Methodology

Every check, where the data comes from and how it is scored.

Each check is OK (full points), Improve (half) or Problem (none), weighted by importance. Area score = weighted share of points, 0–100. The overall score averages the areas: speed 25%, search 25%, security 25%, presence 20%, AI visibility 5%. Checks we could not run are left out instead of counted as failures; if less than a third of an area could be checked, the area is shown as not assessed.

Sources: Google PageSpeed Insights API (Lighthouse and Chrome UX Report), Google Places API, public DNS, your website’s HTTP responses. We never log in to your site and never read private pages.

Speed

Google PageSpeed, Core Web Vitals from real Chrome users, server response time.

Mobile performance score: Most visitors come from phones; Google ranks by the mobile version and slow pages lose visitors before they load.
Desktop performance score: Office customers browse on computers; a slow site looks unreliable.
Largest Contentful Paint: LCP is a Core Web Vital used in Google ranking. Over 2.5 s feels slow.
Cumulative Layout Shift: Content that moves while loading causes mis-clicks and is a Core Web Vital.
Interaction to Next Paint: Real visitors wait too long after tapping buttons or menus.
Total Blocking Time: While scripts run, the page cannot react to the visitor.
Server response time: Everything else waits for the first byte from the server.

Search

Titles, descriptions, headings, structured data, sitemap, robots.txt and indexing.

Website responds: We could not load the home page. Visitors and search engines see the same error.
Page title: The title usually becomes the headline of your Google result and is a key relevance signal; Google cuts long titles at about 600 pixels.
Meta description: Google often uses it for the snippet under the title in search results, and a good snippet drives clicks.
Main heading (H1): A clear main heading tells visitors, screen readers and search engines what the page is about. Several H1s are not penalised, but one focused H1 is clearer.
Canonical URL: Prevents duplicates (www/non-www, parameters) from splitting ranking.
Page language: Helps search engines show the page to the right audience and screen readers pronounce it.
Mobile viewport: Without a viewport tag the page renders as a tiny desktop page on phones.
Social sharing preview: Links shared on Facebook, LinkedIn or messengers show a proper title, text and image.
Structured data: Structured data helps Google and AI assistants understand who you are, where and what you offer.
Indexing allowed: The page asks search engines not to show it. Nobody will find it in Google.
Image descriptions: Image search and accessibility both rely on alt text.
robots.txt: robots.txt is missing or blocks the whole site from search engines.
XML sitemap: A sitemap helps search engines find every page quickly.
Google Lighthouse SEO score: Lighthouse checks crawlability and markup basics that search engines rely on.
Broken internal pages: Some pages on your own site return an error or do not load. Visitors reach a dead end and search engines see a neglected site.
Unique page titles: Pages with no title, or the same title as another page, compete with each other and look identical in search results.
Unique meta descriptions: Missing or repeated descriptions leave Google to pick random text for the snippet, which lowers the number of clicks.
Main heading on every page: A page without a main heading is harder for visitors, screen readers and search engines to understand.
Pages hidden from search: These pages ask search engines not to show them. That is right for thank-you or private pages, and a mistake for pages customers should find.
Redirected internal addresses: Every redirect adds a delay for visitors and passes less of the page strength to the final page.
Pages with very little text: Pages with only a few lines give search engines and customers little to go on, so they rarely rank or convince.
Pages nobody links to: A page that no other page links to is hard for visitors and search engines to find, even if it is listed in the sitemap.
Pages buried deep in the site: Pages that take more than three clicks to reach get less attention from visitors and are crawled less often.

Security & trust

HTTPS and certificate, security headers, exposed admin pages and leftover files, SPF and DMARC for your email domain.

HTTP → HTTPS redirect: Browsers mark plain HTTP as "Not secure"; Google prefers HTTPS.
SSL certificate: An invalid or expiring certificate shows a full-screen browser warning.
HSTS: Forces browsers to always use HTTPS and protects visitors on public Wi-Fi.
Content Security Policy: Limits damage from injected scripts (a common way hacked sites steal data or redirect visitors).
X-Content-Type-Options: Stops browsers from guessing file types, a known attack vector.
Clickjacking protection: Prevents clickjacking (your page shown invisibly inside a malicious site).
Referrer-Policy: The current policy sends full page addresses to other sites.
Server version hidden: Version numbers help attackers find known vulnerabilities.
Exposed admin / leftover files: Public login pages are brute-forced daily; leftover files (.git, .env, phpinfo) can leak passwords and code.
SPF record: Without SPF, anyone can send email pretending to be your domain, and your own mail lands in spam.
DMARC policy: DMARC tells mail servers to reject fake emails from your domain (phishing of your clients).

Presence

Social profiles, clickable contacts, Google Business Profile rating and reviews.

Links to social profiles: Connects your site and profiles for customers and search engines; builds trust.
Contact info on the page: Visitors on phones call or write with one tap; missing contacts cost leads.
Facebook page reachable: The Facebook page link returns "not found".
Instagram profile reachable: The Instagram profile link returns "not found".
Google Business Profile: The map listing is often the first thing local customers see; rating and number of reviews drive calls.

AI visibility

Whether AI crawlers may read your site, whether your business is described as a clear entity, and (optional) a sample question to an AI assistant.

AI search bots allowed: robots.txt blocks bots that AI assistants use to answer people (e.g. OAI-SearchBot, ChatGPT-User, PerplexityBot, Claude-SearchBot), so they cannot cite your pages. Blocking training bots (GPTBot, ClaudeBot, Google-Extended) is a separate choice and does not affect this score.
Business described as an entity: AI assistants and Google build their picture of a business from consistent structured facts: name, website, address or phone, social profiles.
Named by an AI assistant (indicative): More people ask AI assistants for recommendations. In our test question about your service and city, the assistant did not name you. This is one sample, not a ranking.