88 checks,<br>nothing hidden
Here is exactly what the full audit analyses on your site. Every check is explained in plain language, with its real-world impact.
Security
HTTPS, certificates, security headers, exposed files, CSRF…
1 HTTPS active ›
Imagine sending a letter to your friend. HTTPS is like sealing it in an envelope with a secret code, so nobody can read it along the way. Without HTTPS, anyone on the network can spy on what visitors do on the site.
Without HTTPS, passwords, card numbers and private messages can be stolen. Google also shows a "Not Secure" warning and penalises sites without HTTPS in its rankings.
2 Valid SSL certificate ›
The SSL certificate is like the site's ID card. It proves the site is who it claims to be and that communication is encrypted. It has an expiry date, like a passport.
An expired or invalid certificate triggers a large red alert in the browser. Visitors leave immediately and Google penalises the site in its results.
3 HTTP → HTTPS redirect ›
When a visitor types the site address without "https://" at the start, this check verifies the site automatically redirects them to the secure version. It's like a doorman guiding people to the main entrance.
Without this redirect, some visitors access the site in an unsecured version without knowing it. This exposes their data and hurts Google rankings.
4 HSTS header ›
HSTS tells the browser: "This site must ALWAYS be visited over HTTPS, never HTTP". The browser remembers this and blocks any unsecured access attempt, even if someone tries to hijack the connection.
Without HSTS, attackers can force visitors onto HTTP and intercept their data (downgrade attack). HSTS blocks this type of attack once the browser has remembered the rule.
5 HTTP security headers ›
These are hidden instructions in the server response that tell the browser how to protect itself. For example: "don't display this site inside another site's frame" or "don't guess file types". They are the site's security rules.
Without these headers, attackers can embed your site in other pages to trick visitors (clickjacking) or exploit browser bugs. They are very easy to add on the server side.
6 Content-Security-Policy (CSP) ›
CSP is like a guest list for your site. It tells the browser: "Only load scripts from these approved sources". This prevents attackers from injecting malicious code into your pages.
XSS (malicious code injection) attacks are among the most common on the web. A good CSP can block them almost entirely. It's especially important if the site accepts user-generated content.
7 CSRF form protection ›
Imagine someone creates a fake "order" button on their site, and clicking it triggers a real order on another site where you're logged in. The CSRF token is a secret code in forms that prevents this.
Without CSRF protection, an attacker can make logged-in users perform actions (transfers, password changes, orders) without their knowledge. It's one of the most widespread vulnerabilities.
8 robots.txt (security) ›
The robots.txt file tells search engines which pages they can visit. This check ensures it doesn't accidentally block the entire site and doesn't reveal sensitive paths to malicious actors.
A misconfigured robots.txt can prevent indexing of your entire site (SEO disaster) or point attackers to sensitive areas. It's a simple file with significant consequences.
9 Exposed admin pages ›
Admin pages such as "/admin" or "/wp-admin" give full access to site management. This check verifies whether these pages are accessible without authentication.
If the admin page is publicly accessible, attackers can try thousands of passwords automatically (brute force attack). It's the first thing automated scanners look for.
10 Exposed sensitive files ›
Files like ".env" or ".git/HEAD" contain very sensitive information: database passwords, secret API keys, source code. This check ensures they are not publicly accessible.
If these files are public, anyone can retrieve database access or cloud service credentials and take full control of the site. This is an immediate security catastrophe that must be fixed.
11 Cookie consent banner (GDPR) ›
European GDPR law requires sites to ask permission before installing cookies (small tracking files) on visitors' computers. This check detects whether a consent banner is present.
Without a compliant consent banner, the company risks significant fines (up to 4% of turnover under GDPR). It is legally mandatory in France and throughout Europe.
12 Exposed subdomains ›
Subdomains are addresses like "mail.yourdomain.com" or "dev.yourdomain.com". This check lists active subdomains that respond, giving a picture of the site's infrastructure.
Forgotten or poorly secured subdomains can be entry points for attackers. Knowing which ones exist allows you to secure or shut them down.
