Performance
15 checks
Server response time, compression, browser cache, image formats and dimensions, lazy loading, render-blocking CSS and scripts, fonts, DOM size, third-party scripts.
SEO
15 checks
Title tag, meta description, H1 and heading hierarchy, canonical, robots.txt, XML sitemap, meta robots, structured data, Open Graph, hreflang, links.
Security
11 checks
HTTPS and HSTS, exposed server and PHP versions, reachable sensitive files, XML-RPC, directory listing, author enumeration, login page.
WordPress
17 checks
Version, detected theme and plugins, page cache, SEO and security plugins, REST API and exposed accounts, emojis, jQuery, WP-Cron, Heartbeat, page builder. Only when the site runs WordPress.
Accessibility
11 checks
Alt text, empty or generic link text, unlabeled fields, skip link, ARIA landmarks, tab order, focus indicators, touch targets.
Best practices
12 checks
Doctype, charset, favicon and Apple icon, mixed content, resource integrity, deprecated elements, preconnect, manifest, HTTP/2.