Methodology
Every assertion,
written down.
A score is only worth something if you can see what produced it. Here are all 77 checks the scanner runs — 74 on every page you scan, and 3 more that compare pages with each other when a scan crawls — grouped by category, with the severity each one carries. Scanner v2.1.0.
How a scan runs
Your HTML, plus a Lighthouse run by Google
What that means, plainly
1 page free, 60 seconds
412px phone emulation
5 scans an hour, per IP
6 things that are not pass or fail
A check can also be skipped
Performance
20 checksCore Web Vitals, page weight and delivery
The metric checks are graded, not pass/fail: past the first threshold the finding carries a medium weight, past the second a high one. Under the first, nothing is reported at all. Lab metrics come from a Lighthouse run Google performs on their own infrastructure, so you can reproduce them at pagespeed.web.dev; the field metrics are Chrome's 75th percentile across real visits.
Largest Contentful Paint is slow
Cumulative Layout Shift is high
Total Blocking Time is high
Page load time is slow
Speed Index is slow
Time to First Byte is slow
First Contentful Paint is slow
Real users see slow Largest Contentful Paint
Real users see slow Interaction to Next Paint
Real users see high Cumulative Layout Shift
Real users see slow Time to First Byte
Large page weight
High request count
Text resources served without compression
Render-blocking resources in the document head
Static assets missing cache headers
Images served as PNG or JPEG with no WebP or AVIF anywhere
High DOM node count
JavaScript appears unminified
CSS appears unminified
Usability
3 checksMobile rendering and navigation
Missing viewport meta tag, or one without width=device-width
Page content wider than the mobile viewport
Tap targets too small or too close together
What these mean, and how to fix them
QA & Structural
4 checksBroken links and dead assets
Page failed to load, or returned a 4xx or 5xx status
Broken stylesheet or script resource
Broken image resource
Broken link
What these mean, and how to fix them
SEO
27 checksMetadata, indexing, duplicates
Missing title tag
Page blocks indexing via meta robots
robots.txt disallows all crawling
AI crawlers are blocked in robots.txt
No structured data, or structured data that does not parse
Structured data is missing a property its type requires
No llms.txt
Page content only exists after JavaScript runs
Missing meta description
Missing H1
Images missing alt text
www and non-www do not resolve to one canonical host
Duplicate title or meta description across pages
A crawled page returned a 4xx, 5xx or a redirect chain
Pages in the sitemap that no crawled page links to
Title length outside 10 to 60 characters
Meta description length outside 50 to 160 characters
Multiple H1 tags
Missing canonical tag
Missing or incomplete Open Graph tags
Missing Twitter Card tags
Missing charset declaration
Missing favicon
Skipped heading level
No custom 404 page
robots.txt not reachable
sitemap.xml not found
What these mean, and how to fix them
Security
10 checksCertificates, response headers and email spoofing
Site does not use HTTPS
SSL certificate is expired, expiring, or does not match the hostname
Mixed content: an HTTP resource on an HTTPS page
Missing Strict-Transport-Security header
Missing clickjacking protection
No SPF record, or more than one
No DMARC record, or a policy of p=none
Missing Content-Security-Policy header
Missing X-Content-Type-Options header
No DKIM key at the common selectors
Accessibility
13 checksContrast, labels and semantics
Most of these are Lighthouse's own accessibility audits, read out of the same Google run that supplies the performance numbers — contrast and ARIA verdicts need a rendered page and a layout pass, which a scan that launches no browser cannot do for itself. They skip rather than fail when that run is unavailable. The last two read the HTML directly, so they always run. This is an automated pass and it is not a substitute for testing with a screen reader: it catches the mechanical failures, not whether the page is actually usable.
