1. Use HTTPS so the browser shows the lock icon
2. Publish a security policy explaining your protections:
   • Server Firewalls, Malware Scanning
   • SPF, DKIM, and DMARC for email
   • Software updates
   • DDoS protection

These visible and documented measures help users recognize that your site is technically secure.

No. Security is a result of good infrastructure and practices, not the domain name. 

They’re often confusing appearance with actual security. While federal agencies are required to follow certain security protocols like DNSSEC, HTTPS, and email protections, non-federal municipalities are only encouraged to do the same. All government entities can implement these standards with any domain.

Yes. All domains can use high-grade SSL/TLS, secure server setups, multi-factor authentication, regular monitoring; basically, any security best practice measure. 

This is not a straight yes/no answer. You need to weigh the perceived trust benefits against practical drawbacks.

1. Will your .gov domain end up longer and harder to remember due to the get.gov requirements?
2. Will you incur new costs for updating printed materials, signage, and digital assets?
3. CISA does not charge for a .gov domain. All other domains have an annual renewal fee. If you let your old domain expire, there is a cost savings. However, we've experienced that most municipalities keep their domain for at least a few years, just in case.
4. Will your citizens welcome the change to a new website address?
5. Domain transitions require time and administrative oversight.
6. Does it matter to your municipality if your search engine rankings take a hit during the transition?

Only verified U.S. government entities—federal, state, or local. The process is relatively simple and starts at get.gov. Only a municipality can apply for a .gov, your website vendor cannot do it for you. 

While all 6 items below are high priority, if you want to work in a priority order, here is our recommendation. 

1. An active SSL certificate 
2. Ongoing software and server updates 
3. Secure, trusted hosting 
4. Strong password policies and access control 
5. Regular backups and a clear recovery plan.
6. A user-friendly design that reflects professionalism

We have a "How To" article at