SPF
Declares which servers may send as you. Published, then validated against every real sending source — your mail host, your site, your accounting software.
v=spf1 include:_spf.mail.co ~all
Security & compliance
Boring, unglamorous, non-negotiable.
None of what follows will win a design award. All of it is the difference between a business asset and a liability. It is on every build we ship, including the entry plan, because a small business is not a small target — it is an easier one.
The threat, and the answer
What actually goes wrong.
| Risk | What it looks like in practice | What we do about it |
|---|---|---|
| Email spoofing | Anyone can send mail that looks like it came from you | SPF, DKIM and a DMARC policy taken all the way to enforcement |
| Login discovery | Bots find /wp-admin within hours of a domain going live | Login moved to a private URL, plus lockout after failed attempts |
| Credential reuse | One leaked password opens every site you own | Unique admin username and password per site, 2FA required |
| Malicious uploads | A contact form becomes a file drop for a web shell | Server-side type checks and malware screening before write |
| Silent breakage | A plugin update takes the site down on a Friday night | Staging copy, tested updates, daily restorable backups |
| Data exposure | Backup archives and staff pages get indexed by Google | noindex on internal pages, nothing sensitive in the web root |
| Transport | Forms posting over plain HTTP | HTTPS forced, HSTS, modern TLS, security headers |
| Regulatory | Personal data held without a lawful basis or notice | Privacy policy, consent, retention and a documented data map |
Email authentication
Three DNS records almost nobody sets.
Without them your quotes land in spam, and anyone in the world can send an invoice that appears to come from your domain. We publish and verify all three, then walk DMARC from monitoring to enforcement so nothing legitimate breaks on the way.
DKIM
Cryptographically signs every message so a receiving server can prove it was not altered and did come from you. Keys generated per sending source.
selector._domainkey v=DKIM1; k=rsa; p=MIIBIj…
DMARC
Tells the world what to do with mail that fails. We start at p=none and read the reports for two weeks, then move to quarantine and reject.
_dmarc v=DMARC1; p=none; rua=mailto:dmarc@yourdomain
Why the slow path matters. Publishing p=reject on day one is how businesses silently lose a fortnight of invoices. We monitor first, fix what the reports expose, and only then enforce.
Everything else on the checklist
The full runbook.
Live in 12 months for one price
- Your domain name, registered and paid for the first 12 months
- 12 months of managed, SSD-backed hosting with a free SSL certificate
- Five mailboxes on your own domain, with webmail and phone setup
- Daily off-site backups, kept 30 days, restorable in minutes
- Staging copy of your site so changes are proved before they go live
Email that actually arrives
- SPF record published and validated
- DKIM signing keys generated and verified for every sending source
- DMARC policy rolled out on the safe path: p=none, monitored, then enforced
- Reverse DNS and sender reputation checked before launch
- Deliverability test to Gmail, Outlook and Yahoo, with the report sent to you
Locked down from day one
- Login page moved off /wp-admin and /wp-login.php to a private address
- Two-factor authentication on every administrator account
- A unique admin username per site — never "admin", never shared across sites
- Brute-force lockout, firewall rules and disabled file editing in the dashboard
- Uploads screened for malware before they are ever written to disk
- HTTPS forced, HSTS on, security headers set, directory listing off
- Staff and portal pages set to noindex so they never reach a search result
- No stray .bak or .zip files left in the web root — ever
Found on Google
- Google Search Console verified, sitemap submitted, indexing confirmed page by page
- Schema.org structured data for your business, services, reviews and opening hours
- Google Business Profile created or claimed, with categories, hours and photos
- Titles, descriptions and heading structure written for your actual search terms
- Core Web Vitals measured and passed on mobile before launch
- Local landing pages for each town or suburb you serve
Social, connected
- Facebook Page and Instagram Business account linked and verified
- Auto-posting: a new page, offer or article posts itself to your channels
- LinkedIn, TikTok and WhatsApp Business click-to-chat wired into the site
- Open Graph and Twitter card images so shared links look deliberate
- Review capture: a one-tap path from happy customer to public Google review
- A monthly content calendar you can actually keep to
Usable by everyone
- WCAG 2.2 AA contrast, focus states and keyboard navigation, tested not assumed
- A published accessibility statement with a real route to report a problem
- Skip-to-content link, semantic headings, labelled forms and alt text throughout
- Light and dark mode, both audited for contrast independently
- Text scales to 200% without the layout breaking
- Respects reduced-motion for visitors who need it
Yours, legally and practically
- Privacy policy and terms of service written for your jurisdiction
- Cookie consent that defaults to the private option
- You own the domain, the hosting account, the code and the content
- Full export on request, no lock-in, no ransom
- A written handover document so any developer can pick it up
Your jurisdiction
UK GDPR
Every site we build in the United Kingdom ships with a privacy policy and terms written for UK GDPR and the Data Protection Act 2018, cookie consent that defaults to the private option, and a documented map of what personal data the site collects, why, and how long it is kept.
- Privacy policy and terms of service, written for your jurisdiction and your actual data flows
- Cookie consent that defaults to declining non-essential cookies
- A named route for a person to request, correct or delete their data
- Retention periods documented rather than "we keep it forever"
- Data kept in-country: UK hosting on 20i
- Accessibility statement published, with a real address for reporting a barrier
Want your current site checked?
Send us the domain. We will tell you, free, whether your SPF, DKIM and DMARC are right, whether your login is exposed, and whether Google can actually see your pages.