From F to C: The Full Security Check in 60 Minutes

Part 10 of the series "EU Web Security: 10 Steps to a Better Rating"

The Starting Point

52.5% of European websites score a D, 42.3% score an F. A typical EU organisation starts with a composite score around 40 — grade D or F.

Over the past 9 weeks, we have presented one concrete measure each week. Each one takes 5-15 minutes to implement. Together, they deliver the largest score improvement for the least effort.

The Checklist

Total effort: approximately 60-90 minutes. Potential score improvement: 30-50 points. From F to C, from D to B.

The Priority Order

Not all measures are equally urgent. Here is the prioritised order by impact per time invested:

Immediately (under 5 minutes)

1. Set the HSTS header — one line of Nginx/Apache config
2. X-Content-Type-Options: nosniff — one line
3. Referrer-Policy: strict-origin-when-cross-origin — one line
4. Create security.txt — one file with two fields

This Afternoon (15-30 minutes)

1. Enable DNSSEC — one click at the DNS provider
2. Set a CAA record — one DNS entry
3. Set up DKIM — generate key at the mail provider, add DNS record

This Week (30-60 minutes)

1. DMARC to quarantine/reject — requires a monitoring phase (read the reports)
2. Deploy CSP — requires a Report-Only phase (identify sources)
3. Check cookie compliance — test pre-consent state, configure CMP

Before / After

A typical EU organisation before and after implementation:

The biggest levers: Email (SPF to DMARC reject = +53 points) and Headers (HSTS+CSP+XCO = +50 points). DNS is the smallest individual lever, but critical as a foundation (DNSSEC protects everything else).

Automated Monitoring

A one-time improvement is not enough. CMS updates, new plugins, provider changes, expiring certificates — the score can drop again at any time.

SiteGuardian monitors your domains continuously across all six dimensions. When something changes — HSTS header disappears, DMARC policy modified, certificate about to expire — you receive an immediate notification.

Start with a free scan and see where your domain stands today.

The Series Overview

1. HSTS in 5 Minutes
2. DMARC: From "none" to "reject"
3. Content Security Policy Done Right
4. Enable DNSSEC
5. Set Up security.txt
6. DKIM: Email Integrity
7. X-Content-Type-Options and Referrer-Policy
8. CAA Records
9. Cookie Compliance
10. The Full Check (this article)

This series is based on the SiteGuardian EU Web Security Benchmark covering over 700,000 European websites. All data is continuously updated.

SiteGuardian is an EU-based compliance and monitoring tool for web security, developed in Germany.