Your Wix security settings

Wix runs the servers, the platform software and your HTTPS certificate, so there's no hosting to maintain. That leaves a handful of settings in your hands: how you log in, who else can get in, which apps stay installed, and the email records on your domain.

This guide covers each of those, with menu paths from Wix's own help center. It also explains which findings in a CyberVigil report Wix doesn't let you change, so you don't spend an afternoon looking for a setting that isn't there.

What does Wix handle for you?

Wix says every site created on Wix uses HTTPS, with an SSL certificate included at no extra cost. That covers custom domains and subdomains connected to your site, though connecting a custom domain needs a paid plan. You can't switch the certificate off.

There are also things Wix doesn't let you change. Most sites can't add custom security headers, Wix domains don't use DNSSEC, and Wix doesn't support putting Cloudflare's proxy in front of a site. The section on report findings below explains what each of those means for you.

Your part is your login, your collaborators, your apps and your domain's email records.

How do I turn on 2-step verification for my Wix account?

2-step verification, a form of multi-factor authentication (MFA), asks you to confirm it's you after entering your password. Someone with your password alone can't get in. The FTC's small business guidance tells owners to require multi-factor authentication for access to sensitive information, and the account that controls your website and customer forms qualifies.

To turn it on:

1. Go to Account Settings in your Wix account.
2. Scroll down to 2-step verification.
3. Click Enable next to the method you want: the Wix app, text message, an authenticator app, or email.
4. Follow the instructions on screen.

Wix lets you turn on more than one method, which protects you from being locked out if you lose your phone. Add a second method and save your recovery codes in a password manager. You can also set up a passkey, which uses your device's fingerprint or face unlock instead of a code.

Wix remembers a device for 30 days by default. On a shared or public computer, untick Remember this device for 30 days when you sign in.

If you sign in with Google or Facebook

Wix only asks for a verification code when you sign in with your email and password. A social login skips that step, so the protection comes from your Google or Facebook account instead. Turn on 2-step verification there too.

Who should have access through Roles and Permissions?

Give each collaborator the narrowest role that covers their work, and remove people when the work ends. Wix offers roles such as Admin (Co-Owner), Website Manager, Website Designer, Back Office Manager and Billing Manager. Keep Admin rare. As its Co-Owner label suggests, it comes close to owner-level access.

To review roles:

1. Go to Roles & Permissions in your site's dashboard.
2. Check each person's role in the Role column. Hover over it to see what the role allows.
3. To change a role, click the More Actions icon next to the person, click Change Role, select or deselect roles, and click Save.

To remove someone:

1. Go to Roles & Permissions in your site's dashboard.
2. Click the More Actions icon next to the collaborator.
3. Click Remove, then click Remove again to confirm.

2-step verification is a setting on each person's own Wix account. Ask every collaborator to turn it on, and make it a condition for anyone with Admin access.

The FTC gives the same advice for outside help: "Limit access to a need-to-know basis, and only for the time the vendor needs to do the job." Review this list every few months.

Which Wix apps should you delete?

Delete any app you no longer use. Each one adds features you have to keep track of, and dashboard apps can keep running behind the scenes long after you've forgotten them.

Wix removes apps in three different ways, depending on the type:

• Dashboard-only apps, like analytics or automation tools, are removed from Manage Apps in your dashboard. Click the More Actions icon, click Delete, pick a reason, and click Delete App.
• Full-page apps, like Wix Stores or Wix Blog, are removed in the editor. Click My Business, select the app, click the More Actions icon, and click Delete App twice.
• Apps placed on a page, like a social feed widget, are removed by selecting the element in the editor, deleting it, and publishing your site.

Before you delete anything, export the data you want to keep. Wix warns that deleting an app can remove data such as store inventory or bookings. Deleting an app doesn't cancel its subscription, so cancel that first.

While you're in the editor, check any HTML elements you've added. Wix's help center says code containing http:// addresses can make browsers warn that your site isn't fully secure. Change those addresses to https:// and publish.

See what your Wix site shows from the outside

Run a free scan to check your HTTPS setup, certificate and your domain's email protection records in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I add email records to a Wix domain?

Email authentication records make it much harder for scammers to send mail that looks like it came from yourbusiness.com. The FTC recommends three: SPF, DKIM and DMARC. Your email provider gives you the SPF and DKIM values. DMARC is a record you add yourself.

If Wix manages your domain's DNS, add a DMARC record like this:

1. Go to Domains in your Wix account.
2. Click the Domain Actions icon next to the domain, then click Manage DNS records.
3. Scroll to the TXT section and click + Add Record.
4. Enter the host name and value from the table below, then click Save.
5. Click Save Changes in the pop-up.

When a provider tells you to use @ as the host name, for example for an SPF record, Wix wants that field left blank instead. Keep a single SPF record and add each service that sends as your domain to it.

If your domain is connected to Wix by pointing, or uses custom nameservers, Wix doesn't manage its DNS. Add the records at your domain host instead. DNS changes can take up to 48 hours to spread.

Why does my report show findings I can't fix on Wix?

CyberVigil checks what any visitor's browser and the public DNS can see. On a Wix site, three kinds of findings are usually outside your control.

Security headers come first. Wix states: "Currently, it's not possible to add or customize security response headers, via code or otherwise, unless you have the Wix Studio enterprise solution." Adding code to the page won't change the headers CyberVigil reads.

DNSSEC is the second. Wix's help center says "all Wix domains have DNSSEC automatically not signed," and it asks owners of outside domains to keep DNSSEC unsigned so the connection to Wix works.

Cloudflare is the third. Wix says it doesn't support proxied DNS records for domain connections, so a Cloudflare proxy can't add the missing headers for you.

What should you do next?

Start with 2-step verification on your own account. It takes a few minutes and protects everything else on this list.

1. Run a free website security scan to check your HTTPS setup, certificate and email records.
2. Test your domain with the DMARC checker, and follow the DMARC fix guide once your reports look clean.
3. Read how to stop email spoofing to see how the three email records work together.