A complete audit in every scan
WebsiteCoach runs 15 check categories across performance, security, email deliverability, SEO crawlability, threat intelligence, page quality, and sustainability — delivering a full executive briefing in around 60 seconds.
15
Check categories
110+
Individual data points
60+
Prioritised action items
~60s
Typical scan time
Composite health score — weighted across all dimensions
Performance & Core Web Vitals
Source: Google Lighthouse
Full lab-based performance audit via Google PageSpeed, with a revenue impact model that estimates annual conversion rate loss.
- Largest Contentful Paint (LCP)
- First Contentful Paint (FCP)
- Total Blocking Time (TBT)
- Cumulative Layout Shift (CLS)
- Speed Index
- DOM size & render-blocking resources
- Third-party script count & weight
- Top optimisation opportunities
- CVR loss & estimated annual revenue at risk
Real-User Performance
Source: Chrome UX Report (CrUX)
CrUX reports real-user performance over a collection window. Use it alongside lab diagnostics.
- LCP at 75th percentile (p75)
- INP — Interaction to Next Paint (p75)
- CLS at 75th percentile (p75)
- FCP & TTFB from real users
- Good / Needs Improvement / Poor ratings
- Aggregated across all form factors
Security Headers
Source: HTTP Response Analysis
Every response header checked against OWASP best practices for both presence and quality. CSP is inspected for unsafe-inline and wildcard usage; HSTS for max-age and includeSubDomains — weak configurations score differently from missing ones.
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Content-Type-Options
- X-Frame-Options
- Referrer-Policy
- Permissions-Policy
- Cross-Origin-Resource-Policy (CORP)
- Cross-Origin-Opener-Policy (COOP)
- Cross-Origin-Embedder-Policy (COEP)
DNS & Email Deliverability
Source: Cloudflare DNS over HTTPS + policy fetch
A missing SPF or DMARC record lets anyone send email pretending to be your domain. We now check the full deliverability stack — including DKIM signing, BIMI brand logos, MTA-STS enforcement, and TLS failure reporting.
- SPF record — exists, valid, and strict
- DMARC — policy level (none / quarantine / reject)
- DMARC rua= aggregate-report address
- DKIM — 18 common selectors probed
- MX records — inbound mail configured
- CAA — certificate authority restrictions
- TLS-RPT — TLS failure reporting
- MTA-STS — enforce TLS for inbound mail
- BIMI — brand logo in email clients
- Server geolocation & hosting provider
- Composite deliverability score (0–100)
Abuse & IP Reputation
Source: AbuseIPDB v2 API
Checks the server's IP address against AbuseIPDB — a crowdsourced database of IPs reported for malicious activity. A high confidence score signals active attack infrastructure.
- IP address & geolocation
- Abuse confidence score (0–100)
- Total reports & unique reporters
- ISP, usage type & Tor node detection
- Abuse category breakdown
- Date of last reported incident
Google Safe Browsing
Source: Google Safe Browsing API
Real-time lookup against Google's threat database. A flagged site triggers browser warnings in Chrome, Firefox, and Safari — blocking most visitor traffic immediately.
- Malware detection
- Phishing URL detection
- Unwanted software & deceptive pages
- Threat type breakdown with affected URLs
VirusTotal Domain Reputation
Source: VirusTotal v3 API (90+ engines)
Scans your domain against 90+ antivirus engines and threat intelligence feeds simultaneously. Even a single malicious detection can get your domain blocklisted by corporate firewalls.
- 90+ antivirus engine scan results
- Malicious & suspicious engine counts
- Community reputation score
- Vendor category classification
- Domain blocklist status
Domain Intelligence
Source: RDAP registry data + DataForSEO analytics
Domain health, RDAP-backed registration and lock status where available, and an estimated asset valuation based on traffic, keywords, and backlink authority.
- RDAP-preferred domain expiry date & days remaining
- RDAP-preferred EPP registrar lock status
- Registrar & domain age
- Estimated domain value
- Organic keyword count (top 3 / top 10)
- Estimated monthly traffic value
- Referring domains & total backlinks
- Dofollow backlink ratio
- Paid keyword & traffic data
Uptime & Response Time
Source: Live HTTP check via Cloudflare Workers
A point-in-time availability and response check with redirect tracing. Extra hops can add latency; this is not continuous uptime monitoring.
