How it works
Enter your site. The server loads your homepage and a few standard files, the way a search engine would, asks Google how it sees your site and builds your runbook.
Three views
- Ready check: 36 checks the scan answers on its own, with nothing for you to tick. It tells you whether your site is ready.
- Recommended: 75 items. The ready check plus the extras worth doing, some of which you tick yourself.
- Everything: all 117 items, including social profiles and launch sites.
Green, amber, red, grey
Green means the scan confirmed it. Amber means it works but could be better. Red means the scan found a problem. Amber and red items have the fix on the line below. Grey means the scan could not check it this time. Scanned items are locked to what the scan found, so fix the problem and scan again. Blank items are yours to tick.
What the scan checks
- The site loads over HTTPS, the certificate is not about to expire and http:// redirects to https://
- No http:// images, scripts or styles on the https homepage
- www and non-www end up at the same address
- The domain registration is not about to expire and has a transfer lock
- robots.txt lets Google in, a sitemap lists only your final addresses and nothing says noindex
- Title and meta description, and whether Google will cut them off
- Canonical link, viewport tag, lang attribute, one h1 heading and alt text on images
- Open Graph tags with an og:image that loads and is big enough, and a twitter:card tag
- JSON-LD structured data that is valid JSON
- Text on the homepage without JavaScript
- Up to 10 links on the homepage, to find broken ones
- A favicon and an apple-touch-icon
- Phone zoom settings, text encoding, timed refreshes, HTML size and unnecessary redirects
- Server response time, compression, HTTP/2, IPv6, HSTS, security headers and software versions in headers
- security.txt with a contact
- SPF, DMARC, MX and CAA records in DNS
- A made-up URL returns a real 404
- An analytics script: Google Analytics, Plausible, Umami, Cloudflare and others
- Links to a privacy page, a terms page, a contact page and social profiles named after your site
What it asks Google
- Whether Google shows your site when people search its address, and its name (US results)
- Whether Google Safe Browsing flags it as dangerous
- PageSpeed Insights scores for speed, accessibility, SEO and best practices on phones, and Core Web Vitals from real Chrome users
- Button names, field labels, link names, text contrast, heading order, image dimensions, main content landmarks, loading time, layout shifts and script blocking in the same phone test
- Room for phone taps, stretched pictures, links search engines can follow and browser errors during loading
- Names for embedded maps and videos, video captions and unwanted location or notification requests
- Whether the site is verified in Google Search Console (a verification tag or DNS record) and Bing Webmaster Tools
Help with each item
Use the information button beside any item to learn what it means, why it matters and what the scan can actually confirm. Links name the tool or guide they open. Manual checks are for things a public scan cannot reliably test.
The phone preview
The screenshot comes from the same Google phone test as the speed scores. A first test can take up to two minutes. A spinner and elapsed time show that it is loading, and we stop waiting after three minutes including any queue. A successful preview is reused for up to 12 hours, so it can appear immediately on a return visit even if a new test fails. Speed scores are reused for ten minutes.
Your progress
Ticks are saved in your browser, one list per site. Each runbook has its own link, like /r/example.com, so you can come back to it.
Safe scanning
The scanner only visits public addresses on ports 80 and 443. It follows at most five redirects, gives up after a few seconds and reads at most 1.5 MB per page. Scans are limited per visitor, and the Google search and speed checks run for at most 10 new sites a day per visitor. Google results are kept for 12 hours, so a new ranking can take that long to show.