# 37 Audits - Website Audit Platform > The fastest and easiest way to find and fix SEO, security, performance, accessibility, and resilience issues before they cost rankings, revenue or trust. # 37 Audits - Website Audit Platform > The fastest and easiest way to find and fix SEO, security, performance, accessibility, and resilience issues before they cost rankings, revenue or trust. - [Auditors](https://www.37audits.com/auditors.md): Full catalog of website auditors. - [Blog](https://www.37audits.com/blog.md): Articles covering website audit best practices, tutorials, and SEO/performance/security guides. - [Pricing](https://www.37audits.com/pricing.md): Plans and credit pricing for running audits. - [Dogfooding](https://www.37audits.com/dogfooding.md): Live audit results for 37audits.com itself. - [Contact](https://www.37audits.com/contact.md): Get in touch with 37 Audits. [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Website Auditors Explore our comprehensive collection of website auditing tools. Each auditor is designed to identify specific issues and provide actionable insights to improve your website's performance, security, and user experience. Filter by tags: AI Content Crawling DKIM DNS Delivery GDPR GEO General Headers JavaScript Legal Mail Monitoring Performance Privacy Resilience SEO SPF SSL Security Social Networks Showing 48 of 48 auditors [๐Ÿ› Browser Console Messages Auditor Detects JavaScript errors and console messages This checker uses a headless browser to detect JavaScript errors and console messages that may indicate issues with the website. The checker uses Playwright to load the page in a headless browser, captures all console messages and errors, monitors for JavaScript execution issues, and reports any console errors or warnings. PerformanceJavaScript Cost: 50 creditsView details](/auditors/browser-console-messages-checker)[๐Ÿ—„๏ธ Cache Auditor Validates cache headers for optimal web performance A comprehensive cache validation checker that analyzes cache headers for different types of web resources according to industry best practices. It validates cache configuration for HTML pages, static assets, and API responses, with platform-specific logic for Liferay environments. PerformanceResilience Cost: 50 creditsView details](/auditors/cache-checker)[๐ŸŒ CDN Coverage Auditor Checks if your website content is served through a CDN Analyzes whether your website and its static assets (CSS, JavaScript, images, fonts, videos) are being served through a Content Delivery Network (CDN). This checker examines the main HTML document and all first-load assets to determine CDN coverage across your entire website. PerformanceDeliveryResilience Cost: 30 creditsView details](/auditors/cdn-coverage-checker)[๐Ÿ”’ Certificate Auditor Validates SSL certificate validity and expiration status This auditor validates SSL certificates for HTTPS websites, ensuring they are properly configured and not expired. The checker connects to the website via HTTPS, retrieves the server's SSL certificate chain, extracts certificate information including expiration date, and validates certificate format and validity. SecuritySSL Cost: 50 creditsView details](/auditors/certificate-auditor)[๐Ÿ—œ๏ธ Content Encoding Auditor Validates content compression for performance optimization This checker validates that websites use proper content encoding (gzip, deflate, brotli) to optimize page loading performance. The checker sends HTTP request with Accept-Encoding header, analyzes Content-Encoding response header, validates compression method and configuration, and ensures proper content compression. PerformanceContent Cost: 10 creditsView details](/auditors/content-encoding-checker)[๐Ÿ›ก๏ธ Content Security Policy Auditor Validates Content-Security-Policy header configuration This checker validates the Content-Security-Policy header for presence and security configuration, flagging policies containing unsafe directives that weaken XSS protection. The checker retrieves the Content-Security-Policy header from HTTP response, analyzes the policy for unsafe directives (unsafe-inline, unsafe-eval), and validates policy syntax and configuration. Security Cost: 20 creditsView details](/auditors/csp-checker)[๐Ÿช Cookie Auditor Validates cookie security attributes and configuration This checker analyzes Set-Cookie headers for security best practices including Secure, HttpOnly, and SameSite attributes. The checker retrieves all Set-Cookie headers from HTTP response, analyzes each cookie for security attributes, validates Secure, HttpOnly, and SameSite configuration, and