Most important first.
Always-secure instruction (HSTS)
Domain & Security
Technical
Your site does not tell browsers to always use the secure connection.
Why it matters: Without this instruction, a browser may still try the insecure address first, which leaves room for the connection to be tampered with.
How to fix it: Ask your developer or host to add the Strict-Transport-Security header once HTTPS works on every page.
Email sender record (SPF)
Domain & Security
Moderate
Your domain does not publish an SPF record, so mail servers cannot tell which senders are genuinely yours.
Why it matters: Without it, your own emails are more likely to land in spam, and others find it easier to send mail that claims to come from you.
How to fix it: Add an SPF record in your domain's DNS settings; your email provider publishes the exact line to use.
Contact form findable
AI Readiness
Quick
We found no contact form on your homepage.
Why it matters: A form lets a customer reach you at any hour without picking up the phone.
How to fix it: Add a simple contact form, or a clear link to one, on your homepage.