Your Squarespace security settings

Squarespace hosts your site, issues your certificate and runs your checkout, so there's no server for you to patch. Your part is a short list of settings: who can log in, how they log in, how your site handles HTTPS, and the email records on your domain.

This guide walks through each one and explains the few things Squarespace doesn't let you change. That second part matters when you read a CyberVigil report, because some findings on a Squarespace site aren't yours to fix.

What does Squarespace handle for you?

Squarespace manages the hosting, the platform software and your HTTPS certificate. Its help center says every domain connected to a Squarespace site gets a free SSL certificate from Let's Encrypt, refreshed every 90 days, with connections using TLS 1.2 or newer. Squarespace also says its checkout pages meet Level 1 of PCI DSS, the card industry's security standard.

Domains managed by Squarespace also get DNSSEC, a protection for your domain's DNS answers, automatically, as long as the domain ending supports it.

Those are the platform's responsibilities. Logins, contributors, your SSL preference and your domain's email records are yours.

How do I turn on two-factor authentication in Squarespace?

Two-factor authentication, a form of multi-factor authentication (MFA), asks for a code or a passkey after your password. A stolen password alone then isn't enough to get into your account. The FTC's small business guidance tells owners to require multi-factor authentication for access to sensitive information, and your website account qualifies.

Squarespace offers three methods: a passkey, an authentication app, or text messages (only in Australia, Canada, Ireland, the UK and the US). Squarespace recommends turning on just one. To use an authentication app:

1. Download an authentication app such as Google Authenticator.
2. In your Squarespace account dashboard, open the Two-factor authentication panel.
3. Next to Authentication App, click Set Up and log in again when prompted.
4. Scan the QR code with your app, then click Next.
5. Enter the code from the app and click Confirm.
6. Save the backup login codes that appear. They're shown only once, and each works a single time.

When you log in, Squarespace offers to remember the computer for 30 days. Only tick that box on a device you alone use.

Some tools, such as Squarespace's Developer Platform, can't handle the second step. Don't switch two-factor off for them. Open the Security panel in your account dashboard, click App Passwords, and generate a separate password for that tool.

Contributors need to do this themselves. Squarespace says "There isn't a way to enable it for them," so send each contributor this section and ask them to confirm when it's done.

Who should have contributor access to your site?

Anyone who can log in to your site should need that access today. Contributor access doesn't expire when a project ends. Someone has to remove it.

Squarespace splits access into permissions. Administrator includes every other permission, so keep that for people who run the business. Narrower options include Website editor, Store manager, Billing, Analytics, Comment moderator and Viewer. You can turn on more than one for a person.

To review and change permissions:

1. Open the Permissions & Ownership panel. It lists every contributor.
2. In the Contributors section, click a contributor's name.
3. Switch permission toggles on or off to match their job.
4. Click Save.

Squarespace says that if someone doesn't need access anymore, for example because they've left the company, you should remove their contributor profile. Do that from the same panel. Squarespace doesn't offer per-page permissions, so a Website editor can edit every page.

When you bring in someone new, such as a designer, click Invite Contributor in the same panel and turn on only the permissions their project needs. Once the work is finished, remove them.

Check Google Workspace admins too

If you bought Google Workspace through Squarespace, its users are separate from your site contributors. Squarespace notes that the Google Workspace administrator setting is separate from website administrator permissions. To review them, open your domains dashboard, click the domain, click Email, then Manage Google Workspace. Remove anyone who has left, and give admin rights only to people who need them. Our Google Workspace security guide covers the rest of that account.

Which SSL setting should you choose?

Choose Secure with HSTS Secure turned on. Squarespace labels this combination as its recommendation.

• Secure sends visitors who type http:// to the encrypted https:// version of your site.
• HSTS Secure adds a header called HSTS, which tells browsers to only ever use HTTPS for your site.
• Insecure exists for older domains and leaves visitors on unencrypted connections. Avoid it.

To change it:

1. Open your site's SSL panel.
2. Under Security preference, choose Secure.
3. Turn on HSTS Secure.
4. Click Save.

Make this choice once and keep it. Squarespace warns that switching HSTS off later can stop returning visitors from reaching your site for up to 48 hours.

If your browser shows a "not secure" warning on some pages after this, the usual cause is custom code loading an image or script over http://. Change those addresses to https://. Our guide to why a website shows "not secure" walks through the checks.

See what your Squarespace site shows the world

Run a free scan to check your HTTPS redirect, certificate, HSTS header and your domain's email protection records.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Can you add security headers on Squarespace?

Mostly, no. Security headers are instructions your site sends to browsers with every page, such as "don't let other sites frame this page." Squarespace's help center doesn't describe a setting for adding or changing them.

Two workarounds don't help here:

• Code injection adds HTML and scripts inside your pages. A header-style meta tag added that way isn't a response header, and CyberVigil only reads the headers your site sends, so your report won't change.
• Squarespace says it doesn't support third-party SSL providers such as Cloudflare. Putting a proxy in front of your site to add headers isn't a supported setup.

How do I add email records to a Squarespace domain?

Email authentication records stop scammers from easily sending mail that appears to come from your domain. The FTC recommends three: SPF, DKIM and DMARC.

If you bought Google Workspace or Titan email through Squarespace, Squarespace adds the records your mail service needs. Check for a DMARC record with the DMARC checker either way, and add one if it's missing.

If your domain is registered with Squarespace, add a DMARC record like this:

1. Open your domains dashboard and click the domain.
2. Click DNS, then DNS Settings.
3. Under Custom Records, click Add record. Squarespace may ask you to confirm your password or two-factor code.
4. Set Type to TXT, enter the name and text from the table below, and click Save.

Changes can take up to 48 hours to appear. If your domain is registered with another company and only connected to Squarespace, make these changes at that company instead.

SPF and DKIM values come from your email provider. Keep a single SPF record for the domain and add every service that sends as you to it.

What should you do next?

Start with two-factor authentication, then check the SSL panel. Both take a few minutes.

1. Run a free website security scan to confirm your HTTPS redirect, certificate and email records.
2. Read SPF, DKIM and DMARC explained before you tighten your DMARC policy.
3. Follow the DMARC fix guide once your reports look clean.