// proof, not promises

Failing to #1, in under 30 minutes of effort.

We don't publish a fix we haven't run ourselves. We pointed our own scanner at our own site,dev3lop.com, and it came back failing, grade E, 54/100. Then we worked the checklist below. 24 minutes of hands-on changes later it was a perfect100/100, #1 of 569, the single cleanest site in the fleet.

BeforeE
Grade
E
Posture score
54 / 100
Fleet rank
mid-pack
Open findings
6

spoofable email · exposed headers · failing

→
24 min
hands-on
effort
AfterA
Grade
A
Posture score
100 / 100
Fleet rank
#1 of 569
Open findings
0

locked down · zero findings · cleanest in the fleet

Posture climb vs. effort

Every minute of hands-on work, plotted against the security score it bought. Eight real re-scans confirmed each gain, failing (E) to a perfect A in 24 working minutes.

ABCDE0m6m12m18m24mE · 54A · 100 · #1
X = cumulative hands-on minutes · Y = posture score (0–100). Wall-clock spanned a day with breaks; this is active effort.

The exact playbook

Seven fixes, in order. Each row is a real step we took, the hands-on time, the points it recovered, and the running score it produced. Click any step for the copy-paste guide.

  1. 1
    highEmail authentication2 min hands-on+10 posture
    SPF: stop attackers sending email as your domain
    64D
  2. 2
    mediumEmail authentication5 min hands-onenables enforcement
    DKIM: cryptographically sign every email you send
    64D
  3. 3
    highEmail authentication3 min hands-on+20 posture
    DMARC: enforce SPF + DKIM and lock spoofing out
    84B
  4. 4
    lowHeaders / XSS1 min hands-on+4 posture
    X-XSS-Protection: turn the legacy header OFF
    88B
  5. 5
    mediumHeaders / XSS8 min hands-on+10 posture
    CSP: remove 'unsafe-inline' from scripts and kill XSS blast radius
    98A
  6. 6
    infoTLS / PKI3 min hands-on+1 posture
    CAA: control which CAs can issue certificates for you
    99A
  7. 7
    infoDisclosure2 min hands-on+1 posture
    security.txt: give researchers a way to reach you
    100A
  8. ★
    Done, 100/100, grade A, #1 of 569.
    24 minutes of hands-on effort, zero open findings. The cleanest site in the fleet.
Run the same playbook on your site.

Every step above links to the exact, copy-paste fix, free. Most are a single DNS record or header.

Open the checklist →