- HTTP status code (site up or down)
- Time to First Byte (TTFB)
- TTFB rated: Fast / OK / Slow
- Full redirect chain (hop-by-hop)
- Redirect count
- Long-chain detection (>1 hop)
Broken Links
Source: Homepage link crawler
Up to 40 internal links from the homepage are crawled and HEAD-checked. Broken links damage trust, increase bounce rate, and waste crawl budget.
- Up to 40 internal links crawled
- Each link HEAD-checked for 404 / 500
- Broken links listed with URL & status
- Redirect links listed separately
- Score based on broken link density
- Cloudflare false-positive paths excluded
Schema Markup
Source: JSON-LD / Microdata / RDFa parser
Schema markup describes page content in a structured format. Supported types can help establish eligibility for search features.
- JSON-LD, Microdata & RDFa detection
- Schema types identified
- Required properties validated per type
- Missing recommended types flagged
- Organization schema check
- WebSite & BreadcrumbList check
HTML Validation
Source: Internal DOMParser validator
Invalid HTML causes rendering inconsistencies across browsers and can confuse search engine crawlers. We check without sending your code to an external service.
- Error count & warning count
- Duplicate ID detection
- Missing required attributes
- Invalid element nesting
- Top issues listed
Page Quality
Source: Rendered HTML analysis
A deep inspection of the rendered homepage covering social sharing, images, trackers, analytics, lead capture, consent, content quality, trust signals, social presence, and AI/search visibility.
- Open Graph tags (og:title, description, image, url)
- Twitter / X card completeness
- Mixed content (HTTP resources on HTTPS pages)
- Images missing alt text (ADA/WCAG risk)
- Non-modern image formats (WebP/AVIF)
- Images missing width/height attributes
- Third-party tracker detection
- GDPR/CCPA compliance risk level
- Flesch Reading Ease score & grade level
- Social links (Facebook, Instagram, LinkedIn, X, YouTube)
- Trust signals (phone, email, contact, privacy, terms, about, address)
- E-E-A-T compliance signals for Google quality guidelines
- Analytics and marketing tool detection
- Lead capture forms, email fields, CTAs, demo/trial/pricing links
- Cookie consent, CMP, IAB TCF, Google Consent Mode, and policy links
- AI/search visibility score for entity, offer, trust, crawlability, answer format, and llms.txt / AGENTS.md signals
Carbon Footprint
Source: PageSpeed resource weights + GWF formula
Each page view generates CO₂. Calculated from transferred page weight using the Green Web Foundation / Website Carbon methodology, relevant for ESG reporting and corporate sustainability goals.
- CO₂ grams per page view
- Estimated cleaner-than percentile based on page weight
- Energy per visit estimate in kWh
SEO, Accessibility & Crawlability
Source: Google Lighthouse + crawlability audit
Google Lighthouse SEO/accessibility scores combined with a full crawlability audit — checking every technical signal that determines whether search engines can actually find and index your site.
- SEO score (0–100) via Google Lighthouse
- Accessibility score (0–100)
- Best Practices score (0–100)
- Page title — presence & length (30–60 chars)
- Meta description — presence & length (120–160 chars)
- Canonical tag — present & self-referencing
- Noindex detection (meta robots / googlebot)
- hreflang — x-default & self-reference validation
- robots.txt — crawl rules & Sitemap: declaration
- XML sitemap — URL count & lastmod freshness
- Sitemap index — child sitemap resolution
- llms.txt / AGENTS.md — AI agent discoverability
- security.txt — vulnerability disclosure contact, expiry, and canonical location
Every finding becomes a delegatable action item
Raw scores don't move projects forward. Every issue found across all 15 check categories is converted into a plain-English briefing with a priority level, current metric, target, and a specific team to delegate it to — ready to copy-paste into Slack, a ticket, or a board meeting.
Data sources & accuracy: Results depend on the availability of third-party APIs and public data sources (Google PageSpeed, Chrome UX Report, Cloudflare DNS, RDAP registries, DataForSEO, AbuseIPDB, Google Safe Browsing, VirusTotal, and W3C Nu HTML Checker where used). Some checks may be unavailable for low-traffic sites or sites with WAF restrictions. Domain valuation figures and revenue estimates are illustrative models based on industry benchmarks and do not constitute financial advice.