www.onehealth.co.ke

Every visitor who arrives ready to spend money has to leave and find another way to contact you — which in practice means most of them contact a competitor instead. This is the most expensive single problem a website can have.

Add a short enquiry form and a tappable phone or WhatsApp link, both reachable without scrolling.

Anything submitted on an unencrypted page — a contact form, a login, a phone number — can be read by anyone on the same network. Browsers also mark these pages as "Not secure" in the address bar.

Add a permanent (301) redirect from HTTP to HTTPS at the server or CDN level so the unencrypted version is never served.

Most of your visitors are on a phone. A number they can tap turns interest into a call in one action; a number they have to select, copy and paste loses a large share of them at exactly the moment they were ready to talk. In this market, a WhatsApp link often converts better than a form.

Add a tappable phone number and a WhatsApp click-to-chat link in the header, visible without scrolling.

HSTS tells browsers to only ever contact your site over an encrypted connection. Without it, a visitor on public Wi-Fi can be silently redirected to an unencrypted copy of your site before the redirect to HTTPS happens, and anything they type there is readable.

Add a Strict-Transport-Security header with a max-age of at least one year, after confirming every subdomain you use supports HTTPS.

An attacker can load your site invisibly inside their own page and trick your visitors into clicking your buttons — submitting a form or authorising an action they cannot see. It is also used to host convincing copies of login pages.

Add X-Frame-Options: SAMEORIGIN, or a frame-ancestors directive in your Content Security Policy.

The meta description is the two-line summary under your link in search results. Without one, Google scrapes whatever text it finds first, which is often a menu or a cookie notice. That is your sales pitch, written by an algorithm.

Write a 150-160 character description for each important page that states the offer and gives a reason to click.

Most sites are reachable at several addresses — with and without www, with and without a trailing slash, http and https. Without a canonical tag telling Google which is the real one, your ranking strength is split between duplicates instead of concentrated on one page.

Add a canonical link tag to every page pointing at its single preferred address.

A sitemap is the list of pages you want indexed. Without one, search engines only find pages they can reach by following links, so anything buried deep in the site — often exactly the product or service pages you want ranking — may never be crawled.

Generate an XML sitemap, reference it from robots.txt, and submit it in Google Search Console. Most platforms can generate it automatically.

A Content Security Policy tells the browser which scripts it is allowed to run. Without one, if an attacker manages to inject code into a page — through a comment field, a compromised plugin, or a third-party script that gets hijacked — the browser executes it without question. This is the mechanism behind most card-skimming attacks on small e-commerce sites.

Add a Content-Security-Policy header listing the domains permitted to serve scripts, styles and frames. Roll it out in report-only mode first so you can see what would break before enforcing it.

Search engines and AI assistants can only cite what they can read. A page built mostly from images, sliders or text baked into graphics gives them almost nothing to index, so it will not rank for the terms your customers search and will not be quoted in an AI answer.

Add real, specific text covering what you sell, who you serve, where you operate and what makes you the right choice. Text inside images should be moved into actual page copy.

Without this header, browsers may guess the type of a file rather than trusting what the server declares. An uploaded image that actually contains script can then be executed as script.

Add the header X-Content-Type-Options: nosniff. It is a one-line server configuration change.

Structured data is the machine-readable summary of who you are, what you sell, where you are and when you are open. Google uses it for rich results, and ChatGPT, Perplexity and Google AI Overviews lean on it heavily when deciding which business to name in an answer. Without it, an AI assistant asked to recommend a supplier in your category has to guess from your prose — and it will more often name a competitor whose details it can read cleanly.

Add Organization and LocalBusiness schema with your name, address, phone, hours and service area, plus Product or Service schema on the relevant pages and FAQPage schema on any question-and-answer content.

llms.txt is an emerging convention: a plain-text file giving AI assistants a clean, authoritative summary of what your business does and which pages matter, instead of leaving them to infer it from navigation menus and marketing copy. Adoption is early, which is exactly why publishing one now is cheap and puts you ahead of competitors who will get to it in a year.

Publish a short /llms.txt describing the business, the services, the service area and links to the pages you most want cited.

