5 Security Mistakes We Keep Seeing in Harare Business Websites

1. No SPF or DMARC, so anyone can spoof your email

SPF and DMARC are two short records that live with your domain settings. Together they tell the rest of the world which servers are allowed to send email using your name. Without them, a stranger can send a message that appears to come from your business, to your own customers, and their mail provider has no reliable way to tell it apart from the real thing.

The damage is not to your server. It is to the trust your customers place in your name. An invoice that appears to come from you, carrying different banking details, is the version of this that costs Zimbabwean businesses real money.

Check it yourself: run your domain through our email security checker. It reports whether SPF, DMARC and DKIM exist, and whether they are set strictly enough to actually block anything. If something is missing, our SPF and DMARC generator writes the records for you to paste into your DNS.

Cost to fix: nothing but the time. These are text records, not software.

2. Missing security headers

Security headers are instructions your server sends to every visitor's browser, telling it what the page is and is not allowed to do. Without them the browser has to guess, and it guesses permissively. That is what makes clickjacking and content injection possible: an attacker frames your site inside theirs, or persuades a browser to run something you never put on the page.

Three matter most. A content security policy, which limits what the page is allowed to load. HSTS, so browsers refuse to load your site over plain HTTP. And a frame rule, so nobody can embed your site inside theirs and collect what your visitors type.

Check it yourself: our security headers checker lists which headers you send and which you are missing. For the HTTPS side specifically, the SSL checker and TLS checker tell you whether your certificate and protocol versions are current.

Cost to fix: usually a configuration change measured in minutes, not a rebuild. The exception is a content security policy on an older site, which takes some care to avoid breaking things you rely on.

3. Outdated software

Old WordPress, old plugins, old server software. When a vulnerability is fixed it is also published, so attackers learn about it at the same moment you do. From then on the weakness is documented and automated. Nobody is choosing your business specifically. Bots sweep the whole internet looking for the version number you are still running.

"It still works" is not the same as "it is safe." A site can serve pages perfectly well while running a component with a publicly documented way in.

Check it yourself: our tech-stack detector shows what your site is broadcasting about itself, including version numbers it should probably not be advertising. If you are on WordPress, we went further in Is Your WordPress Site a Sitting Duck?

Cost to fix: free, because the update is the fix. A cost only appears when a site has fallen so far behind that updating breaks it, which is an argument for doing it regularly rather than never.

4. No privacy policy

If your site has a contact form, a booking form, or a newsletter signup, you are collecting personal data. Under Zimbabwe's Data Protection Act 2021 that carries obligations, and one of them is telling people plainly what you collect, why you hold it, and how long you keep it.

A missing privacy policy is a compliance gap. A copied one is arguably worse, because it describes a company that is not yours and data handling you do not actually do. Either way it tells a customer, and a regulator, that the question was never really considered.

Check it yourself: our security check-up covers this and the other Act-related questions in a few minutes. For the full picture, our data protection readiness assessment works through the Act section by section, and we set out the obligations in what the Act requires of you.

Cost to fix: free, if you write an honest one yourself. It has to describe what you actually do, which is precisely why a downloaded template does not settle it.

5. Forgotten subdomains and services

Old test sites, staging environments, a demo a previous developer set up and never removed. Still online, still reachable, and almost never updated, because nobody remembers they exist. That is what makes them useful to an attacker: an unmaintained staging copy often shares a database, a login, or a set of credentials with the live site.

This is the one owners are most often genuinely surprised by, and reasonably so. Nothing on your main site links to a subdomain somebody spun up two years ago, so there is no natural way you would come across it.

Check it yourself: our subdomain finder lists what is publicly discoverable under your domain, and the attack surface tool widens that to the other services you expose to the internet.

Cost to fix: free, and the fix is usually deletion. If you do not need it, take it offline.

What to fix first

If you only do one thing this week, do the email records. They are free, they take about twenty minutes, and they close the gap most likely to cost you money directly rather than eventually.

After that, in this order:

• Update your software. Free, and it removes the largest category of automated attack.
• Delete forgotten subdomains. Free, and it shrinks what you have to defend.
• Add the security headers. Minutes of configuration on most setups.
• Write the privacy policy. Free, and it is a legal obligation as well as a security one.

Four of the five cost nothing but attention. That is the honest position, and it is why the tools above are free to use rather than sitting behind a form.

The good news

Every one of these is cheap to fix once you know it is there. The hard part is knowing, and that is what our free website security check is for. It runs these checks from the outside, without touching your live site, and puts the results in one place. You can also run each one individually with our free tools.

If you would rather someone went through the whole thing properly, including what a passive scan cannot see from outside, that is what a penetration test covers. Ours starts at $1,200, and the passive scan stays free whether you buy anything or not.