13 CMS/server version hidden ›
Some sites display in their code which version of WordPress, PHP or other software they use. It's like publicly announcing which lock you have, so thieves can find the right key.
Attackers look for sites running old, vulnerable software versions. Hiding the version makes their work harder. It's a simple but effective preventive measure.
14 No email in plain text ›
If an email address is written in plain text in the HTML code, automated bots harvest it and add it to spam lists. This check detects whether emails are exposed this way on the page.
Exposed email addresses receive huge amounts of spam and are targeted in phishing attempts. It's better to use a contact form or encode the addresses in JavaScript.
Domain & DNS
Domain expiry, SPF, DKIM, DMARC, TTL, blacklists…
1 Valid A/AAAA record ›
The A record is like the site's postal address. When someone types "yoursite.com" in their browser, the DNS system looks up this record to find the IP address of the server hosting the site.
Without a valid A record, the site is simply unfindable. Nobody can access it. It's the absolute foundation of any online presence.
2 Domain expiration ›
Your domain name is rented, not bought forever. It must be renewed every year (or every X years depending on the contract). This check shows how much time remains before the address expires.
If the domain expires, the site disappears immediately. Anyone can then buy your address and use it in your place. Many businesses have lost their domain by forgetting to renew it.
3 MX records ›
MX records tell the world's email servers where to send messages addressed to your domain. Without them, emails sent to "contact@yoursite.com" will go nowhere.
Without MX records, you cannot receive emails using your domain name. This is essential for professional credibility and communication with your clients.
4 SPF record ›
SPF is an authorisation list for emails. It says: "Only these servers are allowed to send emails on behalf of yoursite.com". This prevents attackers from sending fraudulent emails pretending to be you.
Without SPF, anyone can send emails impersonating your address, damaging your reputation and deceiving your clients. It also helps prevent your legitimate emails from landing in spam.
5 DKIM record ›
DKIM adds a digital signature to every email you send, like a wax seal on a letter. Email servers can verify the email really came from you and wasn't tampered with along the way.
Without DKIM, your emails are more likely to land in spam. Combined with SPF and DMARC, it protects your sender reputation and improves email deliverability.
6 DMARC record ›
DMARC is the conductor of email security. It tells receivers what to do if an email claims to come from your domain but fails SPF or DKIM checks: "reject it" or "quarantine it". It also sends you reports.
DMARC protects your brand against email impersonation (phishing). Without it, attackers can send fake emails to your clients in your name, destroying trust and damaging your reputation.
7 BIMI record ›
BIMI allows your company logo to appear directly in email clients (like Gmail) next to your sender address. It's like having an official badge that makes your emails instantly recognisable.
BIMI is optional but improves brand visibility and strengthens recipient trust. It requires a strong DMARC policy (quarantine or reject) to work.
8 Zone transfer protection (AXFR) ›
A DNS zone transfer (AXFR) allows a secondary server to copy all DNS records. If a server accepts this request from anyone (not just authorised servers), it exposes the entire DNS map.
An unauthorised zone transfer gives attackers a complete list of all your subdomains and servers, making targeted attacks easier. Well-configured DNS servers refuse these requests from outside.
9 Consistent TTL ›
TTL (Time To Live) tells DNS servers how long they should remember your site's address before re-checking it. Like an expiry label: after this time, they must re-verify.
A well-configured TTL speeds up DNS resolution for visitors and reduces load on your servers. In normal operation, 3 600 seconds (1 hour) is a good value.
10 Redundant DNS servers ›
NS servers are the "directories" that answer DNS questions about your domain. Having at least two NS servers ensures that if one goes down, the other takes over.
With only one NS server, if it fails, your site becomes inaccessible for everyone. A minimum of two servers is a basic internet RFC requirement for reliability.
11 CAA record ›
The CAA record specifies which certificate authorities (like Let's Encrypt) are allowed to issue an SSL certificate for your domain. It's a whitelist for certificate issuers.
Without CAA, any certificate authority could theoretically issue a fraudulent certificate for your domain. CAA reduces this risk and protects against certain man-in-the-middle attacks.
