Security
The first security step on a public website is to check what any visitor can see from the outside: whether every request goes to HTTPS with a valid certificate, whether the security headers are present, whether any files are exposed, whether the CMS and plugins are up to date and which third-party scripts run on the page. The guides below explain each item, the HTTP headers and the PCI DSS 4.0 rules for checkout scripts.
Website security basics: HTTPS, headers and scripts
What to check first, from the outside, on a public website: HTTPS, TLS, certificate, headers, exposed files, versions, third-party scripts and cookies.
Go deeper
- Security
PCI DSS 4.0: requirements 6.4.3 and 11.6.1 for checkout scripts
What PCI DSS v4.0.1 asks of payment page scripts, who it applies to, what changed in SAQ A in 2025 and how to implement it with CSP, SRI and monitoring.
- Security
HTTP security headers: CSP, HSTS and the rest
Which HTTP security headers to set, with starting values, what each one breaks if you get it wrong and how to roll out CSP without taking the site down.
Frequently asked questions
- Does an external check find every security flaw?
- No. It sees configuration and exposure: HTTPS, the certificate, headers, reachable files and scripts. Flaws in the code, badly stored passwords and how well the admin panel holds up call for a code review and a penetration test.
- Which security headers should I set up first?
- The most common ones are HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy, plus stopping other sites from embedding the page. The article on headers gives starting values and what each one can break.
- Does robots.txt protect sensitive files?
- No. robots.txt only asks crawlers not to crawl a path, and anyone can read it. Files such as .env, .git and backups need to stay off the web server or have access blocked.
- Does PCI DSS 4.0 apply to my store?
- Requirements 6.4.3 and 11.6.1, on scripts and changes to the payment page, apply to stores that accept cards and depend on how payment is integrated. Merchants who redirect the customer to the payment provider or outsource payment entirely have different rules.
Other topics
Accessibility
If your company has its headquarters or a commercial representative in Brazil, its website must be accessible to people with disabilities: that is what article 63 of Brazil's Inclusion Law (Lei Brasileira de Inclusão, Law 13,146/2015) requires.
5 guidesPrivacy
Brazil's LGPD (Lei Geral de Proteção de Dados, Law No. 13,709/2018) never mentions cookies, but it applies to any cookie, pixel or script that collects personal data from site visitors.
3 guidesPerformance
Core Web Vitals are three Google metrics that measure the real experience of visitors: LCP measures loading, INP measures responsiveness to clicks and taps, and CLS measures visual stability.
6 guidesTechnical SEO
Google shows a page only after crawling it, processing the content and deciding to store it in the index.
5 guides
Partners
Partner benefits with one coupon.
WPLIGHT20% OFFGet the offer from WP Rocket (opens in a new tab)
25% OFFGet the offer from Perfmatters (opens in a new tab)
Partner links. We may earn a commission at no extra cost to you.