Every check,
explained on its own.

Broken links

This check takes the links found on the scanned page and requests each one, preferring a HEAD request and falling back to GET for servers that refuse it. Anything answering 400 or above, or not answering inside the timeout, is reported with the status it returned.

Missing title tag

The <title> tag in a page's <head> names the page for browsers, search results and social shares. It's one of the few pieces of a page search engines still treat as an explicit, author-declared signal rather than something inferred from content.

Missing meta description

The meta description is a <meta name="description"> tag summarizing the page in a sentence or two. Search engines usually — not always — use it verbatim as the snippet shown under a result's title.

Canonical tag

A canonical tag (<link rel="canonical">) declares a page's preferred URL when the same content is reachable at more than one address — with and without a trailing slash, with and without a tracking query string, over http and https.

Image alt text

Every <img> should carry an alt attribute: a text description for informative images, or an empty alt="" for images that are purely decorative. This check reads it directly out of the HTML the server sent, so it runs on every scan regardless of whether a rendering engine is available.

Meta robots noindex

The meta robots tag — <meta name="robots" content="..."> — gives per-page instructions to crawlers, most commonly noindex (don't show this page in search results) and nofollow (don't follow links from this page). This check fails when either is set.

Heading hierarchy

Heading hierarchy is whether a page's <h1> through <h6> tags step down one level at a time — an <h2> can be followed by another <h2> or an <h3>, but not by an <h4> with no <h3> in between. This check reads the sequence of heading tags in the order they appear in the HTML.

AI crawler access

This reads robots.txt and checks whether it blocks any of the named AI crawlers — OpenAI's GPTBot and OAI-SearchBot, Anthropic's ClaudeBot and Claude-SearchBot, PerplexityBot, Google-Extended, Common Crawl's CCBot and others — distinct from the general-purpose search crawlers (Googlebot, Applebot) that index for classic search.

Structured data (JSON-LD)

Structured data is a <script type="application/ld+json"> block declaring what a page is, using schema.org vocabulary — Article, Product, Organization, FAQPage and similar types. This check looks for at least one such block that parses as valid JSON and declares a recognizable @type; it isn't a full schema.org validator checking that a given type's required fields are present.

Content that requires JavaScript

This compares the DOM node count and text length in the HTML a server actually sent against the DOM Google's Lighthouse run produces after rendering the page. When the rendered page has several times more nodes than the raw HTML did, and the raw HTML had very little text to begin with, that's the signature of a client-rendered shell rather than a page with real content.

robots.txt

robots.txt is a plain-text file at the root of a site — /robots.txt, never anywhere else — listing which paths crawlers may and may not fetch. It is a convention that well-behaved crawlers follow voluntarily; it is not an access control, and it does not stop anyone determined from reading a page.

XML sitemap

An XML sitemap is a file listing the URLs on a site that its owner considers worth indexing, optionally with the date each was last modified. This check requests /sitemap.xml and asks whether the server returns it.

Open Graph tags

Open Graph is a set of <meta property="og:..."> tags in a page's <head> describing how the page should appear when its URL is pasted somewhere else — a title, a description, an image, a type. It originated at Facebook and is now read by essentially every chat app, social platform and link-preview service.

Missing H1

The <h1> is the top-level heading of a document: the one sentence that says what this page is. This check counts <h1> elements in the served HTML and fails when there are none.

Multiple H1 tags

This check counts <h1> elements and flags a page carrying more than one. It runs only when the page has at least one, so it is a separate finding from a missing H1.

Custom 404 page

This check requests a path that cannot exist — a generated one, so it is not something a site could special-case — and looks at two things: the status code that comes back, and how much content came with it. A response that is not 404, or is under a couple of hundred bytes, reads as a server default rather than a page anyone designed.

www and non-www canonicalization

This check takes the host you entered, works out its counterpart — adding www. or removing it — and requests that. If the counterpart answers without redirecting to the host you entered, both are serving the site independently.

Largest Contentful Paint (LCP)

Largest Contentful Paint (LCP) measures the time from navigation start until the largest image or text block in the viewport has rendered — a stand-in for 'when does this page feel loaded' rather than 'when did the first byte arrive'. It's one of Google's three Core Web Vitals.