12 www vs non-www unified ›
"www.yoursite.com" and "yoursite.com" are technically two different addresses. This check ensures both redirect to the same canonical URL, so visitors always end up in the same place.
If www and non-www show the same page without redirecting, Google sees two identical sites (duplicate content) and penalises rankings. You must choose a canonical version and redirect the other.
13 IP not blacklisted ›
International organisations maintain blacklists of IP addresses known for sending spam or distributing malware. This check verifies whether your server's IP appears on these lists.
If your IP is blacklisted, your emails will be rejected by many servers and some users won't be able to access your site from networks that filter based on these lists.
14 Hosting identified ›
This check resolves the IP address of the server hosting the site. It's basic information useful for diagnosing connection problems or identifying the hosting provider.
Knowing the server IP allows you to verify geographic location (important for local SEO), detect hosting provider changes, and perform technical diagnostics.
15 DNSSEC enabled ›
DNSSEC adds a digital signature to DNS responses. It's like an official seal guaranteeing the response hasn't been tampered with. Without DNSSEC, an attacker could redirect visitors to a fake site.
DNS spoofing attacks can redirect visitors to fake sites without their knowledge. DNSSEC protects against this. Still not widely adopted, but increasingly recommended by security experts.
16 Typosquatted domains ›
Typosquatting involves registering domain names similar to yours with a typo (e.g., "gooogle.com"). This check detects whether similar domains exist and could mislead your visitors.
Similar domains can be used to steal traffic, clients, or for scams. Buying the closest variants of your domain is the best protection for your brand.
17 Reverse DNS (PTR) ›
The PTR record does the reverse DNS lookup: starting from an IP address, it finds the domain name. It's like looking up "who owns this phone number". It's especially important for mail servers.
Without a PTR record, emails sent from this server are more likely to be marked as spam, because email servers verify that the IP corresponds to a known domain.
SEO
Tags, sitemap, structured data, Core Web Vitals…
1 <title> tag ›
The title tag is the text appearing in the browser tab and as the first clickable link in Google results. It's the first thing people read to decide whether to click on your site.
A well-written title (50-65 characters) with the right keywords can double click-through rates from Google. It's the most basic SEO factor and yet often poorly optimised.
2 Meta description ›
The meta description is the 2-3 line text appearing below the title in Google results. It doesn't directly improve rankings, but greatly influences whether people click on your link.
A good meta description (130-160 characters) can significantly increase click-through rates. If absent, Google picks a random excerpt from the page, often unappealing.
3 Unique H1 tag ›
The H1 tag is the main visible title on the page (different from the title in the browser tab). It tells Google and visitors what the page's main topic is. There should be only one per page.
The H1 is a strong SEO signal. Multiple H1s confuse search engines about the page's topic. A missing H1 is a missed SEO opportunity.
4 Heading structure ›
H1, H2, H3… headings structure content like a table of contents. H1 is the main title, H2 are chapters, H3 are sub-sections. Jumping from H1 to H3 without H2 is like skipping chapters in a book.
A good heading hierarchy helps Google understand content structure. It also helps screen readers for accessibility and improves the general reading experience.
5 XML sitemap ›
The XML sitemap is a list of all the site's pages, formatted for search engines. It's like giving Google a detailed floor plan so it can explore everything quickly and easily.
Without a sitemap, Google may miss some pages, especially new ones. Submitting it in Google Search Console speeds up indexing and ensures all important pages are properly referenced.
6 robots.txt (SEO) ›
This check ensures the robots.txt file declares the sitemap address. Google and other search engines check robots.txt on their first visit and can then find the sitemap directly.
Declaring the sitemap in robots.txt makes page discovery easier for crawlers. It's a small detail that can speed up indexing of new pages.
7 Canonical tag ›
The canonical tag tells Google: "This page is the official version". If the same page is accessible at multiple URLs (with www, without, with parameters…), the canonical prevents Google from treating them as duplicate content.
Duplicate content dilutes SEO. Without canonical, Google may split "SEO juice" between multiple versions of the same page or penalise for duplication. It's a common and often overlooked issue.