checks for proper domain and path settings. Security Cost: 50 creditsView details](/auditors/cookie-checker)[๐Ÿช Cookie Consent Auditor Checks for proper cookie consent banners with accept/reject options Analyzes websites for cookie consent banners and GDPR compliance mechanisms. This checker detects the presence of cookie consent interfaces, validates the availability of both accept and reject options, and assesses whether users have proper control over their cookie preferences. LegalGDPRPrivacy Cost: 50 creditsView details](/auditors/cookie-consent-checker)[๐Ÿ”„ CSR/SSR Auditor Detects if website uses Client-Side or Server-Side Rendering Evaluates whether a website is Client-Side Rendered (CSR) or Server-Side Rendered (SSR) by comparing HTML content with JavaScript enabled vs disabled. SEOPerformance Cost: 30 creditsView details](/auditors/csr-ssr-checker)[๐Ÿ” CVE Auditor Scans software stack for known security vulnerabilities This checker scans the technology stack for known Common Vulnerabilities and Exposures (CVEs) using the CVE.org database to identify security risks. The checker queries CVE.org REST API for each software component, analyzes CVSS scores and severity levels, compares against configurable thresholds, and provides detailed vulnerability reporting. Security Cost: 100 creditsView details](/auditors/cve-checker)[๐Ÿท๏ธ DNS Mail BIMI Auditor Validates BIMI for brand authentication in emails Validates BIMI (Brand Indicators for Message Identification) configuration for brand authentication. Security Cost: 10 creditsView details](/auditors/dns-mail-bimi-checker)[โœ๏ธ DNS Mail DKIM Auditor Validates DKIM signatures for email authentication Validates DKIM (DomainKeys Identified Mail) signatures for email authentication and integrity. SecurityMailDNSDKIM Cost: 20 creditsView details](/auditors/dns-mail-dkim-checker)[๐Ÿ”’ DNS Mail DMARC Auditor Validates DMARC policy for email authentication Validates DMARC (Domain-based Message Authentication, Reporting and Conformance) policy configuration. CrawlingSecurityDNSMail Cost: 50 creditsView details](/auditors/dns-mail-dmarc-checker)[๐Ÿ” DNS Mail MTA-STS Auditor Validates MTA-STS for secure email transmission Validates MTA-STS (Mail Transfer Agent Strict Transport Security) configuration for secure email transmission. SecurityDNSMail Cost: 20 creditsView details](/auditors/dns-mail-mta-sts-checker)[๐Ÿ“ง DNS Mail MX Auditor Validates MX records for proper email routing Validates MX (Mail Exchange) records for a domain to ensure proper email routing configuration. SecurityDNSMail Cost: 30 creditsView details](/auditors/dns-mail-mx-checker)[๐Ÿ›ก๏ธ DNS Mail SPF Auditor Validates SPF records to prevent email spoofing Validates SPF (Sender Policy Framework) records to prevent email spoofing and improve deliverability. SecurityMailDNSSPF Cost: 50 creditsView details](/auditors/dns-mail-spf-checker)[๐Ÿ“Š DNS Mail TLS-RPT Auditor Validates TLS-RPT for email security monitoring Validates TLS-RPT (TLS Reporting) configuration for monitoring email security issues. SecurityDNSMail Cost: 30 creditsView details](/auditors/dns-mail-tls-rpt-checker)[โฐ Domain Expiration Auditor Monitors domain expiration dates via RDAP to prevent service disruption Checks domain expiration dates using RDAP protocol to identify domains that are expiring soon and require renewal attention. ResilienceSecurityMonitoring Cost: 20 creditsView details](/auditors/domain-expiration-checker)[โ“ FAQ Auditor Detects FAQ pages using schema markup and content analysis This checker crawls websites to find FAQ pages using multiple detection methods including schema markup, microdata, and content analysis. The checker crawls website pages within the same domain, looks for JSON-LD with "@type": "FAQPage", scans for microdata with FAQPage itemtype, analyzes heading text for FAQ indicators, and limits crawling to prevent excessive requests. GEOSEOCrawling Cost: 50 creditsView details](/auditors/faq-checker)[๐Ÿ“Š Google Analytics Auditor Validates Google Analytics gtag.js implementation and configuration This checker validates that HTML pages contain proper Google Analytics implementation by checking for the presence of the Google Analytics Global Site Tag (gtag.js) script and its configuration. The checker analyzes the HTML page to look for gtag.js script tags with async attribute, validate Google Analytics measurement ID format (G-XXXXXXXXXX), check for proper script loading sequence and configuration, verify consistency between script src IDs and config IDs, detect legacy Universal Analytics (UA) IDs, and validate script placement in