Check your site's security headers and speed — free, in about 30 seconds.
Paste your address. We run Google's own Lighthouse on it and read the security headers and certificate your site already sends to every visitor. Real numbers, no signup, nothing invented.
What we check, and why it matters.
This is a free website audit in two halves. The first is a free website speed test: Google's own Lighthouse, run on the address you typed, scored on the four things Google publishes thresholds for. The second is a passive read of what your site already tells every visitor. Here is what each item is, and what a poor result actually means for a small business.
Google Lighthouse — the four scores
Lighthouse is Google's own open-source auditing tool. The scores at the top of this page are Google running it on your address through the PageSpeed Insights API — the same engine, the same numbers and the same rounding as Google's own PageSpeed page. It returns four scores out of 100, and Google's bands are published, so we show them unchanged: 0 to 49 is poor, 50 to 89 needs improvement, 90 to 100 is good. When someone asks what a good PageSpeed score is, that is the honest answer — 90 or above, and on mobile, because the mobile run is deliberately throttled to a slower processor and a slower connection and is the harder of the two to pass.
Performance
How quickly the page shows something, how long it takes to finish drawing its largest element, how long the browser is blocked from responding to a tap, and how much the layout jumps around while it loads. Lighthouse measures all of it in a lab: a Google machine loading your page on a simulated mid-range phone. A low performance score means visitors on a phone are waiting on you, and mobile is the run we do first because that is where most local searches happen. It is also the only one of the four scores that moves noticeably from run to run.
Accessibility
The automated part of whether someone using a screen reader, a keyboard, or a phone at high zoom can actually use the page: color contrast, form labels, image alt text, heading order, link names, language attributes. Google is explicit that these are only the checks a machine can run, so 100 does not prove a page is accessible — but a low score does prove there is work to do. The misses on a small-business site are usually cheap ones: pale gray text on white, a contact form whose fields have no labels, and buttons that say nothing but “click here”.
Best Practices
Whether the page is served over HTTPS, whether it throws errors into the browser console, whether it relies on deprecated browser APIs, whether images are served at sensible dimensions, and a handful of other hygiene checks. It is the closest Lighthouse comes to answering “is my website secure”, and it is only a first look at the question — which is exactly why the security section below exists. A low score here often points at an abandoned plugin or a third-party script nobody remembers adding.
SEO
Whether a search engine can reach the page, read it and understand what it is about: a real title, a meta description, a successful status code, links a crawler can follow and read, nothing accidentally telling Google not to index it. This is a technical checklist, not a ranking. A perfect 100 means nothing on the page is standing in Google's way — it does not mean you will appear above anyone, because that depends on what is on the page and who links to it.
The security check — what your site tells every visitor
The second half runs on our server, and it only reads the public responses your site already sends to anyone who opens it. It never logs in, never submits a form, never guesses a password and never tries to break anything. Fourteen items are graded — six headers, the certificate, whether https is really enforced, what the server says about itself, and five well-known paths — and each one is shown with the evidence we saw rather than a grade you have to take on trust. The page basics at the end are reported alongside them rather than graded.
The six security headers
A security header is one line your server adds to every response, telling the browser how to behave on your site. They cost nothing to send, need no plugin and no new code, and are usually set once in a server config or a CDN panel. They are also the first thing anyone who sets out to check website security headers looks for, because they are the cheapest protection a small site can have. We look for six:
- Strict-Transport-Security (HSTS) — tells the browser to only ever connect to you over https, so a visitor on public wi-fi cannot be quietly moved onto an unencrypted connection.
- Content-Security-Policy (CSP) — lists the places the page is allowed to load scripts, styles and frames from. It is what limits the damage if a script ever gets injected into one of your pages.
- X-Content-Type-Options: nosniff — stops the browser guessing that a file is something more executable than you meant it to be.
- X-Frame-Options, or frame-ancestors in your CSP — stops another site loading yours inside an invisible frame and collecting clicks meant for you. That attack is called clickjacking.
- Referrer-Policy — controls how much of your visitor's current address is handed over to the next site they click through to.
- Permissions-Policy — switches off the browser features your site does not use, such as camera, microphone and location.