8 Open Graph / Twitter Card ›
Open Graph tags control how the site appears when someone shares it on Facebook, LinkedIn, WhatsApp or X: title, description, preview image. Without them, sharing looks like anything.
A well-formatted share with a nice image attracts far more clicks. It's free and easy to add, but can multiply visits from social networks.
9 Structured data (schema.org) ›
Structured data is special code that tells Google the type of content on the page: article, product, recipe, FAQ, business… Google can then display "rich results" with stars, prices or FAQs directly in search results.
Rich snippets draw much more attention and can multiply click-through rates by 2 or 3. It's a strong competitive advantage, especially for e-commerce and local services.
10 Image alt attributes ›
The alt attribute is alternative text for images. It's read by screen readers for visually impaired users, and used by Google Images to understand the image subject and index it in results.
Images without alt are invisible to screen readers (accessibility issue) and to Google Images (lost traffic). It's also a WCAG accessibility audit criterion.
11 Hreflang tags ›
If the site is in multiple languages, hreflang tags tell Google which version to show to which country. Without them, Google may show the wrong language to the wrong audience.
For multilingual sites, hreflang is essential for international SEO. Misconfigured, it can cause duplicate content penalties or inconsistent rankings across countries.
12 Internal linking ›
Internal links are links pointing from one page of the site to another page on the same site. They help visitors navigate and allow Google to discover and rank all pages.
Internal linking is a powerful SEO lever. It distributes "popularity" (PageRank) between pages and helps Google understand which are most important. Pages with no inbound links are often ignored.
13 Broken links ›
A broken link (or "dead link") is a link pointing to a page that no longer exists (404 error). This check tests external links on the homepage to detect ones that no longer work.
Broken links create a poor user experience and give the impression of a poorly maintained site. Google considers them in its assessment of page quality.
14 Page not blocked (noindex) ›
The "noindex" tag on a page tells Google not to index it, therefore not to display it in search results. This is sometimes intentional (admin pages), but catastrophic if mistakenly applied to important pages.
This is one of the most serious and common SEO problems. An entire site can disappear from Google because of a single misplaced line of code. This check can save a site's rankings.
15 Core Web Vitals / PageSpeed score ›
Google measures site speed on mobile and gives it a score from 0 to 100 (PageSpeed Insights). This score reflects the real user experience: display time, layout stability, responsiveness.
Since 2021, Core Web Vitals are an official Google ranking factor. A slow site is penalised. Furthermore, each additional second of loading drives away approximately 20% of visitors.
16 Google Search Console ›
Google Search Console is a free Google tool for monitoring how the site appears in results, submitting sitemaps, seeing which keywords bring traffic, and being alerted to technical issues.
Without Google Search Console, you're flying blind for SEO. It's the essential tool for any webmaster. The verification tag detected indicates the site is already connected to this tool.
17 Breadcrumb navigation ›
The breadcrumb is the "Home > Category > Article" navigation visible at the top of pages. By structuring it with JSON-LD, Google can display it directly in results, taking up more space and attracting more attention.
Structured breadcrumbs improve Google visibility (rich snippets), help visitors locate themselves in the site, and improve structural signals sent to search engines.
18 Legal pages accessible ›
In France, all professional sites must have legal notices. Terms and conditions are mandatory for e-commerce. A privacy policy is required by GDPR as soon as the site collects personal data.
Missing legal pages is a violation of French law that can lead to fines. They are also necessary for visitor trust and business credibility.
19 robots.txt ↔ sitemap coherence ›
This check ensures the sitemap URL declared in robots.txt is accessible and belongs to the correct domain. It's the coherence between two files that must point in the same direction.
A sitemap declared in robots.txt but inaccessible confuses indexing robots. They may ignore the sitemap or report errors in Google Search Console.
20 Sitemap internal coherence ›
This check analyses the sitemap content itself: are all URLs in HTTPS? Do they all point to this domain? Is the homepage included? Are any pages inaccessible?
An incoherent sitemap (with HTTP URLs, wrong domain, or error pages) harms indexing. Google may ignore some URLs or report errors in Search Console.