the head section. SEOContentGEO Cost: 10 creditsView details](/auditors/google-analytics-checker)[๐Ÿท๏ธ Google Tag Manager Auditor Validates Google Tag Manager implementation and configuration The Google Tag Manager Checker validates that HTML pages contain proper Google Tag Manager (GTM) implementation by checking for the presence of the GTM script, container ID, and proper configuration. GTM is a tag management system that allows you to quickly and easily update measurement codes and related code fragments on your website. The checker analyzes the HTML document to identify and validate Google Tag Manager implementation. It looks for: 1. Script Detection: Scans for inline scripts containing GTM implementation patterns 2. Container ID Validation: Extracts and validates GTM container IDs (format: GTM-XXXXXXX) 3. Script Structure Analysis: Verifies the script follows Google's recommended implementation pattern 4. DataLayer Initialization: Checks for proper dataLayer array initialization 5. GTM Events: Validates presence of gtm.start event and gtm.js event 6. Script Placement: Ensures GTM script is placed in the section for optimal loading 7. Noscript Fallback: Checks for noscript fallback implementation in the section 8. Performance Optimization: Validates async loading configuration Output Results: - Success: Google Tag Manager is properly configured and implemented - Warning: Google Tag Manager is detected but has configuration issues - Fail: Google Tag Manager script not found or completely missing SEOContentGEO Cost: 10 creditsView details](/auditors/google-tag-manager-checker)[๐Ÿ“‹ Heading Structure Auditor Validates HTML heading hierarchy and structure This checker validates that HTML headings follow proper hierarchical structure for accessibility and SEO best practices. The checker scans all heading elements (h1-h6) on the page, validates heading level progression (no skipping levels), checks for proper DOM nesting of headings, and identifies structural issues and violations. SEOGEO Cost: 20 creditsView details](/auditors/heading-structure-checker)[๐Ÿ”’ HSTS Preload Auditor Validates HSTS preload header configuration This checker validates the Strict-Transport-Security header to ensure it's properly configured for HSTS preload inclusion. The checker retrieves the Strict-Transport-Security header, validates max-age, includeSubDomains, and preload directives, and ensures proper configuration for preload inclusion. Security Cost: 20 creditsView details](/auditors/hsts-preload-checker)[๐Ÿ”„ HTTP Redirect Auditor Validates HTTP to HTTPS redirect configuration This checker validates that websites properly redirect HTTP requests to HTTPS to ensure secure connections are enforced. The checker converts HTTPS URL to HTTP for testing, sends HTTP request and monitors redirect response, validates redirect status codes and target URLs, and ensures redirects go to HTTPS. Security Cost: 10 creditsView details](/auditors/http-redirect-checker)[๐ŸŒ HTTP Version Auditor Detects supported HTTP protocol versions This checker detects which HTTP protocol versions are supported by the website, including HTTP/2 and HTTP/3 capabilities. The checker analyzes Alt-Svc header for HTTP/3 support, actively negotiates HTTP/2 connections, detects server capabilities and protocol support, and validates modern HTTP protocol adoption. General Cost: 30 creditsView details](/auditors/http-version-checker)[๐Ÿ–ผ๏ธ Image Alt Auditor Validates image alt attributes for accessibility compliance This checker analyzes all images on a webpage to ensure they have proper alt attributes for accessibility compliance and SEO optimization. The checker scans all img elements on the page, checks for presence and content of alt attributes, categorizes images as having valid alt, missing alt, or empty alt, and provides detailed reporting of problematic images. SEO Cost: 10 creditsView details](/auditors/image-alt-checker)[๐Ÿ“ฆ Large Resource Auditor Detects oversized resources affecting page performance This checker identifies resources (images, scripts, stylesheets) that exceed size thresholds and may impact page loading performance. The checker uses Playwright to load the page and extract resource URLs, checks content length of all resources (images, scripts, CSS, videos), identifies resources exceeding 500KB threshold, and provides detailed reporting of large resources. GeneralPerformanceSEOResilience Cost: 100 creditsView details](/auditors/large-resource-checker)[๐Ÿš€ Latest Version Auditor Validates software stack version against latest releases This checker validates software stack version