on the sending IP that resolves back to a hostname. Missing reverse DNS triggers spam-folder placement or outright rejects.

Read fix

Fix Broken DNSSEC Chain on Email or Web Domain

A broken DNSSEC chain causes SERVFAIL on validating resolvers, breaking SPF/DKIM lookups and websites. Repair the DS record or disable DNSSEC.

Read fix

Fix DNSSEC Not Enabled on Production Domain

Without DNSSEC, your DNS responses can be spoofed by on-path attackers. Enable DNSSEC at your DNS provider and publish DS at the registrar.

Read fix

Fix Nameserver Mismatch Between Registrar and DNS Host

If registrar NS delegation does not match the DNS host's nameservers, queries fall through to the wrong zone. Update NS at the registrar to match.

Read fix

Fix Slow DNS Propagation After a Record Change

DNS changes take effect at TTL expiry. If propagation feels slow, lower TTL beforehand, verify negative caching, and check resolver behavior worldwide.

Read fix

Fix Missing MTA-STS Policy on Receiving Domain

MTA-STS (RFC 8461) forces TLS on inbound SMTP. Without it, attackers can downgrade connections and read mail in transit. Publish a policy file and TXT record.

Read fix

Fix Missing TLS-RPT Reporting Policy

TLS-RPT (RFC 8460) reports inbound SMTP TLS failures to your domain. Without it, you have no telemetry on downgrade attacks or expired certs.

Read fix

Fix Invalid BIMI Record (Brand Logo Not Showing)

BIMI shows your brand logo in Gmail and Apple Mail. Invalid SVG, missing VMC, or wrong DMARC policy hides the logo. Validate the record and assets.

Read fix

Fix Domain or IP Blacklisted on Spamhaus (SBL/XBL/PBL)

Spamhaus listings reject mail at most receivers. Identify the list (SBL, CSS, XBL, PBL), remediate the cause, and submit a delisting request.

Read fix

SEO, schema, meta tags

Title tags, meta descriptions, structured data, hreflang, canonical, sitemaps. The on-page SEO basics that compound over years. · 25 fixes

Fix Missing XML Sitemap: How to Create and Submit sitemap.xml

No sitemap.xml on your site means Googlebot has to discover URLs through internal links alone. Generate one, submit it in Search Console, and reference it from robots.txt.

Read fix

Fix Sitemap Too Large: Split sitemap.xml Into a Sitemap Index

The sitemaps protocol caps each file at 50,000 URLs and 50 MB uncompressed. Beyond that, split the sitemap into shards and reference them from a sitemap index file.

Read fix

Fix Missing robots.txt: Add a Crawl Directives File

Without a /robots.txt file, crawlers fall back to defaults and you lose control over crawl budget, sitemap discovery, and bot-specific rules. Add one even if it is permissive.

Read fix

Fix robots.txt Disallow All: Unblock Googlebot Site-Wide

A robots.txt with Disallow: / blocks every crawler from your entire site. Often a leftover from staging — replace it with a production-appropriate ruleset before traffic disappears.

Read fix

Fix Title Tag Too Long: Stay Under Google's SERP Pixel Limit

Google truncates title tags around 580 pixels (roughly 60 characters). Long titles get cut with an ellipsis, hurting CTR. Tighten copy and front-load the keyword.

Read fix

Fix Missing Title Tag: Add a Unique Title to Every Page

A missing <title> element forces Google to invent one from page content. Add a unique, keyword-led title under 60 characters to every indexable URL.

Read fix

Fix Missing Meta Description: Write One Per Indexable Page

Without a meta description, Google generates a snippet from page content, often poorly. Add a 140-160 character description targeting the primary user intent.

Read fix

Fix Duplicate Meta Descriptions: Make Each Description Unique

Duplicate meta descriptions across many URLs trigger Search Console warnings and lower CTR. Generate unique descriptions from page data, not a global default.

Read fix

Fix Multiple H1 Tags: Use One H1 Per Page

Multiple H1 elements dilute the page's primary topic signal. Use exactly one <h1> matching the user query, with H2s for sections and H3s for subsections.

Read fix

Fix Missing H1 Tag: Add a Single Primary Heading Per Page

Pages without an H1 lose a primary topical signal for search engines and screen readers. Add exactly one H1 element matching the page intent.

Read fix

Fix Missing Canonical Tag: Add rel=canonical to Every Page

Without a rel=canonical link, Google guesses the canonical URL when duplicates exist, often picking the wrong one. Set a self-referential canonical on every indexable page.