Text does not meet minimum contrast against its background
Form controls have no associated label
Links have no discernible text
Buttons have no accessible name
Images are missing an alt attribute
The html element has no lang attribute
Heading levels are skipped or out of order
An ARIA role is missing a required attribute
An ARIA attribute has an invalid value
The viewport tag disables zooming
List markup is malformed
No lang attribute in the served HTML
An element uses a positive tabindex
What these mean, and how to fix them
How the score works
a weighted pass rateEvery check carries a weight set by its severity. A category’s score is the share of that weight it passed — fail half the weight in Security and Security scores 50. The number at the top is those 6 category scores averaged, weighted so the categories that cost a business money count for more: Security 22%, Performance 22%, QA & Structural 18%, SEO 16%, Accessibility 12%, Usability 10%. The weights total 100.
Two rules sit on top. A critical finding caps the whole score at 49, and a high one caps it at 79 — so no site can read “Good” while serving an expired certificate, however many small checks it passes. When a cap is what is holding your score down, the report says so.
Checks that could not run are excluded from both sides, so a skipped check never quietly counts as a pass. And a fault is counted once however many pages it appears on: a missing meta description across ten pages is one problem, not ten. That last point is why unlocking the crawl shows you more issues without collapsing your score.
weight 15
weight 8
weight 4
weight 1
Tiers
80-100 Good·50-79 Needs work·0-49 Poor
The full site audit: 360 checks on every page
paid engagementsThe free scan above looks at one page in depth. The site audit, on a paid engagement, crawls a whole site and runs these checks on every page it finds, then the ones that need the whole crawl: duplicates, broken links, redirect chains, orphan pages, canonical and hreflang targets, and whether the sitemap agrees with the site. Accessibility checks name their WCAG 2.2 success criterion and level; they are the part of WCAG a crawler can decide from a page, which is not all of it.
Response codes (17)
- Internal page returns a client error (4xx)
- Internal page not found (404)
- Internal page gone (410)
- Internal page forbidden (403)
- Internal page needs a login (401)
- Server refused the crawler: too many requests (429)
- Internal page returns a server error (5xx)
- No response (timed out or refused)
- Blocked by robots.txt
- Link to another site is broken (4xx)
- Link to another site returns a server error (5xx)
- Link to another site did not respond
- Slow response (over 1 second to first byte)
- Very slow response (over 3 seconds to first byte)
- Soft 404: answers 200 but reads as "not found"
- Image does not load (4xx/5xx)
- No Content-Type header
Redirects (13)
- Internal address redirects
- Temporary redirect (302, 303 or 307)
- Redirect chain (two or more hops)
- Redirect loop
- Redirects to a broken page
- Redirects to a page that is not indexable
- Meta refresh redirect
- JavaScript redirect
- The http:// version does not redirect to https://
- Both www and non-www versions answer
- Page links to addresses that redirect
- Internal address redirects to another site
- Redirect only adds or removes a trailing slash
Security (22)
- Page served over plain HTTP
- Mixed content: HTTP resources on an HTTPS page
- Form sends to an HTTP address
- Password field on an HTTP page
- Links to other sites open a new tab without rel="noopener"
- Protocol-relative resource addresses (//host/...)
- No Strict-Transport-Security header
- HSTS lasts less than six months
- No Content-Security-Policy
- Content-Security-Policy allows 'unsafe-inline' scripts
- No X-Content-Type-Options: nosniff
- Page can be framed by any site (clickjacking)
- No Referrer-Policy
- No Permissions-Policy
- Server header reveals the software version
- X-Powered-By header reveals the platform
- Cookie set without Secure
- Cookie set without HttpOnly
- Cookie set without SameSite
- Script from another site without integrity (SRI)
- Links to the http:// version of your own pages
- HTML page allows any site to read it (Access-Control-Allow-Origin: *)
URLs (15)
- Address contains non-ASCII characters
- Address uses underscores