information against the latest available releases to ensure your stack is up-to-date. Security Cost: 50 creditsView details](/auditors/latest-version-checker)[๐Ÿค– LLMs.txt Validates llms.txt files for AI-friendly content optimization The LLMs.txt checker validates the presence and format of llms.txt files on websites. These files provide LLM-friendly content and follow a specific markdown format to help language models understand website content. The checker ensures your site is optimized for AI-powered search engines and language models by validating required elements like H1 titles, blockquote summaries, and properly structured sections with links. SEOAIContent Cost: 50 creditsView details](/auditors/llms-txt-checker)[๐Ÿ“ Lorem Ipsum Auditor Detects placeholder text that should be replaced This checker scans web pages for Lorem Ipsum placeholder text that should be replaced with actual content before going live. The checker scans page text content for Lorem Ipsum patterns, detects various spellings and spacing variations, counts occurrences of placeholder text, and identifies pages with incomplete content. SEO Cost: 10 creditsView details](/auditors/lorem-ipsun-checker)[๐Ÿ“ Meta Description Length Auditor Validates meta description length for optimal SEO performance The Meta Description Length Checker validates that HTML pages contain a meta description tag with an appropriate length for optimal search engine optimization (SEO) performance. Meta descriptions are crucial for how your content appears in search engine results pages (SERPs) and can significantly impact click-through rates. The checker analyzes the HTML document's section to identify and validate the meta description tag. It performs the following checks: 1. Meta Tag Detection: Scans for tag in the document head 2. Content Extraction: Extracts the content attribute value and trims whitespace 3. Length Calculation: Counts the character length of the description text 4. Length Validation: Compares the length against SEO best practices (150-160 characters) 5. Range Assessment: Categorizes the length into optimal, acceptable, or problematic ranges Output Results: - Success: Meta description length is within the optimal range (150-160 characters) - Warning: Meta description length is slightly outside the optimal range (120-180 characters) - Fail: Meta description is missing or length is far outside the optimal range SEO Cost: 10 creditsView details](/auditors/meta-description-length-checker)[๐Ÿ“ฆ Minifier Auditor Checks if web resources are minified for optimal performance Analyzes web pages and their linked resources (CSS and JavaScript) to determine if they are properly minified for optimal performance and reduced file sizes. PerformanceResilience Cost: 50 creditsView details](/auditors/minifier-checker)[๐Ÿ”’ Mixed Content Auditor Detects HTTP resources on HTTPS pages and CSP upgrade directive Detects HTTP resources loaded on HTTPS pages and checks for Content Security Policy upgrade-insecure-requests directive to prevent mixed content vulnerabilities. Security Cost: 30 creditsView details](/auditors/mixed-content-checker)[๐Ÿ” Not Found Auditor Checks 404 page implementation and SEO best practices Validates that your website has a proper 404 error page strategy in place following SEO best practices. This checker ensures that non-existent pages return the correct HTTP status code, provide helpful content to users, and are properly configured to avoid negative SEO impact. SEOResilience Cost: 50 creditsView details](/auditors/not-found-checker)[๐Ÿ“ฑ OpenGraph Auditor Validates OpenGraph meta tags for social media sharing This checker validates that HTML pages contain proper OpenGraph meta tags for optimal social media sharing and preview generation. The checker scans for OpenGraph meta tags (og:title, og:type, og:image, og:url), validates tag values and URL formats, checks for semantic consistency and best practices, and identifies missing required tags and configuration issues. General Cost: 10 creditsView details](/auditors/opengraph-checker)[๐Ÿ“ Page Title Auditor Validates page title length and SEO optimization This checker validates that HTML page titles follow best practices for SEO and usability, ensuring they are within the recommended character length range. The checker extracts the title tag from the HTML, measures the title length in characters, and evaluates against SEO best practices (15-70 characters optimal). SEOGEO Cost: 10 creditsView details](/auditors/page-title-checker)[๐Ÿ”’ Permissions Policy Auditor Validates Permissions-Policy header for secure browser