Website Trust Kit

Trust checklist

Visitors trust a site when it's clear who runs it, what it costs, how to reach a person and what happens when something goes wrong. Work through each section and tick what's done. Anything left unticked is your to-do list.

Site: ______________________ Checked by: ______________ Date: ____________

---

1. The basics

• The whole site loads over HTTPS, and http:// addresses redirect to https://.
• There are no browser warnings about mixed content or certificates on any page.
• www and non-www both work and redirect to one version.
• Your SSL certificate renews automatically, or the expiry date is in your calendar.
• Your domain is set to auto-renew, and the expiry date is in your calendar.
• The site has a favicon, so it's recognisable in browser tabs and bookmarks.
• There are no broken links, placeholder text ("Your text here", sample paragraphs) or stock template pages left over.
• Copyright year and "last updated" dates are current.

2. Who you are

• Your business or trading name is on every page, usually in the footer.
• There's a real about page with the names or faces of the people behind the site, or an honest explanation if you prefer to stay private.
• Where local law requires it, your legal business name, registered address and registration or VAT number are published (for example, the imprint page required in Germany and Austria, or company details for UK limited companies).
• Social profiles you link to are active and match your branding.

3. How to reach you

• A contact page that's easy to find from every page.
• At least one direct contact method: an email address that a person reads, a phone number or a contact form. Ideally more than one.
• Expected response time stated ("We reply within one working day").
• If you have a physical location, the address and opening hours.
• Contact form tested this week: the message arrives and the sender gets a confirmation.

4. Clear pricing

• Prices are on the site, or you explain clearly how pricing works and how to get a quote.
• It's clear whether prices include tax and delivery.
• Recurring charges say how often they happen, and when the first charge is.
• Free trials state what happens when they end, and how to cancel before being charged.
• No surprise fees appear only at checkout.
• The currency is shown.

5. Refunds and cancellations

• A refund policy in plain language, linked from the footer and near the buy button.
• It says how to ask for a refund, how long it takes and any conditions.
• Subscriptions can be cancelled online, without a phone call or a maze of screens. Some places now require this by law.
• You've checked the consumer rules where your customers are. For example, in the EU and UK consumers usually have a 14-day cancellation right for online purchases, with specific rules for digital content.

Template: templates/refund-policy.md

6. Privacy and cookies

• A privacy policy that matches what your site actually does, linked from the footer and from every form that collects personal data.
• It lists the services that receive visitor data (hosting, email, analytics, payments, chat widgets, embedded video).
• Forms ask only for what you need.
• Cookie choices only when needed. If you only use cookies that are strictly necessary (for example, a login session or a shopping cart), many sites don't need a consent banner. If you use analytics, advertising or tracking cookies or similar storage, visitors in the EU and UK usually need to agree first, with a real "Reject" option that's as easy as "Accept". Check what your scripts actually set before deciding.
• If you use a consent banner, nothing non-essential loads until the visitor agrees.

Template: templates/privacy-policy.md

7. Terms

• Terms of service or terms of sale, linked from the footer and at checkout or sign-up.
• They cover what you provide, payment, cancellation, acceptable use and how disputes are handled.
• The date they were last updated is shown.

8. Security you can see

• A security.txt file at /.well-known/security.txt so researchers know how to report problems (see templates/security.txt).
• Login, sign-up and checkout pages use HTTPS and your payment provider's hosted checkout or payment fields.
• Your domain sends email with SPF, DKIM and DMARC in place (see email-authentication.md). This protects your customers from emails pretending to be you.
• Admin accounts for your site, domain and email use two-factor authentication.
• Your site's software, theme and plugins are up to date.

9. Accessibility

• The site can be used with only a keyboard, and the focus outline is visible.
• Text has enough contrast against its background.
• Images that carry meaning have alt text.
• Form fields have visible labels.
• Videos have captions.
• An accessibility statement that says what you support, what you know isn't perfect yet and how to ask for help.
• You've checked whether accessibility laws apply to you. For example, the European Accessibility Act applies to many businesses selling certain products and services to EU consumers since 28 June 2025, with exemptions for some very small businesses.

Template: templates/accessibility-statement.md

10. Uptime and status

• An uptime monitor checks your site every few minutes and alerts you.
• If people depend on your service, a status page or a known place where you post updates during outages.
• You know how to reach your host's support quickly.

11. Testimonials and reviews: honesty rules

Reviews persuade because people believe they're real. Keep it that way. Fake or misleading reviews are illegal in many places. In the US, the FTC's rule on consumer reviews and testimonials took effect in October 2024. In the UK, fake reviews are banned under consumer law that took effect in April 2025. Check the rules where you trade.

• Every testimonial is from a real customer who agreed to it being published.
• Quotes are their words. You can shorten them, but you don't change the meaning.
• You use real names or initials and a location or role only with permission.
• You haven't written reviews yourself, or had friends, family or staff post them as if they were customers.
• If a reviewer got something in return (a discount, a free product, payment), that's disclosed next to the review.
• You don't hide or delete negative reviews on your site just because they're negative.
• Ratings and counts ("4.8 from 230 reviews") are current and link to where people can see them.
• Results claims ("doubled my sales") are typical, or clearly marked as not typical.
• Logos of clients or press ("as seen in") are real and you have permission to use them.
• Stock photos aren't presented as customers.
• You keep a record of each testimonial's source and permission.

