Website Health Checker

What A Website Health Check Covers

A website can look fine in a browser and still be one expired certificate, one outdated plugin or one spoofed email away from a bad week. A health check looks under the page: how the server answers, what it tells browsers about security, whether the certificate is valid, whether the domain is protected from email spoofing, and how fast the page loads on a phone. This tool runs all of that from one address and turns it into a single risk score with the findings sorted from most to least serious.

How The Checker Works

When you press Run, five lookups start at once and a sixth runs alongside them:

1. The page itself. Our server fetches the address you entered and records the HTTP status, the final URL after redirects, the response time and the size of the HTML. It reads the response headers and the page source.
2. The plain HTTP version. We request http:// for the same host to see whether it moves visitors to HTTPS.
3. The SSL certificate. Issuer, days until expiry and whether the certificate covers the hostname.
4. SPF and DMARC. DNS TXT lookups on the domain and on _dmarc, read in your browser over DNS over HTTPS.
5. Platform detection. The source is read for markers: a WordPress generator tag (which often exposes the core version), /wp-content/plugins/<slug>/ file paths for plugins, /wp-content/themes/ for the theme, and known markers for Shopify, Webflow, Wix and Squarespace.
6. Google PageSpeed Insights on mobile. The Lighthouse performance score, lab metrics and, when Google has enough traffic data, real visitor Core Web Vitals. If PageSpeed fails or is rate limited, that section is marked unavailable and the rest of the report stands.

The Risk Score And Its Weights

The score runs from 0 (no risk found) to 100. Each rule has a fixed weight. A failed rule adds its full weight, a warning adds half (rounded up), a pass adds nothing. The total is divided by the weights of the rules that actually ran, so a skipped section never counts against the site. There is no hidden benchmark and no comparison with other sites.

• Homepage loads without an error: 15
• SSL certificate valid, not expiring within 14 days, hostname matches: 15
• HTTP redirects to HTTPS: 10
• Mobile PageSpeed performance score (Lighthouse bands: 90 good, 50 to 89 needs improvement, under 50 poor): 10
• SPF record present, single, not +all, within the 10 lookup limit: 8
• DMARC policy present and enforced (p=none is a warning): 8
• Core Web Vitals for real users at Google's thresholds (LCP 2.5 s, INP 200 ms, CLS 0.1): 8
• Strict-Transport-Security: 6
• Content-Security-Policy: 5
• Clickjacking protection, X-Frame-Options or CSP frame-ancestors: 5
• X-Content-Type-Options: 3
• Software versions hidden from the generator tag and headers: 3
• Referrer-Policy: 2
• Permissions-Policy: 2

The weights add up to 100. Under 20 reads as low risk, 20 to 44 as moderate and 45 or more as high. These bands are our own reading of the weights, not an industry standard.

How To Read The Result

Start with the items marked Fix. An error status, an expired or mismatched certificate and a missing HTTP to HTTPS redirect affect every visitor and should be handled the same day. Missing DMARC is next, because it lets anyone send email that appears to come from the business. Security headers matter, but they are hardening rather than emergencies, so they are grouped into one line in the copied summary.

The WordPress line deserves a careful read. A version in the generator tag is a public advertisement of what the site runs. The plugin list only includes plugins that load files on the page you checked, so the real installed count is usually higher. Check the core version against wordpress.org and the plugins against their changelogs.

What To Do Next

• Copy Findings gives you a plain text summary written for a site owner: what needs fixing, what is worth a look, and what checked out.
• Export Full Report adds every check with its points and the raw response headers, which is what you hand a developer.
• Re-run after fixes. The fetch result is cached for ten minutes, so wait before checking again.

Mistakes To Avoid

• Adding a strict Content-Security-Policy straight to production. Start with the report only header or you will break analytics, embeds and payment forms.
• Jumping DMARC from nothing to p=reject. Start at p=none with reports, confirm every real sender passes, then tighten.
• Treating one PageSpeed run as gospel. Lab scores move between runs. Real visitor data is the steadier signal.
• Reading a 403 as a broken site. Some firewalls block automated checks. Open the site yourself before you report it.

Why Agencies Run This On Past Clients

Every site an agency has launched is a client who already trusts it. A specific finding, such as a certificate expiring next month or a domain with no DMARC, is a far better reason to get in touch than a generic offer. Wise Media uses this same check before proposing a care plan: run it, paste the findings, and offer the plan that fixes them and keeps them fixed.