feature controls Validates the Permissions-Policy HTTP header configuration to ensure proper security controls for browser features and APIs SecurityHeaders Cost: 50 creditsView details](/auditors/permissions-policy-checker)[๐Ÿ’ฐ Pricing Auditor Detects pricing and subscription plan pages on websites The Pricing Checker crawls websites to detect the presence of pricing pages, subscription plans, or billing information. This checker is essential for businesses that need to verify their pricing information is discoverable and properly structured for potential customers and search engines. The checker performs a comprehensive website crawl to identify pricing-related content using multiple detection strategies: 1. Website Crawling: Systematically crawls up to 500 pages within the same domain to find pricing content 2. Schema.org Detection: Identifies structured data markup for pricing information including: - JSON-LD scripts with Offer, AggregateOffer, or PriceSpecification types - Microdata markup for pricing-related schema types - Product/Service schemas with price information 3. Content Analysis: Scans page content for pricing-related keywords in: - Headings (H1-H4) containing pricing terminology - Navigation links with pricing-related text - Buttons and call-to-action elements 4. Multi-language Support: Recognizes pricing terms in both English and Portuguese 5. Link Discovery: Follows internal links within the same domain to expand search coverage Output Results: - Success: Pricing/Plans page found with proper structure - Warning: Pricing information detected but may need improvement - Fail: No pricing/plans page found after comprehensive crawl SEO Cost: 50 creditsView details](/auditors/pricing-checker)[๐Ÿ”’ Referrer Policy Auditor Validates Referrer-Policy header for privacy protection This checker validates the Referrer-Policy header to ensure proper configuration for privacy protection and referrer information control. The checker retrieves the Referrer-Policy header from HTTP response, validates policy values against known standards, identifies discouraged or legacy policy values, and ensures proper privacy configuration. Security Cost: 20 creditsView details](/auditors/referrer-policy-checker)[๐Ÿค– Robots Crawl Delay Auditor Validates robots.txt crawl-delay directive presence This checker validates that websites have a robots.txt file with crawl-delay directive to control search engine crawling frequency. The checker fetches the robots.txt file from the website, scans for crawl-delay directive, and validates the directive format and presence. SEOCrawling Cost: 20 creditsView details](/auditors/robots-crawl-delay-checker)[๐Ÿท๏ธ Schema Entities Auditor Validates Schema.org structured data implementation This checker validates the presence and implementation of Schema.org structured data using JSON-LD, Microdata, and RDFa formats. The checker scans HTML for JSON-LD script tags with Schema.org context, analyzes microdata with itemscope/itemtype attributes, checks RDFa markup with typeof attributes, and validates Schema.org entity types and structure. SEOGEO Cost: 100 creditsView details](/auditors/schema-entities-checker)[๐Ÿ” Server Fingerprint Auditor Checks for server info disclosure in HTTP headers Detects server fingerprinting headers that may expose sensitive server information including software versions, technology stacks, and implementation details. SecurityPrivacy Cost: 10 creditsView details](/auditors/server-fingerprint-checker)[๐Ÿ—บ๏ธ Sitemap Auditor Validates XML sitemap availability and freshness This checker validates that websites have properly configured XML sitemaps that are accessible and up-to-date for search engine crawling. The checker discovers sitemap URLs from robots.txt and common locations, validates sitemap XML format and structure, checks sitemap freshness based on lastmod dates, and analyzes both sitemap index and URL set formats. SEOCrawling Cost: 10 creditsView details](/auditors/sitemap-checker)[โšก Time To First Byte Auditor Measures website response time performance This checker measures the Time To First Byte (TTFB) performance metric to evaluate website response speed and server performance. The checker sends HTTP request to the website, measures time from request to first byte received, and categorizes performance based on response time thresholds. It follows the recomendation of https://web.dev/articles/optimize-ttfb Performance Cost: 10 creditsView details](/auditors/ttfb-checker)[๐Ÿ”’ TLS Version Auditor Checks TLS protocol versions for security vulnerabilities Analyzes the TLS protocol versions