What we check

Answers: How fast does the page load and respond for real visitors?

Data from: Google Lighthouse lab test through Google PageSpeed Insights (mobile; desktop on paid plans), and the Chrome UX Report: real-user timings from Chrome over the last 28 days.

38 checks · Examples:

• Lighthouse performance score
• Largest Contentful Paint (LCP)
• Cumulative Layout Shift (CLS)
• Total Blocking Time (TBT)
• First Contentful Paint (FCP)
• Speed Index

Answers: Is the connection encrypted and the site configured against common attacks?

Data from: The page’s response headers and cookies, our own TLS handshake with your server, and public DNS records, checked by PerfoMetrix.

39 checks · Examples:

• Served over HTTPS
• HTTP redirects to HTTPS
• No redirect from HTTPS to HTTP
• Certificate is trusted
• Certificate expiry
• Certificate matches the hostname

Answers: Can your domain’s e-mail be trusted, and is the DNS set up well?

Data from: Public DNS resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) for SPF, DKIM, DMARC, MX, CAA and DNSSEC, and public DNS blocklists. Counted with Security.

14 checks · Examples:

• SPF record
• DMARC policy
• CAA record
• DNSSEC enabled
• MTA-STS for incoming mail
• TLS reporting for mail (TLS-RPT)

Answers: Are there signs of a compromise visible from outside?

Data from: Google Web Risk for the page and the third-party scripts and frames it loads, a list of known compromised script hosts, and passive signs in the page code, robots.txt, sitemap and the PageSpeed network log.

14 checks · Examples:

• Page and its scripts not on Google’s malware lists
• No scripts from known compromised hosts
• Domain not blocked by Quad9
• No fake "verify you are human" paste instructions
• No blockchain calls on a non-crypto site
• No code before <html> or after </html>

Answers: Can search engines find, understand and show the page well?

Data from: The page’s HTML, robots.txt and sitemap, read by PerfoMetrix, and the Google Lighthouse SEO, accessibility and best-practice audits.

71 checks · Examples:

• Page returns HTTP 200
• Short redirect chain
• Title tag
• Meta description
• Exactly one H1 heading
• Canonical URL

Answers: Can AI assistants and answer engines reach, read and quote the page?

Data from: robots.txt rules for AI crawlers, llms.txt, the page’s HTML and structured data, and whether the domain is in the latest Common Crawl.

14 checks · Examples:

• Search and AI search crawlers allowed
• Assistants can open your pages
• AI training crawlers
• Content in the HTML
• Schema for who and what
• Author and date

Answers: What is the site built with, where is it hosted and how well known is it?

Data from: Technology fingerprints in the page, DB-IP for location and network, RDAP registries for the domain, Tranco and Chrome UX Report rankings, endoflife.date and WordPress.org for software versions, certificate transparency logs (crt.sh).

14 checks · Examples:

• At least two name servers
• Name servers on separate networks
• SOA record timers
• Served through a CDN
• Green hosting
• Unsupported software