harrisonndeke.co.ke

Most of your visitors are on a phone. A number they can tap turns interest into a call in one action; a number they have to select, copy and paste loses a large share of them at exactly the moment they were ready to talk. In this market, a WhatsApp link often converts better than a form.

Add a tappable phone number and a WhatsApp click-to-chat link in the header, visible without scrolling.

A policy of "none" means you are watching for forged email but instructing receiving servers to deliver it anyway. Someone impersonating your domain today would still reach the inboxes of your customers. Monitoring is the correct first step, but stopping there leaves the door open.

Review your DMARC aggregate reports to confirm every legitimate sender passes, then move the policy to "p=quarantine" and then "p=reject".

An attacker can load your site invisibly inside their own page and trick your visitors into clicking your buttons — submitting a form or authorising an action they cannot see. It is also used to host convincing copies of login pages.

Add X-Frame-Options: SAMEORIGIN, or a frame-ancestors directive in your Content Security Policy.

A Content Security Policy tells the browser which scripts it is allowed to run. Without one, if an attacker manages to inject code into a page — through a comment field, a compromised plugin, or a third-party script that gets hijacked — the browser executes it without question. This is the mechanism behind most card-skimming attacks on small e-commerce sites.

Add a Content-Security-Policy header listing the domains permitted to serve scripts, styles and frames. Roll it out in report-only mode first so you can see what would break before enforcing it.

The browser stops building the page and waits for each of these to download and run before showing anything. Each one adds directly to how long a visitor stares at a blank screen.

Add defer (or async, where order does not matter) to these tags, or move them to the end of the document.

Organization or LocalBusiness markup is what links your website to a real business entity that search engines and AI assistants can recognise, remember and cite by name. Without it you may have rich results on individual pages while the business itself remains anonymous to the machines.

Add Organization schema sitewide with your legal name, logo, contact details and social profiles, and LocalBusiness schema if you serve customers from a physical location.

Three separate costs here. It signals a smaller operation than you may be, on every quote you send. You cannot apply company security controls, enforce recovery, or retain access if the person holding that account leaves. And customer data sitting in a personal mailbox is difficult to defend as compliant handling under the Data Protection Act.

Move to email on your own domain with enforced two-factor authentication, then configure SPF, DKIM and DMARC so your mail is authenticated and cannot be forged.

DMARC reporting is how you find out that someone is trying to send email as your company, and which of your own tools are misconfigured. Without a reporting address, that intelligence is discarded.

Add an "rua=mailto:" address to the DMARC record and review the aggregate reports.

Standard SMTP encryption (STARTTLS) is opportunistic, meaning an active attacker on the network can strip the encryption handshake and read incoming emails in plaintext. MTA-STS (RFC 8461) forces sending mail servers to use TLS 1.2+ encryption, closing the man-in-the-middle downgrade loophole.

Publish an MTA-STS DNS record at _mta-sts and host the standard policy text at https://mta-sts.<domain>/.well-known/mta-sts.txt.

A CAA (Certificate Authority Authorization) DNS record explicitly specifies which Certificate Authorities (like Let's Encrypt, DigiCert, or Google Trust Services) are allowed to issue certificates for your domain. Without it, if any CA anywhere in the world is compromised or misconfigured, it could issue an unauthorized certificate for your domain without your knowledge.

Publish a CAA DNS record for harrisonndeke.co.ke naming your approved certificate provider(s) (e.g. '0 issue "letsencrypt.org"').

The end of your description, often where the call to action sits, never appears.

Trim to under 160 characters with the most persuasive point first.

AI assistants answer questions. Publishing your common customer questions in a structured, machine-readable format is the most direct way to become the source an assistant quotes when someone asks that exact question about your category.

Publish a genuine FAQ covering the questions your sales team answers every week, marked up with FAQPage schema.

TLS-RPT (RFC 8460) works alongside MTA-STS to send you daily diagnostic reports on inbound email delivery failures and TLS decryption attempts.

Publish a TXT record at _smtp._tls.harrisonndeke.co.ke with "v=TLSRPTv1; rua=mailto:tls-reports@harrisonndeke.co.ke".

When someone discovers a vulnerability in your site, security.txt tells them where to report it. Without one, findings tend to go unreported or get posted publicly instead of coming to you first.

Publish a short /.well-known/security.txt listing a contact address and a preferred language.