www.siggol.com

DMARC is what actually instructs receiving mail servers to reject forged email claiming to be from your domain, and it is what sends you reports when someone tries. Without it, an attacker can email your customers or your own finance team as you — the classic version being a genuine-looking invoice with the bank details swapped. You also get no visibility that it is happening.

Publish a DMARC record at _dmarc.siggol.com starting at "p=none" with a reporting address so you can see who is sending as you, then tighten to "p=quarantine" and finally "p=reject" once legitimate senders are aligned. This is a staged rollout over a few weeks, not a switch to flip.

Without a viewport tag, mobile browsers render the page at desktop width and shrink it, leaving text unreadable until the visitor pinches to zoom. Google indexes the mobile version of your site first, so this suppresses your ranking everywhere — and the majority of Kenyan web traffic is mobile.

Add <meta name="viewport" content="width=device-width, initial-scale=1"> and confirm the layout responds to narrow screens.

Kenya's Data Protection Act 2019 requires that you tell people what data you collect, why, how long you keep it and who you share it with — before you collect it. The same applies under GDPR for any European visitors. Beyond the legal exposure, the absence of a policy is a visible trust problem for anyone deciding whether to hand over their details.

Publish a privacy policy covering the personal data you actually collect, your lawful basis, retention periods, third parties you share with, and how someone exercises their rights. Link it from the footer and from every form.

These tools set identifiers and send visitor behaviour to third parties from the first moment of the visit. Kenya's Data Protection Act requires consent for this, and GDPR requires it before the tracker loads, not after. Enforcement in this area has been rising, and the fines are calculated against turnover.

Add a consent mechanism that genuinely blocks these scripts until the visitor agrees, rather than a banner that only informs. The distinction matters legally — a notice that tracking has already started is not consent.

The browser cannot reserve space for an image it has not measured, so content shifts down the moment each image arrives. Visitors tap the wrong thing, and Google penalises this directly through the Cumulative Layout Shift metric.

Add explicit width and height attributes (or a CSS aspect-ratio) to every image. The browser then reserves the correct space before the image loads.

The main heading tells both search engines and screen readers what the page is about. Its absence weakens your ranking for your core terms and makes the page harder to navigate for anyone using assistive technology.

Add exactly one <h1> per page stating the primary offer in plain language.

Most sites are reachable at several addresses — with and without www, with and without a trailing slash, http and https. Without a canonical tag telling Google which is the real one, your ranking strength is split between duplicates instead of concentrated on one page.

Add a canonical link tag to every page pointing at its single preferred address.

A Content Security Policy tells the browser which scripts it is allowed to run. Without one, if an attacker manages to inject code into a page — through a comment field, a compromised plugin, or a third-party script that gets hijacked — the browser executes it without question. This is the mechanism behind most card-skimming attacks on small e-commerce sites.

Add a Content-Security-Policy header listing the domains permitted to serve scripts, styles and frames. Roll it out in report-only mode first so you can see what would break before enforcing it.

The page you link to can quietly replace the tab your visitor came from with a copy of your site — a convincing way to harvest logins. It also slows down the browser.

Add rel="noopener noreferrer" to every link using target="_blank".

Google truncates titles at roughly 60 characters. Anything past that is replaced with an ellipsis, so the end of your message never reaches the searcher.

Shorten to under 60 characters, front-loading the words people actually search for.

Structured data is the machine-readable summary of who you are, what you sell, where you are and when you are open. Google uses it for rich results, and ChatGPT, Perplexity and Google AI Overviews lean on it heavily when deciding which business to name in an answer. Without it, an AI assistant asked to recommend a supplier in your category has to guess from your prose — and it will more often name a competitor whose details it can read cleanly.

Add Organization and LocalBusiness schema with your name, address, phone, hours and service area, plus Product or Service schema on the relevant pages and FAQPage schema on any question-and-answer content.

llms.txt is an emerging convention: a plain-text file giving AI assistants a clean, authoritative summary of what your business does and which pages matter, instead of leaving them to infer it from navigation menus and marketing copy. Adoption is early, which is exactly why publishing one now is cheap and puts you ahead of competitors who will get to it in a year.