Performance
Speed, images, cache, HTTP/2, render-blocking resources…
1 Server response time (TTFB) ›
TTFB (Time To First Byte) measures the time between the browser requesting the page and the first byte of response arriving. It's like measuring how long a server takes to "pick up the phone".
A TTFB above 500 ms slows down the entire page load. It's also a negative signal for Google rankings. A fast TTFB (< 200 ms) is the foundation of a performant site.
2 gzip/Brotli compression ›
Compression reduces the size of HTML, CSS and JavaScript files before sending them to the browser, like compressing a ZIP file. The browser decompresses it instantly upon receipt.
Compression can reduce page size by 60 to 80%. Without it, visitors on slow connections wait much longer. It's a simple and very effective optimisation.
3 HTTP cache ›
HTTP cache tells the browser to remember files (CSS, JS, images) so it doesn't re-download them on every visit. It's like remembering the route so you don't have to re-check GPS every trip.
Without cache, every visit re-downloads everything from scratch, slowing navigation and increasing server load. With good cache, pages display almost instantly for returning visitors.
4 CDN usage ›
A CDN (Content Delivery Network) is a network of servers distributed worldwide. Instead of serving files from a single server, the CDN serves them from the server closest to the visitor.
A CDN significantly reduces load times for distant visitors. It also absorbs traffic spikes and protects against certain attacks (DDoS). Cloudflare offers a free tier.
5 Image lazy loading ›
Lazy loading means images only download when the visitor is about to see them while scrolling. Images far down the page aren't unnecessarily loaded at the start.
On a page with many images, lazy loading can reduce initial load time by 50% or more. Google considers it in Core Web Vitals. It's a single line of code per image.
6 Page weight ›
This check measures the weight of the main page's HTML code. The lighter the HTML, the faster the page loads. This doesn't count linked images and CSS, just the HTML document itself.
Overly heavy HTML (> 500 KB) slows down the first display. It can be caused by unnecessary code, excessive inline styles, or embedded content. Optimise if the weight is excessive.
7 Render-blocking resources ›
When a browser loads a page and encounters a script without "async" or "defer", it stops and waits for that file to download before continuing. It's like blocking the entire checkout queue.
Render-blocking resources delay page display, harming Core Web Vitals (LCP, FCP). Adding "defer" or "async" to scripts can reduce display time by several seconds.
8 Redirect chain ›
When accessing a URL, the server may redirect to another URL. If that new URL in turn redirects to a third, it's a redirect chain that slows down navigation.
Each redirect adds approximately 100-300 ms of delay. A long chain can seriously slow loading. Ideally, there should be only one redirect (HTTP → HTTPS).
9 Resource preloading ›
Preloading lets you tell the browser early: "You'll need this font or CSS, start downloading it now". Resources are ready well before they're needed.
Preloading critical fonts and CSS can improve LCP and FCP metrics (Core Web Vitals). It's an advanced but effective optimisation, especially for external fonts.
10 HTTP/2 enabled ›
HTTP/2 is the modern version of the communication protocol between browsers and servers. It allows downloading multiple files simultaneously (multiplexing), whereas HTTP/1.1 could only handle one at a time.
HTTP/2 can reduce load times by 20 to 50% on pages with many resources. It's supported by all modern browsers. You just need to enable it on the server side.
11 Service Worker / PWA ›
A Service Worker is a script running in the browser's background, allowing a web app to work offline, show push notifications, and behave like a mobile app (PWA).
For most brochure sites, this is optional. For web applications (SaaS, tools), it's increasingly expected to improve user experience and enable offline use.
12 HTML minification ›
Minification removes unnecessary spaces, line breaks and comments from HTML, CSS and JavaScript code. The result is identical for the browser but more compact, reducing file size.
Minification can reduce file sizes by 10 to 30%. Combined with gzip compression, it makes pages even lighter. It's automated in most modern build tools.
13 Font optimization ›
When a site loads fonts from Google Fonts, text display may be blocked until the font fully downloads (FOIT). The CSS property "font-display: swap" avoids this by showing a system font first.