The certificate (TLS)
We open an ordinary TLS connection and read the certificate the way a browser does: whether it is trusted and valid for that name, who issued it, which protocol version was negotiated, and how many days are left before it expires. We warn inside thirty days rather than waiting for the morning it lapses. An expired certificate takes a working site down as completely as an outage would, because every visitor meets a full-page browser warning before they reach a word of your content.
HTTPS actually enforced
Owning a certificate is not the same as using it. Our server asks for the plain http:// version of your address and records what came back: a redirect to https is a pass, an answer served over plain http is a fail. It matters because anything typed or submitted on an unencrypted page can be read by anyone else on the same network, and browsers now mark those pages “not secure” in the address bar where your visitors can see it.
Well-known sensitive paths
A small number of files get left on servers by accident and give away far more than anyone intended: .env, which typically holds database passwords and API keys; .git/HEAD and .git/config, left by a deploy that copied the whole repository; .DS_Store, which lists your folder names; and phpinfo.php, which describes your entire stack. We request those five paths and mark one failed only when the response really is that file — a 404, a redirect or a themed “not found” page is a pass. This is as close to a vulnerability scan as the check gets, deliberately.
What the server says about itself
Many servers announce their exact version in every response — Server: nginx/1.18.0, or X-Powered-By: PHP/7.4.3. That is a warning rather than a hole. It tells anyone scanning the internet which published vulnerabilities are worth trying against you first, and it takes one configuration line to stop sending it. If your server advertises no version at all, that item passes.
Page basics
Finally, the things that decide whether a page can be read, indexed and shared at all: the title and its length, whether a meta description exists, whether a viewport tag is present so a phone is not served a shrunken desktop layout, the html lang attribute a screen reader uses to pick a voice, whether robots.txt and sitemap.xml are there, and any http:// resources loaded into an https page — mixed content, which browsers block. We also name the platform when the page names one. A CMS is information, not a finding.
Exactly what we run — and what we don't.
- 01
The four scores, the metrics, the opportunities and the screenshot come from Google's PageSpeed Insights API (Lighthouse), requested from your own browser, and are shown exactly as Google returns them. We never recompute, blend or adjust a score, and mobile is what we run first because that is where most local searches happen.
- 02
The security section is a passive read of the public responses your site already sends to every visitor: six security headers, the TLS certificate, whether plain http redirects to https, what the server advertises about itself, and whether a handful of well-known sensitive paths answer with real content. It is not a vulnerability scan. It never tries to log in, submit anything, guess passwords or exploit anything.
- 03
Plain-English notes explain what a finding means. We don't invent an overall grade, estimate lost visitors or revenue, or compare you with anyone — if we didn't measure it, it isn't on the page.
- 04
Nothing about your check is stored unless you submit the form. Security results for an address are cached on our server for 10 minutes so repeat checks don't hammer your site, and Google's run stays in your browser.
- 05
If a measurement fails — Google's free quota is busy, or a site doesn't answer in time — we say so in words. There are no placeholder numbers anywhere on this page.
Straight answers about the check.
Is the website check really free?
Yes. No account, no card, no email address needed to see your results. The Lighthouse half is Google's free API, called from your own browser, and the security half runs on our server. The only limit is a fair-use one: a handful of security checks every few minutes from the same connection, so this page cannot be pointed at somebody else's site as a weapon. Google's free quota is shared and is sometimes busy, and when it is we say so instead of showing a number.
Do you store my website address?
Nothing is written to our systems unless you fill in the report form and ask us to send it. Google necessarily sees the address, because your browser asks Google directly. Our server necessarily sees it, because it has to request your pages to read the headers. We keep the security result in a short-lived cache keyed to that address for ten minutes, so running the same check twice does not hit your site twice, and Google's Lighthouse result stays in your browser.
What is a good PageSpeed score?
Google publishes the bands and we show them unchanged: 90 to 100 is good, 50 to 89 needs improvement, 0 to 49 is poor. Ninety or above on mobile is a fair target for a small-business site, and mobile is the number to watch because it is the throttled run and the one Google indexes. A green score is worth having on its own terms. It is not a ranking promise, and anyone who sells it to you as one is guessing.
Why did my score change between runs, or differ from Google's own page?
