Earn trust from visitors and browsers

Trust has two audiences

A visitor gives you trust in a few seconds, from how the page looks, who stands behind it and whether anything feels off. A browser or mail server gives or withholds it from technical facts: is the connection encrypted, can this message be proven to come from this domain.

They fail differently. A technical failure is loud and automatic: a "not secure" warning, a message in spam. A human failure is silent: the visitor just leaves.

Trust in Growth Score is the score for both. It reads your security headers, your email authentication records and the trust signals a visitor can see.

Fix the technical ones first because they are finite, then spend the rest of your effort on the human ones.

Step 1: https everywhere

A site on plain http gets a warning in every major browser. A page that loads even one script or image over http can lose its padlock.

The checklist:

• A valid certificate that does not expire silently. Turn on auto-renewal and put the renewal date in a calendar anyway.
• Every http address redirects to https with a permanent redirect.
• No mixed content: images, scripts and fonts all load over https.
• Your canonical tags and sitemap use the https address.

Then add HSTS, a header that tells a browser to use https for your domain from now on. Start with a short duration, confirm nothing breaks, then lengthen it.

Step 2: set the headers that protect your visitors

Response headers are instructions your server sends with every page. A few of them decide whether another site can frame your pages, whether a script can read your cookies and whether a browser may guess a file's type.

The four to set first:

• Strict-Transport-Security: https only.
• Content-Security-Policy: limits where scripts and other resources may load from. Powerful and easy to break, so start in report-only mode.
• X-Content-Type-Options: nosniff, so a browser does not reinterpret a file as something dangerous.
• Frame protection (frame-ancestors in a CSP, or X-Frame-Options): stops another site embedding your page to trick people into clicking.

Add Referrer-Policy to control what you tell other sites about where a visitor came from, and mark session cookies HttpOnly, Secure and SameSite.

The security headers check reads yours and names what is open. These changes rarely show up on screen. They are exactly what a cautious customer's security team looks for in a vendor.

Step 3: prove your email is yours

Anyone can type your domain into the From line of an email. Three DNS records are how receiving servers tell your mail from forgeries:

• SPF lists the servers allowed to send for your domain. Keep it to a single record and under ten DNS lookups, or it stops working.
• DKIM adds a signature to each message that a receiver checks against a public key in your DNS.
• DMARC tells receivers what to do when SPF and DKIM fail, and sends you reports. Start at p=none to watch, move to quarantine, then reject once the reports are clean.

This is not optional for volume senders. Gmail and Yahoo require SPF, DKIM and DMARC from anyone sending in bulk to their users, and they expect low spam complaint rates.

Check every service that sends as you: your newsletter tool, your billing system, your support desk. Each needs to be covered by SPF and sign with DKIM, or its mail looks forged. The email DNS check reads the three records and finds the ones that let anyone send as you or protect nothing at all.

Step 4: show who runs it

A visitor deciding whether to pay you looks for a person, not a logo. Make the human evidence easy to find:

• A real About page: names, faces, what the company does and why, and where it is based.
• A way to reach you that is more than a form: an email address, a company address, a phone number where it fits.
• Legal pages that exist and match what you do: terms, privacy policy, refund policy.
• Plain prices and renewal terms.

If you are a one-person business, say so. It is a strength when stated, and a red flag when hidden behind "we".

Step 5: show proof you hold

Results is any evidence a stranger can check. The best kinds, roughly in order:

1. 1Named customers with a specific result, said in their words and with their permission.
2. 2A case study with the starting point, what changed and what happened, including the parts that were hard.
3. 3Reviews on a third-party site you do not control, linked rather than copied.
4. 4Press or awards you can verify.

The rule is simple: if you would not be comfortable with a customer reading it aloud to you, do not publish it. Never invent a testimonial, a customer count or a badge. A fake claim costs far more than the empty space it fills.

If you have no proof yet, say what you can: how long you have run, what you guarantee, what a refund looks like. A clear guarantee is proof of confidence.

Step 6: be open about scripts

Visitors cannot see your third-party scripts, but they can feel what those scripts do. Ad pixels, session recorders, chat widgets and analytics each send data to someone else, and some fire before a visitor has agreed to anything.

List everything your page loads. For each, write down why it is there and who receives the data. Remove what you cannot justify. For what remains, make sure the ones that identify people wait for consent where the law requires it.

The tracker check names every third party a page loads and whether the ones that identify people wait for consent. Fewer trackers also means a faster page, which is a trust signal in itself. If you also tell visitors plainly what you collect, in a privacy page a human can read, you have already beaten most sites.

A one-hour trust audit

Work through this in order:

1. 1Load your home page and one checkout or sign-up page and look for any browser warning.
2. 2Run the security headers check and fix the highest item.
3. 3Send a test email from each service that sends as you and read the headers for SPF, DKIM and DMARC passes.
4. 4Open your About page as a stranger. Can you tell who runs this?
5. 5List every claim of proof on the site. Can you back each one with a source?
6. 6Run the tracker check on one page.

Write down what failed and who owns each fix. Growth Score reads your headers, email records and visible signals daily, and Monitor emails you when one flips. The free Growth Diagnosis shows where you stand today.