When Google triggers an AI Overview at the top of the search page, traditional organic clicks drop by up to 35% unless your site is explicitly cited inside the AI synthesis. Being cited in the AI answer preserves top-of-funnel lead flow.

Add authoritative schema markup, explicit definitions, and structured answer blocks directly below H2 headers on your target pages so Google Gemini and AI Overviews source their summary directly from you.

A verified Knowledge Panel confirms brand legitimacy, displays verified contact routes directly in search results, and trains Google's entity database to associate your domain with your industry.

Claim and verify your Google Business Profile and publish sameAs entity links (LinkedIn, X, crunchbase) inside your sitewide Organization schema.

A first-time visitor has no way to judge whether you deliver. Social proof is consistently among the highest-impact additions to a page, because it answers the question every buyer is actually asking: has this worked for someone like me?

Add three genuine customer testimonials with names and, where possible, photographs, plus client logos and one short case study with a real number in it.

DMARC reporting is how you find out that someone is trying to send email as your company, and which of your own tools are misconfigured. Without a reporting address, that intelligence is discarded.

Add an "rua=mailto:" address to the DMARC record and review the aggregate reports.

Standard SMTP encryption (STARTTLS) is opportunistic, meaning an active attacker on the network can strip the encryption handshake and read incoming emails in plaintext. MTA-STS (RFC 8461) forces sending mail servers to use TLS 1.2+ encryption, closing the man-in-the-middle downgrade loophole.

Publish an MTA-STS DNS record at _mta-sts and host the standard policy text at https://mta-sts.<domain>/.well-known/mta-sts.txt.

A CAA (Certificate Authority Authorization) DNS record explicitly specifies which Certificate Authorities (like Let's Encrypt, DigiCert, or Google Trust Services) are allowed to issue certificates for your domain. Without it, if any CA anywhere in the world is compromised or misconfigured, it could issue an unauthorized certificate for your domain without your knowledge.

Publish a CAA DNS record for onehealth.co.ke naming your approved certificate provider(s) (e.g. '0 issue "letsencrypt.org"').

Without a referrer policy, the full address of the page a visitor came from — which may contain private identifiers or search terms — is passed to every external site they click through to.

Add Referrer-Policy: strict-origin-when-cross-origin.

A title that is just your company name tells a searcher nothing about what you sell. You have around 60 characters of prime advertising space and are using a fraction of it.

Expand to describe the service and location, for example "Company Name — Solar Installation in Nairobi".

robots.txt is where you tell search engines what to crawl and where your sitemap lives. Its absence is not fatal, but it means you are giving crawlers no guidance at all.

Add a robots.txt that allows crawling and points to your sitemap.

When someone shares your link on WhatsApp, LinkedIn or Facebook, these tags decide whether it appears as a rich preview with an image and headline, or as a bare grey URL. In a market where WhatsApp is the main sharing channel, this directly affects how many people click a link a customer forwards.

Add og:title, og:description and og:image (1200x630px) to every page, plus the Twitter card equivalents.

Buyers checking whether a supplier is real look for a location first. It also matters for local search — Google needs a consistent address to rank you for searches that include a place name.

Add your physical address to the footer, matching your Google Business Profile exactly, and include it in LocalBusiness structured data.

Caching lets repeat visitors and the CDN reuse work already done. Without it your server does the full job for every single request, which costs you both speed and hosting capacity on your busiest days.

Set appropriate Cache-Control headers — long-lived for assets with versioned filenames, short with revalidation for HTML.

Organic search traffic is high-intent compounding revenue. Knowing which keywords drive inbound interest allows you to protect your highest-converting search positions against aggressive competitors.

Strengthen internal linking to your top-ranking pages and publish dedicated landing pages for second-page keywords (positions 11-20) to push them into the top 3.

TLS-RPT (RFC 8460) works alongside MTA-STS to send you daily diagnostic reports on inbound email delivery failures and TLS decryption attempts.

Publish a TXT record at _smtp._tls.onehealth.co.ke with "v=TLSRPTv1; rua=mailto:tls-reports@onehealth.co.ke".

When someone discovers a vulnerability in your site, security.txt tells them where to report it. Without one, findings tend to go unreported or get posted publicly instead of coming to you first.

Publish a short /.well-known/security.txt listing a contact address and a preferred language.