Unoptimised web fonts often cause slow LCP (Core Web Vitals). "font-display: swap" is one of the simplest and most effective fixes for improving perceived performance.
14 Image format (WebP/AVIF) ›
WebP and AVIF are new image formats that compress much better than JPEG or PNG: a WebP image weighs 30-50% less for the same visual quality. AVIF is even more efficient but less supported.
Converting images to WebP can significantly reduce a page's total weight. Images are often the heaviest resource. All modern browsers support WebP.
15 HTTP request count ›
Each CSS, JavaScript or image file requires a separate HTTP request to the server. Even with HTTP/2, a very large number of requests slows loading. This check counts referenced resources.
Reducing request count (by bundling CSS/JS files) speeds up loading, especially on slow connections. Beyond 60 resources, loading begins to degrade noticeably.
Content & Accessibility
Mobile, GDPR, legal notices, ARIA, content without JS…
1 Site accessible (HTTP 200) ›
This check ensures the site responds with HTTP code 200, meaning "all good, here's the page". A 500 code means a server error, 503 means the service is unavailable.
This is the most basic check: is the site working? If the homepage returns an error, nobody can visit the site and Google cannot index it.
2 Mobile compatibility (responsive) ›
The viewport tag in the HTML code tells mobile browsers to adapt the page to screen size. Without it, the site displays as a shrunken desktop version on phones, requiring zooming to read anything.
Over 60% of web traffic comes from mobiles. Google prioritises the mobile version of sites ("Mobile First Indexing"). A non-responsive site is penalised in results and drives visitors away.
3 Language declared ›
The lang attribute on the main HTML tag (<html lang="en">) indicates the content language. Browsers and screen readers use it to choose the right pronunciation and adapt the interface.
It's a WCAG accessibility criterion. Without lang, screen readers may pronounce text in the wrong language, making the site incomprehensible for the visually impaired. Google also uses it for geographic targeting.
4 Favicon present ›
The favicon is the small icon appearing in the browser tab, in bookmarks, and on mobile home screens when the site is added as a shortcut. It's the site's first visual brand marker.
A favicon strengthens brand recognition and credibility. Its absence gives the impression of an unfinished or unprofessional site. It's a simple file to add.
5 Contact information ›
This check looks for contact information (phone, email, address) on the homepage. It's an important trust signal for visitors wanting to reach the business.
Visible contact information increases visitor trust and conversions. It's mandatory in French legal notices and important for local search rankings.
6 SIRET/SIREN number ›
The SIRET is the unique identification number of a business in France (14 digits). It must appear in the legal notices of any business or commercial site. It's like the company's ID card number.
The absence of a SIRET in legal notices is a violation of French commercial law that can lead to penalties. It also harms the company's credibility with visitors.
7 Privacy policy (GDPR) ›
The privacy policy explains to visitors what personal data is collected, why, and how it's used and protected. It's mandatory as soon as a site collects data (even just the IP address).
GDPR requires any site targeting European residents to have a privacy policy. The fine can be up to €20 million or 4% of global turnover. This is non-negotiable.
8 Content readable without JavaScript ›
This check measures whether the page contains HTML content visible without JavaScript. Some sites (React, Vue, Angular apps) generate all content via JavaScript, which can be problematic for Google's crawlers.
If all content depends on JavaScript to display, Google may struggle to index it properly. Even though Googlebot executes JavaScript, it's less reliable and slower than static HTML.
9 Keyboard navigation ›
Keyboard navigation allows using a site by pressing Tab to move between elements and Enter to click. It's essential for people who cannot use a mouse.
It's a WCAG 2.1 Level A accessibility criterion. People with motor disabilities navigate by keyboard. It's also legally required for certain sectors (public services, banks).
10 ARIA attributes ›
ARIA (Accessible Rich Internet Applications) attributes add information about elements' roles and states for assistive technologies. For example: "this button opens a navigation menu".
Without ARIA, screen readers for the visually impaired struggle to understand interactive components (dropdowns, modals, sliders). It's an important WCAG accessibility criterion.
