Plain-English answers to the things the free website check looks at: what each one means, why it matters, how to check it and how to fix it.
Yes. HTTPS encrypts the connection between a visitor and your site, so nobody on the same network can read or alter what passes between them. Browsers label plain HTTP pages “Not secure” next to the address, which is a poor first impression for any business, and certificates have been free for years.
Page weight is the total amount a visitor’s browser must download to show the page: the page itself plus every image, script, font and stylesheet. Under 1.5 MB loads comfortably on a 4G connection. Over 3 MB, visitors on phones will wait several seconds, and the average small business page is now heavier than that.
Any site can put your pages inside a frame on its own page, and attackers use this for clickjacking: your login form or a “confirm” button is loaded invisibly over something else, so a visitor clicks it without knowing. The X-Frame-Options header, or the frame-ancestors rule in a content security policy, tells browsers to refuse to display your pages inside other sites. Unless you deliberately embed your pages elsewhere, set it to deny.
Every image, script, font and stylesheet on a page is a separate request to a server. A lean business page loads between twenty and forty files. Pages that load eighty or a hundred feel sluggish even when each file is small, because the browser can only fetch a few at once and each has its own overhead.
One. The H1 is the main heading of the page, the strongest signal to search engines and to screen readers of what the page is about. No H1 leaves that unsaid; several H1s dilute it and usually mean the heading tags are being used for styling rather than structure. Use H2 for sections and H3 within them, and style them however you like.
A robots.txt containing “User-agent: *” followed by “Disallow: /” tells every search engine to stay out of the entire site. Nothing will be crawled and nothing new will be listed, no matter how good the content. It is the single most damaging line a site can contain, and it is nearly always a leftover from the site being built in private.
WordPress adds a “generator” meta tag to every page stating its version number, and attackers scan for old versions with known holes. The better answer is to keep WordPress updated so the version does not matter, but removing the tag also stops you being singled out. It is a two-line addition to the theme or a tick box in most security plugins.
Yes, for almost every photo. WebP and AVIF are modern image formats that are around thirty per cent smaller than JPEG or PNG at the same visible quality. Every modern browser supports WebP, and smaller images mean faster pages, particularly on phones. Most platforms can convert on upload, so it costs nothing to switch.
Landmarks are the HTML elements that mark the regions of a page: header, nav, main and footer. Screen reader users can jump straight to the main content instead of hearing the menu on every page, and a “skip to content” link does the same for keyboard users. Modern HTML makes this almost free: wrap the main content in a main element and the menus in nav.
A redirect tells the browser “the page has moved, go here instead”. One redirect is normal, for example sending www to non-www or http to https. A redirect chain is when the destination redirects again, and again, and each hop is a full round trip to the server before the real page can even be requested.
When a check reports that a page could not be read properly, it usually means the HTML is so malformed, or so far from what a page normally looks like, that an automated reader could not make sense of it. Browsers are forgiving and will usually display something, but search engines and assistive technology are less so, and a page that cannot be read reliably cannot be understood reliably.
Browsers sometimes guess what kind of file they have received, and a guess can be exploited: a file uploaded as an image could be run as a script. The X-Content-Type-Options header, set to “nosniff”, tells the browser to trust the type the server declared and never guess. It is a single line of configuration with no visible effect on a working site, which is exactly why it is so often missing.
The same page can often be reached at several addresses: with and without www, with a trailing slash, with a tracking code on the end. To search engines these can look like duplicate pages competing with each other. A canonical tag names the one official address. It is a single line in the page head and most platforms add it automatically, but it is worth checking it points to the right version.
A content security policy, usually shortened to CSP, is a list of places your pages are allowed to load scripts, styles, images and fonts from. If an attacker manages to inject a script from elsewhere, the browser refuses to run it. It is the most effective defence against cross-site scripting and also the most involved header to set up, so it is the one most sites lack.
The meta description is the grey text under your listing in search results. It does not affect ranking directly, but it decides whether people click. Without one, Google picks a sentence from the page, which is rarely the one you would choose. Write 50 to 160 characters that say what the page offers and why someone should click, and give each page its own.
The title tag is the blue headline of your listing in Google and the name on the browser tab. It is the single most important line of text on the page for search. Between 10 and 60 characters shows in full; longer titles are cut off with an ellipsis. A good title says what the page is and where you are, and every page should have a different one.
When a visitor clicks a link from your site to another, the browser tells the other site where the visitor came from. By default that can include the full address of the page they were on, which might contain a customer’s order number, a search term or a private link. A referrer policy limits what is shared. For most business sites the right setting is “strict-origin-when-cross-origin”, which shares only your domain, not the page.
Alt text is a short description of an image in the page code. Screen readers read it aloud to blind and partially sighted visitors, Google Images indexes it, and it appears in place of the image if the file fails to load. Describe what the image shows and why it is there. Purely decorative images should have an empty alt attribute so screen readers skip them. Missing alt text is the most common accessibility failure on the web.
An XML sitemap is a machine-readable list of every page on your site with the date each last changed. Search engines can find your pages without one by following links, but a sitemap helps them find new pages sooner and not miss any. WordPress generates one automatically at /wp-sitemap.xml, and every site should submit its sitemap in Google Search Console.
When a browser downloads an image, script or stylesheet, it can keep a copy on the visitor’s device. Cache headers sent by your server tell it how long that copy is good for. With sensible headers, a visitor’s second page and their next visit load almost instantly, because most of the files are already there.
