Every check, explained on its own.

Missing title tag

The <title> tag in a page's <head> names the page for browsers, search results and social shares. It's one of the few pieces of a page search engines still treat as an explicit, author-declared signal rather than something inferred from content.

Missing meta description

The meta description is a <meta name="description"> tag summarizing the page in a sentence or two. Search engines usually — not always — use it verbatim as the snippet shown under a result's title.

Canonical tag

A canonical tag (<link rel="canonical">) declares a page's preferred URL when the same content is reachable at more than one address — with and without a trailing slash, with and without a tracking query string, over http and https.

Image alt text

Every <img> should carry an alt attribute: a text description for informative images, or an empty alt="" for images that are purely decorative. This check reads it directly out of the HTML the server sent, so it runs on every scan regardless of whether a rendering engine is available.

Meta robots noindex

The meta robots tag — <meta name="robots" content="..."> — gives per-page instructions to crawlers, most commonly noindex (don't show this page in search results) and nofollow (don't follow links from this page). This check fails when either is set.

Heading hierarchy

Heading hierarchy is whether a page's <h1> through <h6> tags step down one level at a time — an <h2> can be followed by another <h2> or an <h3>, but not by an <h4> with no <h3> in between. This check reads the sequence of heading tags in the order they appear in the HTML.

AI crawler access

This reads robots.txt and checks whether it blocks any of the named AI crawlers — OpenAI's GPTBot and OAI-SearchBot, Anthropic's ClaudeBot and Claude-SearchBot, PerplexityBot, Google-Extended, Common Crawl's CCBot and others — distinct from the general-purpose search crawlers (Googlebot, Applebot) that index for classic search.

Structured data (JSON-LD)

Structured data is a <script type="application/ld+json"> block declaring what a page is, using schema.org vocabulary — Article, Product, Organization, FAQPage and similar types. This check looks for at least one such block that parses as valid JSON and declares a recognizable @type; it isn't a full schema.org validator checking that a given type's required fields are present.

Content that requires JavaScript

This compares the DOM node count and text length in the HTML a server actually sent against the DOM Google's Lighthouse run produces after rendering the page. When the rendered page has several times more nodes than the raw HTML did, and the raw HTML had very little text to begin with, that's the signature of a client-rendered shell rather than a page with real content.

Performance

5 checks

Largest Contentful Paint (LCP)

Largest Contentful Paint (LCP) measures the time from navigation start until the largest image or text block in the viewport has rendered — a stand-in for 'when does this page feel loaded' rather than 'when did the first byte arrive'. It's one of Google's three Core Web Vitals.

Cumulative Layout Shift (CLS)

Cumulative Layout Shift (CLS) scores how much visible content unexpectedly moves during a page's lifetime, weighted by how much of the viewport shifted and how far. A score under 0.1 is good; 0.1-0.25 is graded medium here, above 0.25 is high.

Total Blocking Time (TBT)

Total Blocking Time (TBT) sums how long the main thread was blocked by long tasks (over 50ms) between First Contentful Paint and the page becoming interactive. It's the lab-measurable stand-in this scanner uses for Interaction to Next Paint (INP), which needs real user interaction data that a single-page lab test can't produce.

Text compression

This checks whether text resources — HTML, CSS, JavaScript — are served with gzip or brotli compression via the Content-Encoding header. Resources under about 1.4KB are excluded, matching Lighthouse's own threshold: below that size, compression's header overhead costs more than it saves.

Render-blocking resources

A render-blocking resource is a stylesheet or synchronous script in <head> that the browser must download and process before it can paint anything — the page stays blank until every one of them resolves. This check looks specifically at resources in the document head, the ones the browser encounters before it can render a single pixel.

Security

8 checks

Content-Security-Policy header

Content-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.

Strict-Transport-Security (HSTS) header

Strict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

Clickjacking protection

Clickjacking protection stops another site from loading yours inside an invisible <iframe> and tricking a visitor into clicking something they didn't mean to. It's enforced with either the X-Frame-Options header or a Content-Security-Policy frame-ancestors directive.

X-Content-Type-Options header

X-Content-Type-Options: nosniff tells the browser to trust the Content-Type header a server sends and stop guessing a resource's type from its content.

Mixed content

Mixed content is any http:// resource — a script, stylesheet, image or iframe — loaded on a page served over https://. The page itself is encrypted; the mixed-content resource is not.

critical

SSL certificate validity

This checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.

SPF record

SPF (Sender Policy Framework) is a DNS TXT record on a domain's apex that lists which mail servers are authorized to send email as that domain. A receiving mail server checks the sending IP against this list before accepting a message.

DMARC record

DMARC is a DNS TXT record at _dmarc.<domain> that tells receiving mail servers what to do with a message that fails SPF or DKIM authentication, and where to send reports about it. Its policy value — p=none, p=quarantine or p=reject — sets how strictly that's enforced.

Accessibility

2 checks

Color contrast

This reads Lighthouse's own color-contrast audit: whether text has enough contrast against its background, judged by the WCAG formula rather than eyeballed. The threshold is 4.5:1 for normal text and 3:1 for large text (18pt+, or 14pt+ bold).