Read fix

Fix Canonical Self-Reference Errors: Resolve Loops and Mismatches

Canonical pointing to a different URL than the one served — or to a redirected, 4xx, or non-indexable target — confuses Google's canonical picker. Audit and align.

Read fix

Fix Missing Open Graph Tags: Add og:title, og:description, og:image

Without Open Graph tags, social platforms scrape the page and pick a random image. Add og:title, og:description, og:image, and og:url to control link previews.

Read fix

Fix Missing og:image: Add a 1200x630 Preview Image

Pages without og:image render as text-only link previews. Add a 1200x630 PNG/JPG via og:image and emit it in SSR so social crawlers can fetch it.

Read fix

Fix og:image Too Small: Use 1200x630 for Full-Width Previews

og:image under 600 pixels wide renders as a small square thumbnail on Facebook and LinkedIn. Upscale to 1200x630 for the large preview card.

Read fix

Fix Missing Twitter Card Tags: Add summary_large_image

Without twitter:card and twitter:image, X.com falls back to OG tags imperfectly. Set Twitter Card tags explicitly for predictable, large-image link previews.

Read fix

Fix Missing Schema Markup: Add JSON-LD Structured Data

Without schema markup, your pages are ineligible for rich results — review stars, FAQ accordions, breadcrumbs, sitelinks. Add JSON-LD per page type.

Read fix

Fix Invalid Schema Markup: Resolve JSON-LD Parsing Errors

Invalid JSON-LD makes pages ineligible for rich results. Fix syntax errors, wrong types, and malformed properties using the Rich Results Test.

Read fix

Fix Schema Missing Required Property: Add Headline, Image, Offers

Each Schema.org rich result type has required properties. Missing them makes the page ineligible for the rich result. Add per Google's structured-data docs.

Read fix

Fix Broken Hreflang: Resolve Reciprocation and 404 Errors

Hreflang requires reciprocal annotations: page A pointing to B requires B to point to A. Broken hreflang shows up in Search Console as 'No return tags'.

Read fix

Fix Missing Hreflang: Add Language and Region Annotations

Multilingual sites without hreflang let Google pick which variant to surface, often wrong. Add hreflang annotations on every translated or localized page.

Read fix

Fix Duplicate Content: Consolidate URLs With 301 or Canonical

Duplicate content splits ranking signals and confuses Google's canonical picker. Use 301 redirects, rel=canonical, and parameter handling to consolidate.

Read fix

Fix Thin Content: Expand Pages With Substantive, Original Detail

Thin content pages with little unique value get demoted or excluded from Google's index. Expand with original analysis, examples, and structured data.

Read fix

Fix Broken Internal Links: Find and Repair 404s in Your Own Pages

Internal links pointing to 404s waste crawl budget, frustrate users, and drop ranking signal flow. Crawl, identify, and fix or redirect each one.

Read fix

Fix Orphaned Pages: Add Internal Links to Isolated URLs

Orphan pages have no incoming internal links — Googlebot can only find them via sitemap. Add links from category, navigation, or related-content sections.

Read fix

Page speed, redirects, Core Web Vitals

Core Web Vitals (LCP, INP, CLS), TTFB, render-blocking resources, image optimisation. Browser-grade fixes ranked by user-perceived impact. · 25 fixes

Fix LCP too slow: get Largest Contentful Paint under 2.5s

Largest Contentful Paint above 2.5 seconds fails Core Web Vitals and tanks mobile rankings. Diagnose the LCP element and ship targeted fixes that move the metric.

Read fix

Fix CLS too high: stop layout shifts above 0.1

Cumulative Layout Shift above 0.1 fails Core Web Vitals. Find the shifting elements in DevTools and reserve space for images, fonts, and ads so content stops jumping.

Read fix

Fix INP poor: get Interaction to Next Paint under 200ms

INP above 200ms means the page feels laggy on every click and tap. Profile main-thread work, break up long tasks, and defer non-critical JS to pass Core Web Vitals.

Read fix

Fix TTFB slow: cut Time to First Byte under 800ms

Time to First Byte above 800ms starves every other Core Web Vital. Move rendering to the edge, cache aggressively, and tune origin response times to unblock LCP.

Read fix

Fix FCP slow: get First Contentful Paint under 1.8s

First Contentful Paint above 1.8s means users stare at a blank page too long. Eliminate render-blocking resources and inline critical CSS to make the page paint sooner.