Cumulative Layout Shift (CLS)

Cumulative Layout Shift (CLS) scores how much visible content unexpectedly moves during a page's lifetime, weighted by how much of the viewport shifted and how far. A score under 0.1 is good; 0.1-0.25 is graded medium here, above 0.25 is high.

Total Blocking Time (TBT)

Total Blocking Time (TBT) sums how long the main thread was blocked by long tasks (over 50ms) between First Contentful Paint and the page becoming interactive. It's the lab-measurable stand-in this scanner uses for Interaction to Next Paint (INP), which needs real user interaction data that a single-page lab test can't produce.

Text compression

This checks whether text resources — HTML, CSS, JavaScript — are served with gzip or brotli compression via the Content-Encoding header. Resources under about 1.4KB are excluded, matching Lighthouse's own threshold: below that size, compression's header overhead costs more than it saves.

Render-blocking resources

A render-blocking resource is a stylesheet or synchronous script in <head> that the browser must download and process before it can paint anything — the page stays blank until every one of them resolves. This check looks specifically at resources in the document head, the ones the browser encounters before it can render a single pixel.

Time to First Byte

Time to First Byte is the interval between the browser asking for a page and the first byte of the response arriving. It covers DNS resolution, the TCP and TLS handshakes, and whatever the server did before it started answering — database queries, template rendering, an upstream API call.

Cache headers on static assets

This check looks at the static assets a page loaded — stylesheets, scripts, images, fonts — and asks whether each one came back with a Cache-Control header that lets the browser keep it.

Modern image formats

This check looks at the images a page actually loaded and counts the ones still served as PNG or JPEG where a modern format would do the same job smaller.

Content-Security-Policy header

Content-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.

Strict-Transport-Security (HSTS) header

Strict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

Clickjacking protection

Clickjacking protection stops another site from loading yours inside an invisible <iframe> and tricking a visitor into clicking something they didn't mean to. It's enforced with either the X-Frame-Options header or a Content-Security-Policy frame-ancestors directive.

X-Content-Type-Options header

X-Content-Type-Options: nosniff tells the browser to trust the Content-Type header a server sends and stop guessing a resource's type from its content.

Mixed content

Mixed content is any http:// resource — a script, stylesheet, image or iframe — loaded on a page served over https://. The page itself is encrypted; the mixed-content resource is not.

SSL certificate validity

This checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.

SPF record

SPF (Sender Policy Framework) is a DNS TXT record on a domain's apex that lists which mail servers are authorized to send email as that domain. A receiving mail server checks the sending IP against this list before accepting a message.

DMARC record

DMARC is a DNS TXT record at _dmarc.<domain> that tells receiving mail servers what to do with a message that fails SPF or DKIM authentication, and where to send reports about it. Its policy value — p=none, p=quarantine or p=reject — sets how strictly that's enforced.

HTTPS

This check reads the scheme of the URL that was scanned and fails when it is http rather than https. It is the first security check to run, and when it fails the rest are skipped — there is no useful question to ask about a Content-Security-Policy header on a connection anyone can rewrite in transit.

Color contrast

This reads Lighthouse's own color-contrast audit: whether text has enough contrast against its background, judged by the WCAG formula rather than eyeballed. The threshold is 4.5:1 for normal text and 3:1 for large text (18pt+, or 14pt+ bold).

Form field labels

This checks that every form field has an associated label — a <label> with a for attribute matching the field's id, or the input nested inside the label — read from Lighthouse's rendered-DOM audit rather than the raw HTML, so it catches labels missing at render time as well as in markup.

The lang attribute on <html>

The lang attribute on the <html> element declares the document's primary language, as a BCP 47 tag: lang="en", lang="en-GB", lang="pt-BR". This check reads the served HTML and fails when the attribute is missing or empty.

Viewport meta tag

The viewport meta tag tells a mobile browser how wide to consider the page. This check fails when the tag is missing, and also when it is present but does not set width=device-width.

Tap target size

This check measures the rendered size of interactive elements — links, buttons, form controls — and the gaps between them, flagging anything smaller than 44 by 44 pixels or closer than 8 pixels to its neighbour.