supported by a web server to identify security vulnerabilities. This checker performs a comprehensive scan of TLS 1.0, 1.1, 1.2, and 1.3 support to ensure servers are configured with secure encryption protocols only. SecuritySSL Cost: 50 creditsView details](/auditors/tls-version-checker)[๐Ÿฆ Twitter Card Auditor Validates Twitter Card meta tags for social media sharing optimization The Twitter Card Checker validates that HTML pages contain proper Twitter Card meta tags according to Twitter's Card specification. Twitter Cards enhance how your content appears when shared on Twitter, providing rich previews with images, titles, and descriptions. The checker analyzes the HTML document's section to identify and validate Twitter Card meta tags. It looks for: 1. Meta Tag Detection: Scans for tags with name or property attributes starting with "twitter:" 2. Required Tag Validation: Ensures mandatory tags (twitter:card and twitter:title) are present and have non-empty values 3. Card Type Validation: Verifies that twitter:card values are valid (summary, summary_large_image, app, player) 4. URL Validation: Checks that image and URL references are absolute URLs 5. Semantic Validation: Validates card-type-specific requirements (e.g., summary_large_image requires twitter:image) 6. Accessibility Check: Ensures image alt text is provided when images are present 7. Duplicate Detection: Identifies duplicate meta tags that could cause conflicts Output Results: - Success: All required Twitter Card tags are present and properly configured - Warning: Twitter Card tags are present but have configuration issues - Fail: Required Twitter Card tags are missing or completely empty SEOSocial Networks Cost: 10 creditsView details](/auditors/twitter-card-checker)[๐Ÿ” X-Content-Type-Options Auditor Validates X-Content-Type-Options header for MIME sniffing protection This checker validates the X-Content-Type-Options header to ensure it's properly configured to prevent MIME sniffing attacks. The checker retrieves the X-Content-Type-Options header from HTTP response, validates that the header value is set to "nosniff", and checks for proper header configuration. Security Cost: 20 creditsView details](/auditors/x-content-type-options-checker)[๐Ÿ›ก๏ธ X-Frame-Options Auditor Validates X-Frame-Options header for clickjacking protection This checker validates the X-Frame-Options header to ensure it's properly configured to prevent clickjacking attacks. The checker retrieves the X-Frame-Options header from HTTP response, validates header values (DENY, SAMEORIGIN, ALLOW-FROM), and checks for proper security configuration. Security Cost: 20 creditsView details](/auditors/x-frame-options-checker) Need help understanding how these auditors work?[Contact our support team](/contact) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Website Auditing Blog - Insights & Best Practices Expert insights on website auditing, performance optimization, SEO friendliness, and troubleshooting. Learn from real-world case studies and industry best practices. [9/6/20253 min readHow Midnight Fire Drills Inspired Me to Build 37 AuditsMoments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients.downtimedamage-controlbusiness-impactThiago MoreiraRead More](/blog/how-midnight-fire-drills-inspired-me-to-build-37-audits)[8/26/20253 min readSSL Certificate Expiration: The Silent Website KillerLearn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business.sslsecuritycertificatesThiago MoreiraRead More](/blog/ssl-certificate-expiration-silent-killer)[8/21/20252 min readThe Hidden Costs of Website Downtime: A Customer's NightmareDiscover how unexpected website outages can devastate customer trust, revenue, and brand reputation. Learn from real-world examples of businesses that lost millions due to poor monitoring.downtimemonitoringbusiness-impactThiago MoreiraRead More](/blog/hidden-costs-website-downtime)[7/26/20259 min readPerformance Monitoring: Why Page Speed Kills ConversionsExplore the direct correlation between website performance and business success. Learn how slow loading times are costing you customers and revenue every day.performancepage-speedconversionsThiago MoreiraRead More](/blog/performance-monitoring-page-speed-conversions)[7/24/202510 min readThe Great CDN Failure: When Global Infrastructure Lets You DownA deep dive into how CDN outages can bring down thousands of websites simultaneously. Learn from major incidents and discover how to build resilience into your monitoring strategy.cdninfrastructureoutagesThiago MoreiraRead More](/blog/great-cdn-failure-global-infrastructure)[7/21/202511 min readJavaScript Errors: The Silent Conversion Killers Hiding in Your CodeUncover how client-side JavaScript errors are secretly destroying your user experience and conversion rates. Learn to detect, monitor, and fix these invisible problems.javascripterrorsmonitoringThiago MoreiraRead More](/blog/javascript-errors-silent-conversion-killers) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Meet 37AuditsBot - Your Website's Digital Inspector Learn how our intelligent bot works to audit your website's SEO, security, performance, and accessibility. User-Agent: 37AuditsBot/1.0 (+https://www.37audits.com/bot) ## What is 37 Audits? 