Fixed-price fix

Missing security headers

All six browser security headers set and sound, leaking ones removed, an A on the free site check.

What "fixed" means

Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are sent on every page with sound values. Headers that reveal software versions are removed, obsolete ones are dropped, and session cookies carry the Secure and HttpOnly flags. Our free site check grades the site an A. The site, its admin, its forms and anything that embeds it work as before. A copy of the configuration from before the change is kept. A strict script policy for an A+ is quoted separately, since it has to list every script the site loads.

Access we will need

• Server access (SSH or SFTP)
• WordPress admin

Helpful if your host offers it, but we start without it: Hosting panel collaborator, Cloudflare API token.

You grant it after the hold is placed, with step-by-step instructions for your host. The people who sign in are our own US-based team, bound by our confidentiality, never a contractor or a marketplace, and every sign-in is logged on your job page. We remove our own access when the job closes.

WordPress admin is granted through our FixGuru Access plugin, a temporary administrator that deletes itself, with a backup first and a change log on your site. If you would rather not install a plugin, you can share a temporary login in the encrypted vault instead.

How paying works

1. Held. Your card is authorized for $99. Nothing is charged.
2. Fixed. We start within 2 hours of access during service hours and finish within 24 hours.
3. Approved. You review the report and approve. Only then is the card charged. If it isn't fixed, the hold is released and you pay $0.

Same problem back within 14 days? We fix it again at no charge.