Publish a short /llms.txt describing the business, the services, the service area and links to the pages you most want cited.

When Google triggers an AI Overview at the top of the search page, traditional organic clicks drop by up to 35% unless your site is explicitly cited inside the AI synthesis. Being cited in the AI answer preserves top-of-funnel lead flow.

Add authoritative schema markup, explicit definitions, and structured answer blocks directly below H2 headers on your target pages so Google Gemini and AI Overviews source their summary directly from you.

Standard SMTP encryption (STARTTLS) is opportunistic, meaning an active attacker on the network can strip the encryption handshake and read incoming emails in plaintext. MTA-STS (RFC 8461) forces sending mail servers to use TLS 1.2+ encryption, closing the man-in-the-middle downgrade loophole.

Publish an MTA-STS DNS record at _mta-sts and host the standard policy text at https://mta-sts.<domain>/.well-known/mta-sts.txt.

A CAA (Certificate Authority Authorization) DNS record explicitly specifies which Certificate Authorities (like Let's Encrypt, DigiCert, or Google Trust Services) are allowed to issue certificates for your domain. Without it, if any CA anywhere in the world is compromised or misconfigured, it could issue an unauthorized certificate for your domain without your knowledge.

Publish a CAA DNS record for siggol.com naming your approved certificate provider(s) (e.g. '0 issue "letsencrypt.org"').

robots.txt is where you tell search engines what to crawl and where your sitemap lives. Its absence is not fatal, but it means you are giving crawlers no guidance at all.

Add a robots.txt that allows crawling and points to your sitemap.

When someone shares your link on WhatsApp, LinkedIn or Facebook, these tags decide whether it appears as a rich preview with an image and headline, or as a bare grey URL. In a market where WhatsApp is the main sharing channel, this directly affects how many people click a link a customer forwards.

Add og:title, og:description and og:image (1200x630px) to every page, plus the Twitter card equivalents.

Caching lets repeat visitors and the CDN reuse work already done. Without it your server does the full job for every single request, which costs you both speed and hosting capacity on your busiest days.

Set appropriate Cache-Control headers — long-lived for assets with versioned filenames, short with revalidation for HTML.

Modern image formats are typically 25-50% smaller at the same visual quality. On an image-heavy page this is often the single largest saving available.

Convert images to WebP or AVIF with a fallback, or move to an image CDN that does the conversion automatically per visitor.

Organic search traffic is high-intent compounding revenue. Knowing which keywords drive inbound interest allows you to protect your highest-converting search positions against aggressive competitors.

Strengthen internal linking to your top-ranking pages and publish dedicated landing pages for second-page keywords (positions 11-20) to push them into the top 3.

TLS-RPT (RFC 8460) works alongside MTA-STS to send you daily diagnostic reports on inbound email delivery failures and TLS decryption attempts.

Publish a TXT record at _smtp._tls.siggol.com with "v=TLSRPTv1; rua=mailto:tls-reports@siggol.com".

When someone discovers a vulnerability in your site, security.txt tells them where to report it. Without one, findings tend to go unreported or get posted publicly instead of coming to you first.

Publish a short /.well-known/security.txt listing a contact address and a preferred language.

A live chat widget only works during office hours, and outside them it collects messages that go stale overnight. An assistant grounded in your own product and pricing information handles the routine questions immediately at any hour and hands over to your team only when the conversation is worth their time.

Keep the widget and add a grounded assistant behind it, with clear escalation to a human. Visitors keep the interface they recognise; you stop losing the after-hours enquiries.

Between the moment someone requests a quote and the moment they receive it, they are contacting your competitors. Research on lead response consistently finds that the supplier who responds first wins a disproportionate share of the business. If quotes go out the next working day because someone has to build each one by hand, you are losing deals you already paid to attract.

Automate quote generation from your existing pricing rules — an instant indicative figure to the customer plus a structured brief to your sales team, with the complex cases still routed to a human. This is workflow automation rather than a website change.