WordPress on Vercel: readiness playbook

Readiness by lane

The WordPress on Vercel playbook

Gaps ordered by impact, with the platform-specific step where one exists.

1. security.txt published

   2% observed · all sites 5.5%

   Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.

   Guide: A Practical Website Health Check for Owners

2. Modern image formats in use

   43% observed · all sites 40%

   Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.

   On WordPress: WordPress has supported WebP uploads since 5.8 and AVIF since 6.5; image plugins or the host can convert existing images.

   On Vercel: Vercel Image Optimization serves modern formats.

   Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format

3. HTTP/3 advertised

   17% observed · all sites 36%

   Turn on HTTP/3 at your CDN. Browsers fall back to HTTP/2 automatically, so the risk is low.

   Guide: CDN Guide for Website Owners

4. DMARC policy enforces quarantine or reject

   52% observed · all sites 31%

   Publish DMARC with p=none and a reporting address first, fix any legitimate senders that fail SPF or DKIM alignment, then move to quarantine and finally reject.

   Guide: A Practical Website Health Check for Owners

5. Content Security Policy present

   29% observed · all sites 31%

   Start with Content-Security-Policy-Report-Only to see what would break, tighten the policy over a few weeks, then enforce it.

   Guide: Payment Security and PCI DSS: What Website Owners Need to Know

6. No render-blocking scripts in <head>

   44% observed · all sites 44%

   Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.

   On WordPress: Since WordPress 6.3, scripts can be registered with a defer or async loading strategy.

   Guide: Control Third-Party Scripts Before They Control Your Page

7. DNSSEC signed

   9.6% observed · all sites 8.1%

   Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.

   Guide: Website Uptime Readiness: Prepare Before Traffic Arrives

8. Framing restricted

   40% observed · all sites 49%

   Send Content-Security-Policy: frame-ancestors 'self' (or a list of trusted origins). X-Frame-Options: SAMEORIGIN covers older browsers.

   Guide: A Practical Website Health Check for Owners

Where WordPress on Vercel sites lead

• HSTS kept for at least a year96% observedall sites 31%
• Static files cached for 30 days or more94% observedall sites 50%
• CAA records limit who can issue certificates50% observedall sites 11%
• Offscreen images lazy-loaded86% observedall sites 61%

All 31 checks on WordPress on Vercel

Related