Methodology

Every assertion,
written down.

A score is only worth something if you can see what produced it. Here are all 58 checks the scanner runs, in the order it runs them, and the severity each one carries.

How a scan runs

engine

Your HTML, plus a Lighthouse run by Google

The free scan reads the HTML your server sends and checks it directly, and asks Google’s PageSpeed Insights to render the page for the measurements that genuinely need a browser — Core Web Vitals, layout width, tap targets and the screenshot. Those numbers are Google’s, not ours, and you can reproduce them at pagespeed.web.dev.
limits

What that means, plainly

Anything a script builds after the page loads is not in the HTML we read, so the structural checks see what your server sent rather than what a browser finally shows. Google’s render covers that ground where the two overlap. The crawl drives a real browser and sees everything.
budget

1 page free, 60 seconds

The entered page gets the full check battery, fully free. An email unlocks a crawl of up to 10 more same-origin pages under a 90-second budget. The two differ because the free scan waits on Google while the crawl drives a browser across ten pages.
viewport

412px phone emulation

The mobile checks are judged from a render at a phone viewport, not inferred from a media query.
limit

5 scans an hour, per IP

Enough to check a site, fix something, and check it again.
evidence

4 things that are not pass or fail

The mobile screenshot, the breakdown of what the page loaded, Google’s Lighthouse category scores and the 25-week history of real-user metrics are evidence, not assertions. They are shown in the report but deliberately kept out of the passed/failed tally below, which counts only things that can be right or wrong.
skipped

A check can also be skipped

Some checks need data that is not always there — real-user metrics need enough Chrome traffic, the cross-page checks need the crawl, and the Google-sourced ones need Google to answer. A skipped check is reported as skipped and counts toward neither passed nor failed, so the tally never flatters a scan by counting a check it could not actually run.

Performance

20 checks

Core Web Vitals, page weight and delivery

The metric checks are graded, not pass/fail: past the first threshold the finding carries a medium weight, past the second a high one. Under the first, nothing is reported at all. Lab metrics come from a Lighthouse run Google performs on their own infrastructure, so you can reproduce them at pagespeed.web.dev; the field metrics are Chrome's 75th percentile across real visits.

[high]

Largest Contentful Paint is slow

Medium over 2.5s, high over 4s.
[high]

Cumulative Layout Shift is high

Medium over 0.1, high over 0.25.
[high]

Total Blocking Time is high

Medium over 200ms, high over 600ms. The lab-measurable stand-in for INP.
[high]

Page load time is slow

Medium over 3s, high over 6s. No official threshold exists for this one; these follow the usual web-perf convention.
[medium]

Speed Index is slow

Medium over 3.4s, high over 5.8s.
[medium]

Time to First Byte is slow

Medium over 800ms, high over 1.8s.
[medium]

First Contentful Paint is slow

Medium over 1.8s, high over 3s.
[high]

Real users see slow Largest Contentful Paint

Chrome's 75th percentile over the trailing 28 days. Skipped when the origin has too little traffic to report.
[high]

Real users see slow Interaction to Next Paint

Over 200ms at the 75th percentile. INP, not the retired FID.
[high]

Real users see high Cumulative Layout Shift

Over 0.1 at the 75th percentile.
[medium]

Real users see slow Time to First Byte

Over 800ms at the 75th percentile.
[medium]

Large page weight

Over 3MB transferred.
[low]

High request count

Over 100 requests.
[medium]

Text resources served without compression

[medium]

Render-blocking resources in the document head

[low]

Static assets missing cache headers

[low]

Images served as PNG or JPEG with no WebP or AVIF anywhere

[low]

High DOM node count

Over 1500 elements.
[low]

JavaScript appears unminified

[low]

CSS appears unminified

Usability

3 checks

Mobile rendering and navigation

[high]

Missing viewport meta tag, or one without width=device-width

[medium]

Page content wider than the mobile viewport

Judged from a render at a 412px phone viewport.
[low]

Tap targets too small or too close together

Against the 48x48px guidance.

Structural

4 checks

Broken links and dead assets

[critical]

Page failed to load, or returned a 4xx or 5xx status

[high]

Broken stylesheet or script resource

[medium]

Broken image resource

[medium]

Broken link

Up to 15 same-origin links per page, HEAD first and GET if HEAD is refused.

SEO

21 checks

Metadata, indexing, duplicates

[high]

Missing title tag

[high]

Page blocks indexing via meta robots

[high]

robots.txt disallows all crawling

[medium]

Missing meta description

[medium]

Missing H1

[medium]

Images missing alt text

[medium]

www and non-www do not resolve to one canonical host

[medium]

Duplicate title or meta description across pages

Crawl only.
[medium]

A crawled page returned a 4xx, 5xx or a redirect chain

Crawl only.
[low]

Title length outside 10 to 60 characters

[low]

Meta description length outside 50 to 160 characters

[low]

Multiple H1 tags

[low]

Missing canonical tag

[low]

Missing or incomplete Open Graph tags

[low]

Missing Twitter Card tags

[low]

Missing charset declaration

[low]

Missing favicon

[low]

Skipped heading level

[low]

No custom 404 page

[low]

robots.txt not reachable

[low]

sitemap.xml not found

Security

10 checks

Certificates, response headers and email spoofing

[critical]

Site does not use HTTPS

[critical]

SSL certificate is expired, expiring, or does not match the hostname

[high]

Mixed content: an HTTP resource on an HTTPS page

[medium]

Missing Strict-Transport-Security header

[medium]

Missing clickjacking protection

Either X-Frame-Options or a CSP frame-ancestors directive satisfies this.
[medium]

No SPF record, or more than one

Without SPF anyone can send email claiming to be your domain. Two records is a permanent error at the receiving server, which is worse than none.
[medium]

No DMARC record, or a policy of p=none

p=none monitors and enforces nothing.
[low]

Missing Content-Security-Policy header

[low]

Missing X-Content-Type-Options header

[low]

No DKIM key at the common selectors

Reported as inconclusive rather than failed: selectors are chosen per mail provider and cannot be listed from DNS.

How the score works

a weighted pass rate

Every check carries a weight set by its severity. A category’s score is the share of that weight it passed — fail half the weight in Security and Security scores 50. The number at the top is those five category scores averaged, weighted so the categories that cost a business money count for more: Security and Performance 25% each, QA & Structural and SEO 20% each, Usability 10%.

Two rules sit on top. A critical finding caps the whole score at 49, and a high one caps it at 79 — so no site can read “Good” while serving an expired certificate, however many small checks it passes. When a cap is what is holding your score down, the report says so.

Checks that could not run are excluded from both sides, so a skipped check never quietly counts as a pass. And a fault is counted once however many pages it appears on: a missing meta description across ten pages is one problem, not ten. That last point is why unlocking the crawl shows you more issues without collapsing your score.

[critical]

weight 15

An expired certificate, or a page that will not load at all.
[high]

weight 8

A failing Core Web Vital, or a page telling search engines not to index it.
[medium]

weight 4

A broken link, or a missing security header.
[low]

weight 1

A title two characters too long.

Tiers

80-100 Good·50-79 Needs work·0-49 Poor

See it against a site you know.

Pick something you did not build. The checks read the same either way.

Run a scan