12. Tone and polish

• Spelling and grammar checked on every main page.
• No pressure tactics: fake countdown timers, false "only 2 left" messages or pre-ticked add-ons.
• Claims are specific and true. "Used by 40 studios" beats "trusted by thousands" if 40 is the real number.
• The site looks right on a phone.
• Pages load quickly on a mobile connection.

---

Summary

| Section | Done | To do |
|---|---|---|
| 1. The basics | | |
| 2. Who you are | | |
| 3. How to reach you | | |
| 4. Clear pricing | | |
| 5. Refunds and cancellations | | |
| 6. Privacy and cookies | | |
| 7. Terms | | |
| 8. Security you can see | | |
| 9. Accessibility | | |
| 10. Uptime and status | | |
| 11. Testimonials and reviews | | |
| 12. Tone and polish | | |

Email authentication: SPF, DKIM and DMARC

Three DNS records tell inbox providers which services are allowed to send email for your domain. With them in place, your messages are more likely to reach the inbox, and it's much harder for someone to send email pretending to be you.

Large inbox providers now expect these. Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, and Microsoft introduced similar rules for high-volume senders to Outlook addresses in 2025. Even if you only send a few emails a day, set them up.

You'll need access to your domain's DNS settings (at your registrar, or wherever your DNS is hosted, such as Cloudflare). All examples use example.com. Replace it with your domain.

---

Step 1: list everything that sends email as you

Before touching DNS, write down every service that sends from an @example.com address.

| Service | What it sends | Sends as | SPF include or setting | DKIM set up? |
|---|---|---|---|---|
| Your mailbox provider | Everyday email | [email protected] | | |
| Newsletter tool | Newsletters | [email protected] | | |
| Shop or payments | Receipts | [email protected] | | |
| Help desk | Support replies | [email protected] | | |
| Website forms | Notifications | [email protected] | | |

Each service's help pages will give you the exact SPF value and DKIM records. Use theirs rather than guessing.

Step 2: SPF

SPF lists the servers allowed to send for your domain. It's one TXT record on the root of the domain.

| Type | Name | Value |
|---|---|---|
| TXT | `@` (or `example.com`) | `v=spf1 include:_spf.google.com ~all` |

Common includes (check each provider's current documentation, since these can change):

| Provider | Include |
|---|---|
| Google Workspace | `include:_spf.google.com` |
| Microsoft 365 | `include:spf.protection.outlook.com` |

Combining two services:

v=spf1 include:_spf.google.com include:[newsletter-provider-include] ~all

Rules that catch people out:

• Only one SPF record per domain. Two records starting with v=spf1 break SPF. Merge them into one.
• Ten lookup limit. Each include, a, mx and redirect counts towards a limit of 10 DNS lookups. Go over it and SPF fails. Remove services you no longer use.
• Ending. ~all (soft fail) is a safe start. -all (hard fail) is stricter, and fine once you're sure every sender is listed.
• Domains that never send email should say so, to stop spoofing:

  v=spf1 -all

Step 3: DKIM

DKIM adds a signature to each message, which receivers check against a public key in your DNS. Each sending service gives you its own record, usually created from its dashboard.

DKIM records look like one of these:

| Type | Name | Value |
|---|---|---|
| TXT | `google._domainkey` | `v=DKIM1; k=rsa; p=MIIBIjANBgkqh...` (long public key) |
| CNAME | `s1._domainkey` | `s1.domainkey.u1234.wl.[provider].net` |

The part before ._domainkey is called the selector. Each service uses its own, so you can have several DKIM records side by side.

Tips:

• Use 2048-bit keys where the service offers a choice.
• Some DNS panels split long TXT values into several quoted strings. That's normal.
• After adding the record, go back to the service and click its "verify" or "authenticate" button.

Step 4: DMARC

DMARC tells receivers what to do when a message fails SPF and DKIM checks, and where to send reports. It's one TXT record at _dmarc.

Start by watching, without affecting delivery:

| Type | Name | Value |
|---|---|---|
| TXT | `_dmarc` | `v=DMARC1; p=none; rua=mailto:[email protected]` |

After two to four weeks of reports showing all your real email passes, tighten it in stages:

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]
v=DMARC1; p=quarantine; rua=mailto:[email protected]
v=DMARC1; p=reject; rua=mailto:[email protected]

| Tag | Meaning |
|---|---|
| `v=DMARC1` | Required, always first |
| `p=` | Policy: `none` (monitor only), `quarantine` (send to spam), `reject` (block) |
| `rua=` | Where daily summary reports go |
| `pct=` | Percentage of failing mail the policy applies to, useful while ramping up |
| `sp=` | Policy for subdomains, if different |
| `adkim=` / `aspf=` | Alignment: `r` relaxed (default) or `s` strict |

Tips:

• DMARC reports are XML files and arrive in large numbers. Use a dedicated mailbox, or a DMARC reporting service, to read them.
• If the report address is on a different domain, that domain needs an extra record to accept them. Keeping it on your own domain avoids this.
• For DMARC to pass, at least one of SPF or DKIM must pass and match your From domain. DKIM alignment is the more reliable of the two, since SPF often fails when email is forwarded.

