freightforwarders.co.ke

DMARC is what actually instructs receiving mail servers to reject forged email claiming to be from your domain, and it is what sends you reports when someone tries. Without it, an attacker can email your customers or your own finance team as you — the classic version being a genuine-looking invoice with the bank details swapped. You also get no visibility that it is happening.

Publish a DMARC record at _dmarc.freightforwarders.co.ke starting at "p=none" with a reporting address so you can see who is sending as you, then tighten to "p=quarantine" and finally "p=reject" once legitimate senders are aligned. This is a staged rollout over a few weeks, not a switch to flip.

Most of your visitors are on a phone. A number they can tap turns interest into a call in one action; a number they have to select, copy and paste loses a large share of them at exactly the moment they were ready to talk. In this market, a WhatsApp link often converts better than a form.

Add a tappable phone number and a WhatsApp click-to-chat link in the header, visible without scrolling.

These tools set identifiers and send visitor behaviour to third parties from the first moment of the visit. Kenya's Data Protection Act requires consent for this, and GDPR requires it before the tracker loads, not after. Enforcement in this area has been rising, and the fines are calculated against turnover.

Add a consent mechanism that genuinely blocks these scripts until the visitor agrees, rather than a banner that only informs. The distinction matters legally — a notice that tracking has already started is not consent.

HSTS tells browsers to only ever contact your site over an encrypted connection. Without it, a visitor on public Wi-Fi can be silently redirected to an unencrypted copy of your site before the redirect to HTTPS happens, and anything they type there is readable.

Add a Strict-Transport-Security header with a max-age of at least one year, after confirming every subdomain you use supports HTTPS.

The main heading tells both search engines and screen readers what the page is about. Its absence weakens your ranking for your core terms and makes the page harder to navigate for anyone using assistive technology.

Add exactly one <h1> per page stating the primary offer in plain language.

Visitors arriving on mobile often bounce within 5 seconds if they have to hunt through menus to find how to call or message you. Putting a one-tap contact route directly on the homepage stops that drop-off.

Add a visible call-to-action button, click-to-call phone number, or WhatsApp link directly in the homepage header and hero section.

A Content Security Policy tells the browser which scripts it is allowed to run. Without one, if an attacker manages to inject code into a page — through a comment field, a compromised plugin, or a third-party script that gets hijacked — the browser executes it without question. This is the mechanism behind most card-skimming attacks on small e-commerce sites.

Add a Content-Security-Policy header listing the domains permitted to serve scripts, styles and frames. Roll it out in report-only mode first so you can see what would break before enforcing it.

Attackers scan the internet for specific software versions with known vulnerabilities. Publishing yours means an automated tool can match your site to a working exploit without doing any work first.

Suppress or genericise these headers in the web server or CDN configuration.

The page you link to can quietly replace the tab your visitor came from with a copy of your site — a convincing way to harvest logins. It also slows down the browser.

Add rel="noopener noreferrer" to every link using target="_blank".

The browser stops building the page and waits for each of these to download and run before showing anything. Each one adds directly to how long a visitor stares at a blank screen.

Add defer (or async, where order does not matter) to these tags, or move them to the end of the document.

llms.txt is an emerging convention: a plain-text file giving AI assistants a clean, authoritative summary of what your business does and which pages matter, instead of leaving them to infer it from navigation menus and marketing copy. Adoption is early, which is exactly why publishing one now is cheap and puts you ahead of competitors who will get to it in a year.

Publish a short /llms.txt describing the business, the services, the service area and links to the pages you most want cited.

Organization or LocalBusiness markup is what links your website to a real business entity that search engines and AI assistants can recognise, remember and cite by name. Without it you may have rich results on individual pages while the business itself remains anonymous to the machines.

Add Organization schema sitewide with your legal name, logo, contact details and social profiles, and LocalBusiness schema if you serve customers from a physical location.

Standard SMTP encryption (STARTTLS) is opportunistic, meaning an active attacker on the network can strip the encryption handshake and read incoming emails in plaintext. MTA-STS (RFC 8461) forces sending mail servers to use TLS 1.2+ encryption, closing the man-in-the-middle downgrade loophole.

Publish an MTA-STS DNS record at _mta-sts and host the standard policy text at https://mta-sts.<domain>/.well-known/mta-sts.txt.

A CAA (Certificate Authority Authorization) DNS record explicitly specifies which Certificate Authorities (like Let's Encrypt, DigiCert, or Google Trust Services) are allowed to issue certificates for your domain. Without it, if any CA anywhere in the world is compromised or misconfigured, it could issue an unauthorized certificate for your domain without your knowledge.

Publish a CAA DNS record for freightforwarders.co.ke naming your approved certificate provider(s) (e.g. '0 issue "letsencrypt.org"').

Without a referrer policy, the full address of the page a visitor came from — which may contain private identifiers or search terms — is passed to every external site they click through to.

Add Referrer-Policy: strict-origin-when-cross-origin.

Visitors download images far below the fold that most of them will never see. On mobile data this is bandwidth they pay for, spent slowing down the part of the page they actually wanted.

Add loading="lazy" to images below the fold — keeping it off the main hero image, which should load immediately.

When someone shares your link on WhatsApp, LinkedIn or Facebook, these tags decide whether it appears as a rich preview with an image and headline, or as a bare grey URL. In a market where WhatsApp is the main sharing channel, this directly affects how many people click a link a customer forwards.

Add og:title, og:description and og:image (1200x630px) to every page, plus the Twitter card equivalents.

AI assistants answer questions. Publishing your common customer questions in a structured, machine-readable format is the most direct way to become the source an assistant quotes when someone asks that exact question about your category.

Publish a genuine FAQ covering the questions your sales team answers every week, marked up with FAQPage schema.

TLS-RPT (RFC 8460) works alongside MTA-STS to send you daily diagnostic reports on inbound email delivery failures and TLS decryption attempts.

Publish a TXT record at _smtp._tls.freightforwarders.co.ke with "v=TLSRPTv1; rua=mailto:tls-reports@freightforwarders.co.ke".

When someone discovers a vulnerability in your site, security.txt tells them where to report it. Without one, findings tend to go unreported or get posted publicly instead of coming to you first.

Publish a short /.well-known/security.txt listing a contact address and a preferred language.