Performance is a lab measurement, not a fixed property of your site. Google loads the page on one of its own machines with a simulated phone and a throttled connection, so a busy server, a slow third-party script, an ad slot or ordinary network variance moves the number. We call the same PageSpeed Insights API that Google's own page calls, so a run here and a run there differ for exactly the reason two runs on Google's page differ. Accessibility, best practices and SEO barely move.
Is this a vulnerability scan or a penetration test?
No, and we would rather say so plainly. It is a passive read of the public responses your site already sends every visitor: headers, the certificate, whether http redirects to https, what the server advertises about itself, and whether five well-known files answer with real content. It never logs in, submits a form, guesses a password, scans ports or exploits anything. A penetration test is a scoped, authorized engagement in which an engineer tries to get in on purpose, and it starts with a signed agreement.
What does a failed security header actually mean?
It means your server is not sending a line it could send, so the browser is not enforcing a protection it would otherwise enforce. It is not evidence that anyone has been in your site. Take X-Content-Type-Options: without it, a browser is free to guess that a file is something more executable than you intended it to be. Each item on the list is a setting, usually one line in a server config or a CDN panel, and none of them requires touching your content.
Can you fix these for me?
Yes — that is the Fix Sprint below: a fixed list of fixes on the site you already have, for a fixed price, in five business days, with this same check re-run at the end so the before and after are in writing. If we look at your site and cannot meaningfully improve it for that price, we say so and you pay nothing. If the honest answer is that your theme or platform is the real problem, you hear that before you pay rather than after.
Do I need to be technical to use this?
No. Paste your address and read the plain-English note under each result. Every finding says what it is, what our server or Google actually observed, and what it means — there is no invented severity score and no jargon we have not explained. If somebody maintains the site for you, the results are written so you can forward them and ask for specific items by name. If nobody does, ask us and we will tell you which ones are worth your money.
My site is on Wix, Squarespace, Shopify or WordPress — does this still work?
It works on any platform, because it only reads what your site sends back over the public internet. What changes is what you can do about the results. On WordPress, or anywhere you control the server or a CDN in front of it, every item here is fixable. On a hosted builder the platform owns the response headers, so some of them are simply not yours to set — we will tell you which, rather than sell you a fix you cannot apply. Speed and the page basics are almost always still in your hands: images, apps and the theme you chose.
Why is mobile scored separately from desktop?
Because Google scores them separately, and because Google indexes the mobile version of your site. The mobile run is throttled on purpose — a simulated mid-range phone on a slower connection — so the same page usually scores lower there than on desktop. That is why we run mobile first, and why the desktop run only starts when you switch to that tab: it keeps one visitor from spending two of Google's free quota slots without needing to.
Want it fixed? Here is the price — and here is what it does not cover.
Most of what this check finds is configuration, not a rebuild. So there is a fixed price for doing it, on the site you already have.
Website Fix Sprint
$399 one-off
The fixes your check report asks for, done for a fixed price — on the site you already have, without a rebuild.
What is included
- Security headers configured properly: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy
- HTTPS enforced everywhere, mixed content cleaned up, certificate and renewal checked
- The performance work Google's own report asks for on your key pages: image compression and sizing, render-blocking resources, caching headers
- SEO basics fixed across up to 10 pages: one H1 each, real titles and meta descriptions, canonical tags, robots.txt and sitemap.xml
- Google Search Console and GA4 connected, sitemap submitted, conversion tracking on your contact form
- The same check re-run at the end — before and after, in writing, so you can see exactly what changed
What it does not cover
- A rebuild. If your theme or platform is the real problem, we will tell you before you pay, not after
- New pages, content writing or design changes
- Any promise about rankings or traffic — nobody can honestly make one
- Paid plugin or theme licences, and work inside another agency's proprietary system
- Ongoing maintenance — that is the care plan, and it is optional
Access to your hosting or CMS (and DNS if headers are set there). We will tell you exactly what we need before you pay.
If we look at your site and can't meaningfully improve it for this price, we say so and you pay nothing.
Not sure which of these matter for your business?
Run the check, then book twenty minutes and we will go through it with you — including the items we would leave alone. If we are not the right people for what you need, we will say so and tell you who is.