How it works

Enter your site. The server loads your homepage and a few standard files, the way a search engine would, asks Google how it sees your site and builds your runbook.

Three views

• Ready check: 28 checks the scan answers on its own, with nothing for you to tick. It tells you whether your site is ready.
• Recommended: 53 items. The ready check plus the extras worth doing, some of which you tick yourself.
• Everything: all 85 items, including social profiles and launch sites.

Green, amber, red, grey

Green means the scan confirmed it. Amber means it works but could be better. Red means the scan found a problem. Amber and red items have the fix on the line below. Grey means the scan could not check it this time. Scanned items are locked to what the scan found, so fix the problem and scan again. Blank items are yours to tick.

What the scan checks

• The site loads over HTTPS, the certificate is not about to expire and http:// redirects to https://
• No http:// images, scripts or styles on the https homepage
• www and non-www end up at the same address
• The domain registration is not about to expire and has a transfer lock
• robots.txt lets Google in, a sitemap lists only your final addresses and nothing says noindex
• Title and meta description, and whether Google will cut them off
• Canonical link, viewport tag, lang attribute, one h1 heading and alt text on images
• Open Graph tags with an og:image that loads and is big enough, and a twitter:card tag
• JSON-LD structured data that is valid JSON
• Text on the homepage without JavaScript
• Up to 10 links on the homepage, to find broken ones
• A favicon and an apple-touch-icon
• Server response time, compression, HTTP/2, IPv6, HSTS, security headers and software versions in headers
• security.txt with a contact
• SPF, DMARC, MX and CAA records in DNS
• A made-up URL returns a real 404
• An analytics script: Google Analytics, Plausible, Umami, Cloudflare and others
• Links to a privacy page, a terms page, a contact page and social profiles named after your site

What it asks Google

• Whether Google shows your site when people search its address, and its name (US results)
• Whether Google Safe Browsing flags it as dangerous
• PageSpeed Insights scores for speed, accessibility, SEO and best practices on phones, and Core Web Vitals from real Chrome users
• Whether the site is verified in Google Search Console (a verification tag or DNS record) and Bing Webmaster Tools

Your progress

Ticks are saved in your browser, one list per site. Each runbook has its own link, like /r/example.com, so you can come back to it.

Safe scanning

The scanner only visits public addresses on ports 80 and 443. It follows at most five redirects, gives up after a few seconds and reads at most 1.5 MB per page. Scans are limited per visitor, and the Google search and speed checks run for at most 10 new sites a day per visitor. Google results are kept for 12 hours, so a new ranking can take that long to show.