- Address contains capital letters
- Address contains repeated slashes
- Address repeats a folder
- Address contains a space
- Internal search results page
- Address has query parameters
- Address over 115 characters
- Internal link carries tracking parameters (utm_ and similar)
- Address contains a session id
- Link points to a #fragment that is not on the page
- Page answers both with and without a trailing slash
- Page answers under addresses differing only in case
- Address is double-encoded (%25)
Page titles (13)
- Page title missing
- Page title empty
- Page title used on more than one page
- Page title over 60 characters
- Page title under 30 characters
- Page title wider than 561 pixels in results
- Page title narrower than 200 pixels
- Page title identical to the H1
- More than one title on the page
- Title outside the <head>
- Page title repeats a word three or more times
- Page title is generic (Home, Untitled, Index)
- Page title is all capitals
Meta descriptions (10)
- Meta description missing
- Meta description empty
- Meta description used on more than one page
- Meta description over 155 characters
- Meta description under 70 characters
- Meta description wider than 985 pixels
- Meta description narrower than 400 pixels
- More than one meta description
- Meta description outside the <head>
- Meta description repeats the title
Meta keywords (3)
- Meta keywords tag present
- More than one meta keywords tag
- Same meta keywords on more than one page
H1 (7)
- No H1
- H1 is empty
- H1 used on more than one page
- H1 over 70 characters
- More than one H1
- H1 is only an image (its alt text)
- The first heading is not the H1
H2 (5)
- No H2
- Same H2 on more than one page
- H2 over 70 characters
- Empty H2
- An H2 comes before the H1
Heading structure (4)
- Heading levels skipped (e.g. H2 to H4)
- Heading over 150 characters
- More than 50 headings
- No headings at all
Content (12)
- Exact duplicate of another page
- Nearly the same as another page (about 90% or more)
- Low content (under 200 words)
- Page has no visible text
- Hard to read (Flesch reading ease under 50)
- Very hard to read (Flesch reading ease under 30)
- Placeholder text (lorem ipsum)
- Unfinished page ("coming soon", "TODO", "[insert")
- Possible spelling mistakes (English pages)
- Little text compared to code (under 10%)
- Long sentences (over 25 words on average)
- A paragraph appears more than once on the page
Images (13)
- Image without an alt attribute
- Alt text over 100 characters
- Alt text is a file name
- Alt text starts with "image of" or similar
- Image without width and height
- Image over 100 KB
- Image over 1 MB
- Image in JPEG, PNG or GIF only
- Many images, none lazy-loaded
- First image is lazy-loaded
- Image address redirects
- Large image without srcset
- More than 100 images on the page
Canonicals (15)
- Indexable page without a canonical
- More than one canonical
- Canonicals that disagree
- Canonical points to another page
- Canonical points to a broken page
- Canonical points to a page that is not indexable
- Canonical points to an address that redirects
- Canonical is a relative address
- Canonical outside the <head>
- Canonical target is not linked from the site
- Canonical is not a valid address
- Canonical points to http:// on an https:// site
- Canonical points to another domain
- Canonical in the HTTP header disagrees with the page
- Canonical points to a page that itself canonicalises elsewhere
Pagination (6)
- Pagination link points to a broken page
- Pagination address not linked in the page
- Pagination points to a non-indexable page
- More than one rel=next or rel=prev
- Pagination points to itself
- Pagination sequence does not match (next's prev is not this page)
Directives (17)
- Page is noindex
- Page is nofollow
- Page is robots=none (noindex, nofollow)
- noarchive
- nosnippet: no text shown in results or AI overviews
- max-snippet limits the result text
- max-image-preview limits image previews
- max-video-preview limits video previews
- noimageindex
- notranslate
- unavailable_after set
- Obsolete directive (noodp, noydir)
- X-Robots-Tag header says noindex
- Robots directives disagree (meta and header, or two metas)
- More than one robots meta tag
- noindex page listed in the sitemap
- Page blocked by robots.txt is in the sitemap
Hreflang (13)
