Always-secure instruction (HSTS)
Domain & Security
Technical
Your site does not tell browsers to always use the secure connection.
Why it matters: Without this instruction, a browser may still try the insecure address first, which leaves room for the connection to be tampered with.
How to fix it: Ask your developer or host to add the Strict-Transport-Security header once HTTPS works on every page.
Domain receives email
Domain & Security
Moderate
Your domain has no mail server set up, so email sent to an address at your domain will not arrive.
Why it matters: Customers who find your domain often guess an address like info@ at it; if nothing receives that mail, the enquiry is lost.
How to fix it: Set up email for your domain with a provider, or remove email addresses at this domain from your site and listings.