Website Health Check
Enter a web address and this free health check tests one page for the problems that quietly cost small businesses visitors and email: HTTPS and redirects, security headers, titles and meta tags, robots.txt and the sitemap, and the SPF and DMARC records on your domain. Results appear in about 20 seconds, each with a plain-English explanation.
Please note: this checks one public page and the DNS records of its domain, as seen from our checker at that moment. It does not log in, test every page, scan for malware or measure loading speed in a browser, so a clean result is a good sign, not a guarantee.
How it works
The checker opens the page you enter, follows up to three redirects, and reads the response headers and HTML. It also requests the plain http version of your homepage, your robots.txt and sitemap, and looks up your domain's SPF and DMARC records in DNS. Each result is marked Pass, Check (worth a closer look), Fix or Info.
Connection and SSL
Page status and speed: the page should answer with HTTP 200. We also show how long your server took to answer our checker and how much HTML it sent. A slow answer here often points to an overloaded host or a heavy WordPress setup.
SSL certificate: a Pass means the page loaded over https and the certificate was accepted as valid and trusted. We cannot read the expiry date, so the result links to a free SSL Labs report that shows it, along with the full certificate chain.
http redirects to https: someone who types your address without https should land on the secure version. Good looks like a permanent 301 or 308 redirect. A temporary 302 still works for visitors, but it tells Google the move is not final.
Security headers
We look for Strict-Transport-Security (HSTS), which tells browsers to always use https for your site, then for five more: X-Content-Type-Options, X-Frame-Options (or the CSP frame-ancestors rule), Content-Security-Policy, Referrer-Policy and Permissions-Policy. Four or more of the five is a Pass. These headers are set on the server, not in your page content, so ask your host or developer if they are missing.
SEO basics
We check the page title (about 50 to 60 characters is a good target), the meta description (aim for 140 to 155), a canonical tag, Open Graph tags so links shared on WhatsApp and Facebook show a proper preview, exactly one H1 heading, a mobile viewport tag, and that nothing tells search engines not to index the page. We also look for JSON-LD structured data; if there is none, the result links to our Local Business Schema Generator. To see how your title and description may look in Google, try the Google Snippet Preview.
robots.txt and sitemap
robots.txt is optional, but it should never block the whole site from search engines, and it is the usual place to list your sitemap. We then look for an XML sitemap in robots.txt or at /sitemap.xml. Once you have one, submit it in Google Search Console so Google can find every page.
Email records: SPF and DMARC
We look up the SPF record on your domain (there must be exactly one, and it should never end in +all) and the DMARC record at _dmarc on your domain. Good looks like one SPF record that lists the services that send your email, and a DMARC policy of quarantine or reject. A DMARC policy of "none" only monitors, so it is a sensible first step but not the finish. Our help article on SPF, DKIM and DMARC shows how to set them up. DKIM is not tested, because checking it needs the selector name your email provider uses.
What this check cannot tell you
It looks at one page only, so run it on your most important pages separately. It cannot see the SSL expiry date (use the SSL Labs link), and it does not measure Core Web Vitals or how fast the page renders in a browser: for that, use Google's PageSpeed Insights. It does not scan for malware, check plugins or test your forms. If you want someone to keep an eye on all of that, our website maintenance plan covers monthly updates, backups and security checks.
What happens to the address you enter
We fetch only the page you enter and the few files listed above from the same website. We do not store the address you check or the results: they appear on your screen and are gone when you close the page. To stop the tool being abused, we keep a one-way hash of your IP address and the time of each check for the hourly limit, never the IP address itself. A Cloudflare Turnstile spam check runs before each scan. You can read more in our privacy policy.
Related services and guides
- Website maintenance: monthly updates, backups and security checks once your site is live
- Website maintenance guide: what to check, and how often
- SSL certificates: HTTPS for every page of your site
- SSL certificates and HTTPS explained: what the padlock does and does not protect
- SEO services: when the basics are right and you want to rank higher
- Email hosting: professional email on your own domain
Frequently Asked Questions
What does a website health check test?
This one tests the things that most often go wrong on small business sites without anyone noticing: whether the page loads and how quickly it answers, HTTPS and the http to https redirect, six common security headers, the page title, meta description, canonical tag, social sharing tags, H1 heading, mobile viewport, noindex instructions, structured data, robots.txt, the XML sitemap, and the SPF and DMARC records that help your email reach the inbox.
Is my SSL certificate about to expire?
This tool cannot read the certificate expiry date, only whether the certificate was accepted as valid when we checked. The SSL result links to a free SSL Labs report that shows the exact expiry date and how the certificate is set up. Free Let's Encrypt certificates last 90 days or less and normally renew automatically, so if one has expired, auto-renewal has usually failed. Our guide to SSL certificates and HTTPS explains the options.
Why does my site show "Check" for security headers?
Security headers are instructions your server sends with every page, telling browsers to always use HTTPS, not to guess file types, not to let other sites frame your pages, and so on. Many hosting setups send none of them by default. Missing headers do not mean your site is hacked, but adding them closes common gaps. On Apache and LiteSpeed hosting they can usually be added in the .htaccess file, and some WordPress security plugins add them for you.
What are SPF and DMARC, and why are they in a website check?
They are DNS records on your domain that tell receiving mail servers which servers may send email as you, and what to do with mail that fails the test. Without them, your quotes and invoices are more likely to land in spam, and scammers can more easily send email that looks like it came from you. They sit on the same domain as your website, so a health check is a good moment to look at them. Our help article on setting up SPF, DKIM and DMARC walks you through it.
Does this check my site speed and Core Web Vitals?
No. It reports how long your server took to answer our checker, which can point to a slow host, but that is not the same as how fast the page feels to a visitor. For loading speed and Core Web Vitals, use Google's free PageSpeed Insights, which tests the page in a real browser and shows field data from Chrome users where Google has enough of it.
Want us to do it for you?
Tell us what you need and we will reply with a clear recommendation and a fixed price. Prefer to chat? WhatsApp or call us.