- Hreflang points to a broken page
- Hreflang address not linked from the site
- Hreflang has no return link
- Return link uses a different language code
- Hreflang points to a non-canonical page
- Hreflang points to a noindex page
- Invalid language or region code
- The same language code points to different pages
- Hreflang does not include the page itself
- No x-default
- Hreflang outside the <head>
- Hreflang uses a relative address
- Hreflang points to an address that redirects
JavaScript rendering (15)
- Most text appears only after JavaScript runswith JavaScript rendering
- Links appear only after JavaScript runswith JavaScript rendering
- JavaScript changes the titlewith JavaScript rendering
- Title appears only after JavaScript runswith JavaScript rendering
- JavaScript changes the meta descriptionwith JavaScript rendering
- JavaScript changes the H1with JavaScript rendering
- H1 appears only after JavaScript runswith JavaScript rendering
- JavaScript changes the canonicalwith JavaScript rendering
- Canonical appears only after JavaScript runswith JavaScript rendering
- Served HTML says noindex; JavaScript removes itwith JavaScript rendering
- JavaScript adds noindexwith JavaScript rendering
- JavaScript changes nofollowwith JavaScript rendering
- JavaScript errors in the consolewith JavaScript rendering
- Resources failed to load while renderingwith JavaScript rendering
- Uses the old #! AJAX crawling scheme
Links (21)
- No links to other pages on the site
- Internal link with no text
- Link text like "click here" or "read more"
- More than 100 links to other sites
- More than 500 internal links
- Internal links marked nofollow
- Page is only linked with nofollow
- Same page linked with and without nofollow
- Four or more clicks from the start page
- Orphan page: in the sitemap but not linked from any crawled page
- Only one internal link points here
- Page links to broken internal pages
- Page links to broken pages on other sites
- Link with an empty href
- Link with a javascript: href
- Link address is malformed
- Link to localhost or a development address
- mailto: link with an invalid address
- tel: link with an invalid number
- Links to pages that are noindex
- Anchor without href used as a link
Structured data (14)
- No structured data
- JSON-LD that does not parse
- JSON-LD without a schema.org @context
- JSON-LD item without @type
- Structured data missing required properties
- Structured data missing recommended properties
- Date in structured data is not ISO 8601
- Address in structured data is not absolute
- Empty value in structured data
- Rating outside its scale
- More than one Organization description
- Type with restricted rich results (FAQPage, HowTo)
- Microdata vocabulary is not schema.org
- Deep page without BreadcrumbList
Sitemaps (14)
- No XML sitemap found
- Sitemap not listed in robots.txt
- Sitemap is not valid XML
- Sitemap over 50,000 addresses
- Sitemap over 50 MB
- Sitemap lists broken pages
- Sitemap lists pages that are not indexable (noindex or canonicalised)
- Sitemap lists addresses that redirect
- Sitemap lists another domain's pages
- Invalid lastmod date
- lastmod in the future
- Address listed in more than one sitemap
- Indexable page not in the sitemap
- Sitemap lists http:// addresses on an https:// site
Performance (14)
- HTML over 500 KB
- HTML not compressed
- Scripts in the <head> block rendering
- More than three stylesheets block rendering
- More than 30 scripts
- More than 10 stylesheets
- Over 50 KB of inline script
- Over 50 KB of inline CSS
- Over 1,500 elements
- Over 3,000 elements
- Resources from more than 10 other sites
- Uses document.write
- More than five iframes
- Fonts from another site without preconnect
Mobile (8)
- No viewport meta tag
- Viewport is not width=device-width
- Viewport set to a fixed width
- Text set under 12px
- Uses plugins (Flash, Java applets, <embed>)
- No apple-touch-icon
- No favicon
- No web app manifest
HTML validation (17)
- No <!DOCTYPE html>
- Old doctype (not HTML5)
- No character encoding declared
- Character encoding is not UTF-8
- Charset declared after the first 1,024 bytes
- More than one <head>
- More than one <body>
- No <head> element
- No <body> element
- Body elements inside the <head>
- Duplicate id attributes
- HTML over 15 MB
- Obsolete elements (font, center, marquee ...)