Step 5: check it works

1. Wait for DNS to update. Usually minutes, sometimes up to a day or two.
2. Send an email from each service to a Gmail address. Open it, choose "Show original" and check SPF, DKIM and DMARC all say PASS.
3. Use any public DNS lookup tool to confirm the records are visible.
4. Read your first DMARC reports and look for legitimate senders that fail.

A complete example

For a business using Google Workspace for mail and one newsletter tool:

example.com.                  TXT    "v=spf1 include:_spf.google.com include:[newsletter-include] ~all"
google._domainkey.example.com TXT    "v=DKIM1; k=rsa; p=[public key from Google Admin]"
[selector]._domainkey         CNAME  [value from newsletter tool]
_dmarc.example.com.           TXT    "v=DMARC1; p=none; rua=mailto:[email protected]"

Also worth doing

• Bulk email extras. If you send marketing email in volume, the major inbox providers also expect a one-click unsubscribe link and a low spam complaint rate. Check their current sender guidelines.
• Parked domains. For domains you own but don't use for email, add v=spf1 -all, a DMARC record with p=reject, and no MX record. Scammers love unused domains.
• MTA-STS and TLS reporting are optional extras that make sure mail to you travels encrypted. Worth a look once the basics are done.
• BIMI can show your logo next to your emails in some inboxes, once DMARC is at quarantine or reject. Some providers also require a paid certificate for it.

Refund and cancellation policy template

Not legal advice. This is a plain-language starting point. Consumer law varies by country and sometimes by state or province, and some rights can't be removed by your policy. For example, in the EU and UK consumers usually have a 14-day right to cancel most online purchases, with specific rules for digital content and services. Check the rules where your customers are, and have a qualified professional review your final policy.

Replace everything in square brackets. Delete the sections that don't apply to what you sell.

---

Refund policy

Last updated: [date]

We want you to be happy with what you buy from [Business name]. If something isn't right, here's how we'll put it right.

The short version

• [You can return physical items within [30] days for a full refund.]
• [You can cancel your subscription at any time from your account. You'll keep access until the end of the period you've paid for.]
• [If a digital product doesn't work as described, tell us within [14] days and we'll fix it or refund you.]
• To ask for a refund, email [[email protected]] with your order number.

Physical products

Returns. You can return most items within [30] days of delivery. Items should be [unused and in their original packaging].

Items we can't take back. [Personalised items, perishable goods, sealed hygiene items once opened, gift cards.] This doesn't affect your rights if an item is faulty.

Faulty or wrong items. If something arrives damaged, faulty or isn't what you ordered, contact us within [14] days with a photo. We'll [replace it, repair it or refund you], and we'll cover the return postage.

Return postage. For change-of-mind returns, [you pay / we pay] return postage. We recommend a tracked service.

How to return.

1. Email [[email protected]] with your order number and the items you're returning.
2. We'll reply within [one working day] with the return address [and a label].
3. Once we receive the item, we'll refund you within [5 working days] to your original payment method.

Digital products

[Downloads, templates, software licences, courses.]

Before you buy. We describe each product in detail and [offer a preview / free version / demo] so you know what you're getting.

After you buy. [Choose one and make it true:]

• [Because digital products can be downloaded straight away, we don't offer refunds for change of mind once you've downloaded the files. If you're in the EU or UK, we'll ask you to confirm this at checkout.]
• [If you're not happy, email us within [14] days and we'll refund you, no questions asked.]

If it doesn't work. If a product is faulty or not as described, tell us within [14] days. We'll help you get it working, replace it or refund you.

Subscriptions

Cancelling. Cancel at any time from [Account > Billing], or by emailing us. You don't need to call us or give a reason.

What happens next. Your subscription won't renew. You'll keep access until [the end of your current billing period].

Refunds on subscriptions. [Choose one:]

• [We don't refund partial billing periods, except where the law requires it.]
• [If you cancel within [14] days of your first payment, we'll refund that payment in full.]
• [If you forgot to cancel before an annual renewal, email us within [7] days of the renewal and we'll refund it.]

Free trials. We'll remind you [3] days before your trial ends. If you don't cancel before then, you'll be charged [price] on [day the trial ends].

Services

[Consulting, design, repairs, bookings.]

Cancelling a booking. Cancel at least [48 hours] before your appointment for a full refund. Later cancellations [are charged [50%] / can be rescheduled once for free].

Work in progress. If you cancel a project after we've started, we'll charge for the work completed so far and refund the rest.

If we get it wrong. If our work doesn't match what we agreed, tell us within [14] days and we'll put it right or refund the affected part.

How long refunds take

We process refunds within [5 working days] of approving them. Your bank or card provider may take a few more days to show the money in your account.

Questions

Email [[email protected]] or see our contact page.

[Business legal name], [address]