Gmail's rules
Since February 2024, Gmail asks every sender to have SPF or DKIM set up. Anyone sending around 5,000+ emails a day needs SPF, DKIM and DMARC. From November 2025 Gmail started rejecting more mail that doesn't meet the rules.
Website & Email Security Check-Up
Is your email
landing in spam?
Let's check.
We look at what anyone on the internet can already see about your website and email domain: SSL, security headers, SPF, DKIM and DMARC. You get a plain-English report with a short fix list, and we can do the fixes for you.
Passive checks only. We never test, scan or log in to anything without your written OK.
01Why it matters now
Yahoo & Outlook too
Yahoo has the same kind of rules. Since May 2025, Outlook.com sends mail from high-volume domains without SPF, DKIM and DMARC to junk, and can reject it outright.
Spoofing is easy
Without a DMARC policy, a scammer can send an email that looks like it came from you@yourbusiness.com. Your customers and suppliers can't tell the difference.
Small gaps, big trust
Missing security headers and weak SSL settings are quick to fix. Fixing them makes your site harder to abuse, and gives you something solid to show customers and insurers.
Sources: Gmail sender guidelines · Gmail FAQ (Nov 2025 enforcement) · Yahoo sender best practices · Outlook.com postmaster policies
02Pricing
Security Snapshot
$99
- Passive check of public signals
- 3–5 page PDF report in 48h
- Traffic-light grades in plain English
- Priority fix list
- 100% credited if you upgrade within 14 days
Most popular
Fix Pack
$349
- Everything in the Snapshot
- SPF, DKIM & DMARC set up properly
- HTTPS redirects & HSTS fixed
- Security headers added
- WordPress hardening (updates, 2FA, cleanup)
- Before/after report as proof
- Done in 3–5 days
Harden + Monitor
$599 + $49/mo optional
- Everything in the Fix Pack
- Cloudflare protection (free tier)
- Backups set up
- Uptime & SSL-expiry alerts
- Monthly DMARC report review
- Monthly check-up email + 30-min call
Prices in USD. Fix Pack and Harden need access to your domain DNS, hosting and website admin. Shopify, Wix and Squarespace sites: we cover account security and email DNS, and the platform handles the server side.
03What we check
- 01
Email domain
SPF, DKIM and DMARC records, mail servers (MX), and whether your domain can be spoofed.
- 02
SSL / HTTPS
Certificate validity and expiry, TLS versions, HTTP to HTTPS redirect, HSTS.
- 03
Security headers
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
- 04
Public exposure
Mixed content, CMS and plugin versions visible in page source, blacklist status, and known breaches of your domain's emails.
Passive checks only
We only read what your website and DNS already show to every visitor. Think of it as walking past the shop and noticing the window is open. We don't run attack tools, try logins or probe your systems. Any hands-on work happens only after you give us written permission and access, and only for the fixes you agreed to. We don't promise "unhackable". We promise less risk and documented fixes.
04See a real report
We ran the Snapshot on our own domain first, creativestudio.group. It found real gaps (yes, on our own site), and the report shows exactly how we explain them and what the Fix Pack would change.
Download sample report (PDF) →What you get:
- → An overall grade and score
- → Each finding with a severity level
- → What it means for your business, in plain words
- → How to fix it, step by step
05Get your Snapshot
Email us your domain name. That's all we need for the Snapshot.
julia@creativestudio.groupReport delivered within 48 hours. We work with small businesses in the US and UK, remotely.