Read fix

Eliminate render-blocking resources slowing first paint

Render-blocking CSS and JavaScript delay First Contentful Paint by hundreds of milliseconds. Inline critical styles and defer the rest to unblock the browser.

Read fix

Remove unused CSS to speed up first paint

Unused CSS bloats render-blocking stylesheets and slows FCP. Use Coverage tools to find dead rules and split styles by route to ship only what each page needs.

Read fix

Remove unused JavaScript to cut bundle size and TBT

Unused JavaScript bloats bundles, blocks the main thread, and tanks INP. Code-split, tree-shake, and lazy-load to ship only the code each route actually needs.

Read fix

Enable Brotli or gzip to compress text assets

Serving HTML, CSS, and JS uncompressed wastes 60-80% of payload bytes. Enable Brotli on your CDN or origin to cut transfer size and speed up FCP and LCP.

Read fix

Optimize images: AVIF, WebP, srcset, and modern formats

Unoptimized images are usually the LCP bottleneck. Convert to AVIF or WebP, ship responsive srcset, and lazy-load below-the-fold images to drop megabytes of payload.

Read fix

Fix render-blocking fonts: stop FOIT and font swap shifts

Web fonts loaded with default font-display block text rendering and cause layout shifts. Use font-display: swap, preload critical fonts, and self-host to fix FCP and CLS.

Read fix

Reduce excessive DOM size: keep nodes under 1500

DOMs over 1500 nodes slow down style recalc, layout, and INP. Virtualize long lists, lazy-render off-screen content, and prune unused wrappers to cut DOM weight.

Read fix

Fix main thread blocked: cut Total Blocking Time and INP

Long tasks over 50ms freeze the main thread, spike Total Blocking Time, and tank INP. Profile bottlenecks, break up tasks, and offload to workers to keep the page responsive.

Read fix

Enable HTTP/2 or HTTP/3 to multiplex requests

Serving over HTTP/1.1 forces the browser to open multiple connections and head-of-line blocks every request. HTTP/2 and HTTP/3 multiplex everything over one connection.

Read fix

Enable Brotli compression for smaller text payloads

Brotli compresses HTML, CSS, and JS 15-25% smaller than gzip. Enable it on your CDN or origin to cut bytes over the wire and speed up FCP and LCP.

Read fix

Use a CDN to cut latency and offload origin traffic

Without a CDN, every user hits a single origin, paying full RTT and TLS setup cost. Push static assets to the edge with Cloudflare, Fastly, Vercel, or CloudFront.

Read fix

Set Cache-Control headers to enable browser and CDN caching

Without Cache-Control headers every visit re-downloads every asset. Configure long-lived caching for hashed assets and stale-while-revalidate for HTML.

Read fix

Reduce too many redirects: cut chains to one hop

Redirect chains add 200-500ms per hop on mobile and waste crawl budget. Resolve canonical URLs in one redirect or none, and update internal links to point to final URLs.

Read fix

Fix redirect loop: break circular 301/302 chains

Redirect loops return ERR_TOO_MANY_REDIRECTS to users and confuse search crawlers. Trace the loop, identify the layer responsible, and break the cycle.

Read fix

Reduce redirect chain length: collapse multi-hop chains

Chains of 3+ redirects waste crawl budget, leak link equity, and add hundreds of ms per hop. Collapse them to a single 301 from start to final URL.

Read fix

Fix redirects that strip query parameters

Redirects that drop ?utm_ and other query strings break analytics, attribution, and deep linking. Configure rules to preserve query parameters across the hop.

Read fix

Fix missing www/non-www redirect to canonicalize the host

Without a redirect, both www.example.com and example.com serve content, splitting SEO signals and breaking absolute URLs. Pick a canonical host and 301 the other.

Read fix

Fix broken internal links draining crawl budget and perf

Broken internal links return 404s that waste crawl budget, frustrate users, and trigger spurious redirects. Audit the site, fix or remove every broken link.

Read fix

Fix timeouts on fetch: avoid hanging requests and slow APIs

Fetch requests without timeouts hang indefinitely on slow APIs, blocking renders and burning client connections. Set explicit timeouts and circuit-break failing services.

Read fix

Fix uptime flapping: stabilize intermittent monitoring failures

An uptime monitor that flips up/down every few minutes drowns alerts in noise. Identify the root cause — flaky checks, slow endpoints, infrastructure issues — and fix it.

Read fix