37 Audits is a comprehensive website audit platform that provides automated checks for SEO, security, performance, accessibility, and resilience issues. Our platform helps businesses find and fix website problems before they cost rankings, revenue, or trust. Think of us as your website's digital health inspector. Just like a building inspector checks for structural issues, electrical problems, and safety hazards, our bot examines your website for technical issues that could impact your online success. ## How 37AuditsBot Works ### 1. Website Discovery Our bot visits your website using the user agent "37AuditsBot/1.0" and begins analyzing your site's structure, content, and technical implementation. ### 2. Comprehensive Analysis The bot runs over 50+ different checks covering SEO, security headers, performance metrics, accessibility standards, and more. ### 3. Detailed Report You receive a comprehensive audit report with actionable insights, prioritized recommendations, and specific fixes for each issue found. ### Technical Specifications #### Bot Identity User-Agent: 37AuditsBot/1.0 Website: https://www.37audits.com/bot Audit Duration: 30-60 seconds #### What We Check SEO optimization and meta tags Security headers and SSL certificates Performance and loading speed Accessibility compliance Mobile responsiveness ## Bot Behavior & Best Practices ### Respectful Crawling Follows robots.txt We respect your robots.txt file and won't crawl disallowed areas Rate Limited We crawl at a reasonable pace to avoid overwhelming your server Single Request Each audit typically requires only one HTTP request to your site ### What We Don't Do No Data Collection We don't store personal data or sensitive information from your site No Malicious Activity We only perform legitimate security and performance checks No Server Stress Our audits are lightweight and won't impact your site's performance ## Privacy & Security ### Data Protection We only collect technical metrics needed for the audit. No personal data or content is stored. ### Secure Analysis All audit data is encrypted in transit and at rest using industry-standard security protocols. ### Transparent Process You can see exactly what we check and how we analyze your website in our detailed reports. ## Frequently Asked Questions ### Can I block 37AuditsBot from crawling my site? Yes, you can add our bot to your robots.txt file. Add this line: `User-agent: 37AuditsBot` followed by `Disallow: /` ### How often does the bot crawl my website? The bot only crawls your website when you request an audit through our platform. We don't perform continuous monitoring unless you have an active subscription with scheduled audits. ### Will the bot affect my website's performance? No, our bot is designed to be lightweight and respectful. Each audit typically requires only one HTTP request and is completed within 30-60 seconds without impacting your site's performance. ### What information does the bot collect? We only collect technical metrics needed for the audit: page load times, HTTP headers, meta tags, accessibility issues, and security configurations. We don't collect personal data or store your website's content. ## Ready to Audit Your Website? Experience the power of 37AuditsBot and discover how to optimize your website for better performance, security, and user experience. Start Free Audit Contact Us [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Contact 37 Audits - Website Auditing Support Get in touch with our website auditing experts. We're here to help you optimize your site's performance, security, and user experience. ## Get in Touch Have questions about website auditing, need technical support, or want to discuss enterprise solutions? Our team is ready to help you achieve optimal website performance. ### Email Support We typically respond within 24 hours ### Enterprise Support Available for Enterprise customers Dedicated support line with SLA guarantee ### Global Auditing