availability
Keep the homepage reachable
Your website’s first response is a useful signal, but one response
cannot tell you its uptime history.
-
Check the website in a normal browser and on a second network.
If only an automated request fails, your bot protection may be
the cause.
-
Review your host’s incident status and recent deployments.
Record the error and the time before changing anything.
-
For ongoing monitoring, agree which pages matter, how often to
check, and who should receive confirmed incident alerts.
https
Keep HTTPS working
A successful HTTPS connection shows that certificate validation
succeeded for that request. It does not measure when the
certificate expires.
-
Enable automatic renewal with your hosting or certificate
provider and keep the renewal contact current.
-
Use HTTPS for links, scripts and media. Test redirects from the
HTTP version of your site.
-
Confirm all relevant hosts work over HTTPS before enabling HSTS.
Test the impact of includeSubDomains before using it.
headers
Review browser security headers
Headers are part of a broader security setup. Copying a strict
policy without testing can break your website.
-
Start with X-Content-Type-Options: nosniff and a suitable
Referrer-Policy in your hosting settings.
-
Design a Content Security Policy around the scripts, fonts,
forms and integrations your site needs. Use report-only mode
while testing.
-
Keep platform software updated, limit access, and maintain
tested backups. A header check does not replace these controls
or a security review.
seo
Make search signals clear
Public HTML can reveal useful signals. Only your search console
can show actual indexing and performance.
-
Give each important page a descriptive title and an accurate
meta description. Avoid stuffing either with repeated keywords.
-
Check canonical URLs and remove accidental noindex instructions
from pages intended for public search. Keep private and staging
content protected.
-
Review your sitemap and robots rules, then use Google Search
Console or the equivalent search engine tools to inspect the
pages that matter.
mobile
Check the actual mobile experience
A viewport tag is a starting point. It cannot show whether someone
can read your text or complete an enquiry.
-
Use a real phone to check navigation, readable text, image
layout and button sizes.
-
Test contact links, click-to-call and WhatsApp links where you
use them. Make sure the expected business account opens.
-
Complete an authorised enquiry or test-mode purchase. Check for
keyboards covering buttons, confusing validation and missing
confirmations.
speed
Measure performance before changing things
The free checker’s response observation includes DNS checks and
redirects. It is not a full page-load time or a Core Web Vitals
assessment.
-
Run a browser performance audit using PageSpeed Insights.
Compare mobile and desktop, and separate lab results from
real-user data when available.
-
Start with oversized images, excessive third-party scripts and
slow server responses when the evidence points to them.
-
Repeat the same measurements after changing one thing. Keep an
eye on usability and conversion as well as a synthetic score.
email
Check the domain that actually sends email
Enter the domain after the @ in your business email. A website
subdomain may not have the same records. DNS records alone cannot
prove inbox delivery.
-
Use your sending provider’s instructions for SPF. Avoid creating
multiple SPF records; merge authorised senders carefully and
check lookup limits.
-
Use the DKIM selector provided by your email service to verify
signing. A generic scan cannot reliably discover every selector.
-
Review DMARC alignment and reports before moving to stricter
enforcement. Test delivery with permission, and investigate
actual bounces rather than promising an inbox placement score.
journeys
Test the customer journey with permission
A homepage can work while a form or checkout fails. These checks
require more than reading a public page.
-
Agree which journeys you are authorised to test and how to
distinguish test records from real customers.
-
For forms, check validation, the confirmation screen and
delivery to the intended inbox. Remove test data using your
normal process.
-
For payments, use your provider’s supported test mode. Verify
the order status and confirmation messages. Never use a live
purchase as an unannounced automated test.
routine
A simple monthly website routine
Choose a small, repeatable routine and give someone responsibility
for it.
-
Review domain, hosting and certificate renewal ownership. Keep
recovery contacts and multi-factor authentication current.
-
Check backups and periodically test a restore in a safe
environment. Agree who can approve urgent changes.
-
Review your important pages, enquiry journey and recent updates.
Keep a short change log and confirm that alerts reach someone
who can act.
