A 10-second checkup of the things that quietly break trust and rankings: HTTPS, security headers, redirects, mixed content, compression, and response speed. The stuff monitoring tools gate behind a login, free.
Free, no signup. We check your live site's security and performance signals.
A site can look fine and still be quietly bleeding trust: a missing security header, a slow first byte, an http:// image throwing a “not secure” warning. This snapshot checks the technical signals that browsers, Google, and customers all notice, even when you don’t.
HTTPS & SSL (is the connection secure), security headers (HSTS, clickjacking and MIME-sniffing protection, referrer policy), redirects (does http go to https), mixed content (insecure resources on a secure page), compression (is text gzipped), and response time (how fast your server replies). Each comes with a plain-English fix.
Browsers flag non-HTTPS sites as “Not secure,” which scares off customers. Slow response time hurts both rankings and conversions. Missing security headers leave you exposed and can fail security reviews. These are usually quick fixes with outsized impact.
We build sites that pass every one of these out of the box, and fix the ones that do not. Free audit available.
Get a free audit →Or call/text: (407) 694-2055You hand it a domain and our server loads that page once. It follows redirects to wherever they land, cuts the attempt off at twelve seconds, and keeps the first 400,000 characters of HTML. From that one response it reports whether the final address is https, whether an http address redirects to https, the status code, how long the round trip took, whether a compression header came back, and whether four common security headers are present: HSTS, nosniff, frame protection through X-Frame-Options or a content security policy, and a referrer policy. On an https page it also scans the HTML for images, scripts, styles, and fonts still loading over http, and it flags an X-Powered-By header that advertises your stack to anyone who looks.
The score is a weighted count, nothing cleverer. A pass is worth one, a warning half, a failure zero, divided by the number of checks and shown as a percentage: 85 and up reads as healthy, 60 to 84 as some issues, below that as needs attention. Timing is banded at under 800 milliseconds for a pass and under 2 seconds for a warning. Two things follow. Most of these items are server configuration, so the number can jump several points from adding one header, which no customer will ever notice. And the timing figure covers the whole round trip through the last byte of HTML, measured from a data center rather than from a phone on a mobile network, so a single sample near a boundary is a hint, not a verdict.
The limits deserve saying plainly. This is one request to one page, usually your homepage, so it says nothing about the rest of the site. It does not render anything, so it cannot measure Core Web Vitals, image weight, or layout shift, and it does not look at your content, your rankings, your mobile layout, or whether your forms deliver. It cannot see a page behind a login, and a host that blocks data center traffic will refuse it outright. Results are cached per address for about an hour, so a recheck right after a fix may hand you the previous snapshot. For a wider read the website report card covers more of the page, and keeping these greens green is the boring half of website maintenance.
It means everything on this short checklist passed. The list covers transport security, a few headers, compression, and one timing sample. It says nothing about whether your pages load fast on a phone, whether the content answers what people came for, or whether visitors call you. A perfect score on a site whose contact form quietly fails is still a broken site.
A few things cause that. Some hosts and firewalls block requests coming from data center addresses or from an unfamiliar user agent. Anything that takes longer than twelve seconds to answer gets cut off. A page behind a login, a country block, or a bot filter will not respond either. Check the address you entered first, then whether your firewall is filtering automated requests.