Most audit companies show you a designed mock-up of a
report. We would rather show you the real thing, so we pointed our own
engine at our own website and published everything it found —
including the findings it raised against us.
Your site gets the same run. This page is the whole list of
what that means.
Which cookies are actually set, and whether consent is genuinely owed
Whether the policy says how long data is kept
11Hosting and infrastructure
The parts underneath the website.
The HTTPS certificate: valid, trusted, and how long is left on it
Email DNS — SPF, DKIM and DMARC, including whether DMARC actually stops anything
DNSSEC and CAA, and whether DNSSEC is half-configured rather than off
Where it is hosted, and whether anything sits in front of it
www and non-www, http and https — all arriving in one place
12Code quality
What the markup says about how the site was built.
W3C validation errors
Inline styles scattered through the markup
Whether the HTML uses real structure or a wall of divs
Source maps left published, handing out your original code
13Social and reputation
What it looks like when somebody shares it.
Open Graph and Twitter tags, and whether the preview image is really there
Links to profiles that exist, rather than icons pointing nowhere
Review and rating structured data, which is what puts stars in a search result
14Trust and conversion
What a stranger deciding whether to buy actually sees.
Reviews or testimonials — the single strongest thing on a page
A phone number, an email, a contact form, live chat
An address, so the visitor knows a real business is behind it
A returns or refund policy, and an About page
15Local search
Being found by people nearby.
The Business Profile: claimed, complete, rated, and with opening hourswith permission or a key
Whether your name, address and phone match across the web
LocalBusiness structured data, and an embedded map
What a scanner does not do
Every finding is read by a person before you see it
The engine raises them; a person decides which are real, ranks them, and writes the ones that stay. On our own report nine were overruled, each with the reason left in.
The whole site, not one page
Up to sixty pages followed the way a search engine would — orphan pages, redirect chains, dead internal links, duplicate content, and what your sitemap claims against what is actually reachable.
Findings tied to the page they were found on
Not "some images lack alt text" but which images, on which page. A developer can act on the second one.
A check that could not run is never reported as a defect
If something could not be measured it is listed as unmeasured, with the reason. A dash means we could not look, not that you passed.
What we do not claim
A report that only lists what it found, and never what
it could not reach, is not telling you the truth about its own coverage.
Things we ask permission for
The deep security scan sends your server requests an ordinary visit would not. It does not run until you confirm in writing which domains and when.
Things that need a key you own
Real-visitor speed data and Business Profile details come from Google. Where there is no key, those checks are listed as unmeasured rather than guessed at.
Things an outside audit cannot see
Server-side analytics, monitoring you run privately, work already scheduled. We report what is visible from outside, and say so.