11 Icon accessibility ›
Icons (arrows, logos, pictograms) should either be hidden from screen readers (if decorative) with aria-hidden="true", or labelled with aria-label if they carry meaning (e.g., a close button).
An icon without ARIA management may be read as "image without description" by a screen reader, making the site difficult to use for the visually impaired. It's easily fixed with a single attribute.
12 No Flash content ›
Flash was a technology from the 2000s for browser animations. It was discontinued in 2020 and is no longer supported by any modern browser or mobile device. It's a dead technology.
If the site still uses Flash, all visitors see a blank screen or error. This is urgent: replace Flash content with modern HTML5/CSS3/JavaScript equivalents.
13 Content freshness ›
This check looks for recent years in the page content (in text, copyright dates, articles…) to estimate whether the site is regularly updated or appears abandoned.
A site with recent content inspires more visitor trust. Google also favours fresh content for certain queries. A current-year copyright is the minimum signal of an active site.
Technical & Infrastructure
CMS, 404 errors, malware, trackers, social media…
1 Technology / CMS detected ›
This check identifies the technology used to build the site (WordPress, Shopify, Next.js, custom code…) by analysing the HTML code, response headers, and cookies.
Knowing the technology allows tailoring optimisation recommendations. An unupdated CMS is more vulnerable. The absence of a detectable CMS signature is even a good security practice.
2 Server/PHP version hidden ›
Some servers display their exact version in HTTP headers (e.g., "Apache/2.4.51" or "PHP/8.1.2"). This check verifies whether the precise server or PHP version is publicly exposed.
Displaying the exact software version helps attackers look for known vulnerabilities for that specific version. Hiding it doesn't fully secure but complicates automated attack tooling.
3 Consistent HTTP 404 codes ›
When a visitor accesses a non-existent page, the server should return HTTP code 404. Some sites return 200 (success) even for non-existent pages: this is a "soft 404" that confuses Google's crawlers.
"Soft 404s" trick search engines into indexing empty or error pages, wasting crawl budget and harming SEO. A real 404 lets Google know not to index these pages.
4 Custom 404 page ›
When a visitor lands on a non-existent page, a custom 404 page helps them stay on the site (with navigation, suggestions, a link to the homepage). Without it, the visitor sees "404 Not Found" and leaves.
Every visitor on a 404 is a lost opportunity. A well-designed 404 can recover a good portion of these visitors and guide them to the right content. It's also a user experience criterion.
5 Valid external links ›
This check tests links pointing to other sites from the homepage, to ensure they still work. Sites change and links can become invalid over time.
Broken links degrade user experience and give the impression of a poorly maintained site. They can also harm SEO by signalling to Google that the site is not well maintained.
6 Malware / phishing detection ›
Google Safe Browsing is a database of dangerous sites (malware, phishing). This check verifies whether the site is flagged. If so, visitors see a red warning page before accessing it.
If the site is flagged as dangerous, browsers block access and Google removes it from results. This is an absolute emergency that can destroy the site's credibility within hours.
7 Third-party trackers identified ›
Third-party trackers are scripts from Google Analytics, Meta Pixel, LinkedIn Insight, etc. installed on the site to measure visits or target advertising. This check identifies them.
Each third-party tracker requires explicit consent before being activated (GDPR). Loading them without consent exposes the company to fines. They also slightly slow down the site.
8 Social media links ›
This check detects whether the site contains links to social media profiles (Facebook, LinkedIn, Instagram…). It's useful information for evaluating the company's online presence.
For local businesses or brands, social media links strengthen trust and can improve local SEO. For SaaS products or online tools, it's less critical.
9 Google Maps / local listing ›
This check detects whether Google Maps is embedded on the site, which is typical of local businesses wanting to show their location to customers. For an online tool, this is generally not applicable.
For physical businesses, a well-completed Google My Business listing and an embedded Google Maps improve local Google visibility, geo-targeted SEO and potential customer trust.
Ready to audit your site?
Get the full report with all 88 checks, prioritised recommendations and a downloadable PDF.