Gzip and Brotli are ways for a server to squeeze text files before sending them, so the browser downloads far less and expands the file on arrival. The page itself, its scripts and its stylesheets are all text, and they typically shrink by around seventy per cent. It is a single server setting that makes every page on the site faster.
HSTS, which stands for HTTP Strict Transport Security, is a header your server sends telling browsers to use https for your site for a set period without ever trying http first. It closes the small window in which a visitor’s first request could be intercepted and downgraded. It is one line of configuration, and any site that already works fully over https should use it.
Lazy loading tells the browser not to download images further down the page until the visitor scrolls towards them. The top of the page appears sooner, visitors who never scroll never download the rest, and a long page with thirty photos costs no more to open than a short one.
Mixed content is when a secure (https) page loads some of its images, scripts or styles over plain http. Browsers respond by removing the padlock, showing a warning, or blocking the insecure file altogether, which can break layouts and features. It usually comes from old content, and the fix is to update the addresses.
robots.txt is a small text file at the root of your site, at yourdomain.co.uk/robots.txt, that tells search engines which parts to skip and where to find your sitemap. Most business sites need very little in it, but search engines look for it on every visit and a missing file is a small mark against you. The danger is the opposite: a robots.txt that blocks the entire site.
Structured data is a block of machine-readable detail added to a page: what the business is, where it is, its opening hours, its reviews. Google uses it to understand the page and, sometimes, to show richer listings. For a local business the LocalBusiness type is the one that matters, because it reinforces your Google Business Profile and helps with map results.
One file often accounts for more of a page’s weight than everything else combined: a hero photo saved at full camera resolution, a background video, or a bloated script bundle. Finding that one file is the quickest way to make a page faster, because fixing it can halve the download in a few minutes.
Every domain name is rented, not owned outright: it is registered for a fixed term, usually one to ten years, and has to be renewed before the term ends. The expiry date is public. Type your domain into our free domain check, or look at the registry record with any WHOIS or RDAP tool, and it shows who the domain is registered with, when it was registered and when it runs out. If you are within sixty days, renew it now.
When a check reports that a site could not be reached, it means the request either got no answer at all, was refused, timed out, or came back with an error status such as 500 or 503. Sometimes it is a passing blip, but if a scanner cannot reach the site, some real visitors and search engines probably cannot either. Try the address in a browser, then on a phone using mobile data rather than your own wireless.
A label is the visible text tied to a form field in the code, so that a screen reader announces “Email address” when the field gets focus, and so that clicking the text puts the cursor in the field. Placeholder text inside the field is not a label: it disappears the moment someone starts typing, and screen readers often ignore it. Every field should have a label element linked to it.
Headings are the outline of a page. Screen reader users jump between them the way sighted people skim, and a level skipped, such as an H2 followed straight by an H4, makes the outline confusing. Search engines read the same structure. Use one H1, H2 for sections, H3 within them, and never choose a heading level for its size.
When someone shares your link, the app builds a preview card from Open Graph tags in the page: the title, a description and, most importantly, an image. Without them you get a bare link or a random picture from the page. Set a title, a description and a 1200 by 630 pixel image for every page, and most SEO plugins add the tags for you.
If an image has no width and height set in the page, the browser does not know how much space to leave for it. The text appears, then the image arrives and shoves everything down. On a phone that means the button you were about to tap moves and you tap something else. Google calls this cumulative layout shift and measures it as one of its three Core Web Vitals.
Without a viewport tag, a phone assumes the page was designed for a desktop and shrinks the whole thing to fit, leaving visitors pinching and zooming to read. The tag is one line in the page head that tells the phone to use its real width. Every modern theme includes it; its absence means the site predates mobile design or the theme has been edited by hand.
Screen readers can list every link on a page on its own, out of context. A list that reads “click here, click here, read more, here” tells the visitor nothing. Google also reads link text to understand what the destination page is about. Make the link the meaningful words: “see our kitchen gallery” rather than “to see our gallery, click here”.
One common reason is a “noindex” instruction on the page, telling search engines not to list it. It is correct for private pages and a disaster for a home page. It is very often a leftover from the site being built in private, where the developer switched search engines off and forgot to switch them back on. In WordPress the setting is under Settings, Reading, “Discourage search engines from indexing this site”.
When you open a page, the first thing that happens is a wait: your browser asks the server for the page and the server has to build it and send it back. That wait is the server response time, and it sits in front of everything else on the page. Under half a second feels instant. Over a second, people notice. Over two, they start to leave.
The lang attribute on the html tag tells browsers, screen readers and search engines what language the page is written in. Screen readers use it to choose the right voice and pronunciation. Search engines use it to show the page to people searching in that language. For a British site the value is “en-GB”, and most platforms set it from the site’s language setting.
Almost nobody types https. They type the bare address, or click an old link, and the browser may try plain http first. If your server does not redirect that request to the secure version, the visitor stays on an insecure page with the “Not secure” label, even though a secure version exists. The redirect is a one-line server rule.
Servers often announce themselves in the response headers: “Apache/2.4.41 (Ubuntu)” or “X-Powered-By: PHP/7.4.3”. To an attacker that is a shopping list. Every version has a published set of known weaknesses, and automated scanners look for exactly these strings. Hiding the version does not fix a weakness, but it stops you being singled out by the cheapest kind of attack.