The invisible checklist
When an enterprise buyer evaluates your product, their security team runs a quiet background check on your domain before the first call. They don't tell you. They just deprioritise vendors who fail it.
Here are the signals that matter — and that your competitors have already fixed.
Email authentication (DMARC, SPF, DKIM)
What it is: DNS records that prove you own your email domain and prevent spoofing.
Why it matters: Any enterprise with an email security policy blocks vendors without DMARC. This is table stakes for financial services, healthcare, and government procurement.
How to fix: Add TXT records to your DNS. Takes 30 minutes. Tools like MXToolbox verify setup.
SSL / HTTPS everywhere
What it is: HTTPS on all pages including redirects, login, and marketing site.
Why it matters: Modern browsers flag HTTP as "Not Secure." Enterprise security scanners flag it harder.
How to fix: Ensure no mixed content, force HTTPS redirects, use HSTS headers.
Security headers
What it is: HTTP response headers — Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options.
Why it matters: These are checked by automated security scanning tools used by enterprise procurement. Missing headers fail automated vendor assessments.
How to fix: Add to your reverse proxy or Next.js next.config.js headers config.
security.txt
What it is: A file at /.well-known/security.txt with your responsible disclosure contact.
Why it matters: ISO 27001 and SOC 2 auditors look for this. Also shows security maturity to technical buyers.
How to fix: Two lines of config. Takes 10 minutes. [IETF RFC 9116](https://www.rfc-editor.org/rfc/rfc9116).
Privacy policy, Terms of Service, Cookie policy
What it is: Legal pages accessible from the footer.
Why it matters: GDPR, CCPA, and general procurement checklists require these. Legal teams won't approve a vendor without them.
How to fix: Use a generator for a baseline. Get legal review before any regulated industry customer.
Cookie consent
What it is: A compliant consent banner for cookies and tracking.
Why it matters: GDPR requires it for EU visitors. Many enterprise buyers test this as a proxy for overall compliance maturity.
How to fix: Implement a compliant CMP (Consent Management Platform). Cookiebot, OneTrust, or self-built.
Review badges (G2, Capterra, Trustpilot)
What it is: Third-party review scores displayed on your site.
Why it matters: 80% of B2B buyers check review sites before shortlisting. No reviews = "new vendor risk."
How to fix: Systematically ask customers for reviews after onboarding. 5 reviews beats 0 dramatically.
llms.txt
What it is: A structured text file at /llms.txt describing your product for AI systems.
Why it matters: AI-powered research tools (used by buyers and analysts) read this to understand your product. Missing it = invisible to AI-assisted procurement research.
How to fix: 30 lines describing what you do, who you serve, pricing, and key URLs.
CDN and performance
What it is: Serving assets from a CDN (Cloudflare, Fastly, CloudFront) for fast global load times.
Why it matters: Slow marketing sites correlate with slow products in buyers' minds. Also affects Core Web Vitals and SEO rankings.
HTTP/2 support
What it is: Modern HTTP protocol with multiplexing and server push.
Why it matters: Performance + signals technical hygiene. Most CDNs enable this by default.
Domain age and SSL certificate history
What it is: How long your domain has been registered; certificate transparency logs.
Why it matters: Phishing and scam sites use new domains. Old, consistently-certified domains are trusted more by email filters and browser security.
The competitive angle
Run this checklist against your top competitor. Chances are they've fixed most of these. Every one they have and you don't is a reason a buyer chooses them.
QFLOO automates this audit and shows you exactly which signals your competitors have that you don't — with a prioritised list to close the gap.
Summary
None of these are hard to fix. Most take under an hour. But they compound — a buyer who checks five of these signals and finds you fail two will deprioritise you. Fix the whole list, then use it as a selling point.