- A form inside a form
- Element with an empty src
- Content before the <head>
- Unclosed HTML comment
Accessibility (WCAG 2.2) (65)
- Image has no text alternativeWCAG 1.1.1 (A)
- Image button has no text alternativeWCAG 1.1.1 (A)
- Image-map area has no text alternativeWCAG 1.1.1 (A)
- SVG with role=img has no nameWCAG 1.1.1 (A)
- <object> has no text alternativeWCAG 1.1.1 (A)
- Element with role=img has no nameWCAG 1.1.1 (A)
- Alt text repeats the text next to it
- Form field has no labelWCAG 4.1.2 (A)
- Drop-down has no labelWCAG 4.1.2 (A)
- Button has no accessible nameWCAG 4.1.2 (A)
- Link has no accessible nameWCAG 2.4.4 (A)
- Frame has no titleWCAG 4.1.2 (A)
- Frames share a title
- Page language not setWCAG 3.1.1 (A)
- Page language is not a valid codeWCAG 3.1.1 (A)
- Part of the page has an invalid langWCAG 3.1.2 (AA)
- Page has no titleWCAG 2.4.2 (A)
- An id used by ARIA or a label is not uniqueWCAG 4.1.2 (A)
- Unknown ARIA attributeWCAG 4.1.2 (A)
- Invalid ARIA roleWCAG 4.1.2 (A)
- ARIA role missing a required attributeWCAG 4.1.2 (A)
- aria-hidden on the <body>WCAG 4.1.2 (A)
- Focusable element inside aria-hiddenWCAG 4.1.2 (A)
- aria-labelledby or aria-describedby points to a missing idWCAG 1.3.1 (A)
- Positive tabindexWCAG 2.4.3 (A)
- Media plays sound automaticallyWCAG 1.4.2 (A)
- Video without a captions trackWCAG 1.2.2 (A)
- Page refreshes or redirects on a timerWCAG 2.2.1 (A)
- Page redirects with a meta refreshWCAG 2.2.4 (AAA)
- Zooming is disabledWCAG 1.4.4 (AA)
- Blinking or scrolling text (blink, marquee)WCAG 2.2.2 (A)
- Data table without header cellsWCAG 1.3.1 (A)
- Invalid scope on a header cellWCAG 1.3.1 (A)
- Empty headingWCAG 1.3.1 (A)
- Heading levels skipped
- No level-one heading
- No way to skip repeated contentWCAG 2.4.1 (A)
- No single <main> landmark
- Link text does not say where it goesWCAG 2.4.9 (AAA)
- Same link text goes to different placesWCAG 2.4.9 (AAA)
- Link opens a new window without saying soWCAG 3.2.5 (AAA)
- Personal-data field without autocompleteWCAG 1.3.5 (AA)
- Invalid autocomplete valueWCAG 1.3.5 (AA)
- Text colour contrast under 4.5:1 (inline styles)WCAG 1.4.3 (AA)
- Text colour contrast under 7:1 (inline styles)WCAG 1.4.6 (AAA)
- Justified textWCAG 1.4.8 (AAA)
- Abbreviation without its expansionWCAG 3.1.4 (AAA)
- Text needs more than lower-secondary reading abilityWCAG 3.1.5 (AAA)
- Choosing an option changes the pageWCAG 3.2.2 (A)
- Form with no submit buttonWCAG 3.2.2 (A)
- Click target smaller than 24 by 24 pixels (inline styles)WCAG 2.5.8 (AA)
- Focus outline removedWCAG 2.4.7 (AA)
- Password field blocks pasting or password managersWCAG 3.3.8 (AA)
- Placeholder used instead of a labelWCAG 3.3.2 (A)
- Clickable element that keyboards cannot reachWCAG 2.1.1 (A)
- List item outside a listWCAG 1.3.1 (A)
- Definition term or description outside a <dl>WCAG 1.3.1 (A)
- Interactive element inside anotherWCAG 4.1.2 (A)
- Radio buttons without a group labelWCAG 1.3.1 (A)
- Label points to a field that does not existWCAG 1.3.1 (A)
- Decorative image with alt text
- Duplicate accesskey
- Server-side image mapWCAG 2.1.1 (A)
- Help or contact link missing here but on most pagesWCAG 3.2.6 (A)
- Only one way to find pagesWCAG 2.4.5 (AA)
AI search readiness (7)
- No llms.txt
- llms.txt has no heading or links
- robots.txt blocks AI search crawlers
- Served HTML has almost no text (AI crawlers do not run JavaScript)
- Article without an author
- Article without a published or updated date
- noai or noimageai directive
See it against a site you know.
Pick something you did not build. The checks read the same either way.
Run a scan