Wix: readiness playbook

Readiness by lane

The Wix playbook

Gaps ordered by impact, with the platform-specific step where one exists.

1. DMARC policy enforces quarantine or reject

   17% observed · all sites 31%

   Publish DMARC with p=none and a reporting address first, fix any legitimate senders that fail SPF or DKIM alignment, then move to quarantine and finally reject.

   Guide: A Practical Website Health Check for Owners

2. No render-blocking scripts in <head>

   4.2% observed · all sites 44%

   Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.

   Guide: Control Third-Party Scripts Before They Control Your Page

3. security.txt published

   0% observed · all sites 5.5%

   Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.

   Guide: A Practical Website Health Check for Owners

4. Content Security Policy present

   1% observed · all sites 31%

   Start with Content-Security-Policy-Report-Only to see what would break, tighten the policy over a few weeks, then enforce it.

   Guide: Payment Security and PCI DSS: What Website Owners Need to Know

5. CAA records limit who can issue certificates

   1.7% observed · all sites 11%

   Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.

   Guide: HTTPS and TLS Guide for Website Owners

6. Framing restricted

   2.1% observed · all sites 49%

   Send Content-Security-Policy: frame-ancestors 'self' (or a list of trusted origins). X-Frame-Options: SAMEORIGIN covers older browsers.

   Guide: A Practical Website Health Check for Owners

7. Modern image formats in use

   39% observed · all sites 40%

   Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.

   Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format

8. Static files cached for 30 days or more

   47% observed · all sites 50%

   Give versioned (fingerprinted) CSS, JavaScript, fonts and images Cache-Control: public, max-age=31536000, immutable, and change the file name whenever the content changes.

   Guide: Browser Caching Guide for Website Owners

Where Wix sites lead

• HSTS kept for at least a year96% observedall sites 31%
• HTTP/3 advertised96% observedall sites 36%
• X-Content-Type-Options: nosniff96% observedall sites 48%
• Structured data present97% observedall sites 53%

A note on hosted platforms

On Wix, the platform controls much of the TLS, header and caching configuration. Owners mostly influence content-level checks such as images, structured data, social previews and the sitemap. Header-level gaps are worth raising with the platform.

All 31 checks on Wix

High-readiness Wix sites

• ascuolaoggi.com74

Related