Worldwide infrastructure 24/7 auditing from multiple locations ### Common Questions Technical Issues:Auditing setup, false alerts, integration help Billing & Plans:Subscription changes, usage questions, enterprise pricing Feature Requests:New auditor suggestions, API enhancements, integrations ## Send us a Message ## Additional Support Resources ### Documentation Comprehensive guides and API documentation for website auditing setup ### Community Forum Connect with other users and share website auditing best practices ### Status Page Real-time status of our auditing infrastructure and services [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Home](/) # ๐Ÿ• Dogfooding in Action We eat our own dog food! Here are the real audit results for our own website, **37audits.com**. This demonstrates our commitment to quality and transparency - we use the same tools we provide to you. https://www.37audits.com 48 Total Checks 43 Passed 5 Warnings 0 Failed ## Audit Results ### Browser Console Messages Auditor [](/auditors/browser-console-messages-checker "View documentation") No console messages were found 8/17/2026 ### Cache Auditor [](/auditors/cache-checker "View documentation") Found 1 cache warnings (0 errors) 8/17/2026 ### CDN Coverage Auditor [](/auditors/cdn-coverage-checker "View documentation") All content (HTML + all discovered assets) is served via a CDN 8/17/2026 ### Certificate Auditor [](/auditors/certificate-auditor "View documentation") Certificate is valid for 53 day(s) 8/17/2026 ### Content Encoding Auditor [](/auditors/content-encoding-checker "View documentation") Content is served compressed with 'br' 8/17/2026 ### Content Security Policy Auditor [](/auditors/csp-checker "View documentation") Content-Security-Policy-Report-Only header detected - CSP is in report-only mode 8/17/2026 ### Cookie Auditor [](/auditors/cookie-checker "View documentation") No Set-Cookie headers found 8/17/2026 ### Cookie Consent Auditor [](/auditors/cookie-consent-checker "View documentation") Cookie consent banner found with both accept and reject options 8/17/2026 ### CSR/SSR Auditor [](/auditors/csr-ssr-checker "View documentation") Website appears to be Server-Side Rendered (SSR). Content is pre-rendered on the server. 8/17/2026 ### CVE Auditor [](/auditors/cve-checker "View documentation") No CVEs found for all components. 8/17/2026 ### DNS Mail BIMI Auditor [](/auditors/dns-mail-bimi-checker "View documentation") BIMI record is properly configured: v=BIMI1;l=https://www.37audits.com/logo.svg;a= 8/17/2026 ### DNS Mail DKIM Auditor [](/auditors/dns-mail-dkim-checker "View documentation") One or more DKIM keys with issues 8/17/2026 ### DNS Mail DMARC Auditor [](/auditors/dns-mail-dmarc-checker "View documentation") DMARC policy is properly configured: p=reject, aspf=r, adkim=r 8/17/2026 ### DNS Mail MTA-STS Auditor [](/auditors/dns-mail-mta-sts-checker "View documentation") MTA-STS policy mode=enforce from https://mta-sts.37audits.com/.well-known/mta-sts.txt 8/17/2026 ### DNS Mail MX Auditor [](/auditors/dns-mail-mx-checker "View documentation") MX records found: smtp.google.com 8/17/2026 ### DNS Mail SPF Auditor [](/auditors/dns-mail-spf-checker "View documentation") SPF record is properly configured 8/17/2026 ### DNS Mail TLS-RPT Auditor [](/auditors/dns-mail-tls-rpt-checker "View documentation") TLS-RPT record is properly configured: v=TLSRPTv1; rua=mailto:security-report@37audits.com 8/17/2026 ### Domain Expiration Auditor [](/auditors/domain-expiration-checker "View documentation") Domain is valid for 368 day(s) 8/17/2026 ### FAQ Auditor [](/auditors/faq-checker "View documentation") Found FAQ page: https://www.37audits.com/auditors 8/17/2026 ### Google Analytics Auditor [](/auditors/google-analytics-checker "View documentation") Google Analytics properly configured 8/17/2026 ### Google Tag Manager Auditor [](/auditors/google-tag-manager-checker "View documentation") Google Tag Manager properly configured 8/17/2026 ### Heading Structure Auditor [](/auditors/heading-structure-checker "View documentation") All headings are properly set 8/17/2026 ### HSTS Preload Auditor [](/auditors/hsts-preload-checker "View documentation") HSTS preload header is configured correctly 8/17/2026 ### HTTP Redirect Auditor [](/auditors/http-redirect-checker "View documentation") Site properly redirects HTTP to HTTPS with redirect code 308 8/17/2026 ### HTTP Version Auditor [](/auditors/http-version-checker "View documentation") HTTP/2 supported (no HTTP/3 advertisement found) 8/17/2026 ### Image Alt Auditor [](/auditors/image-alt-checker "View documentation") All 1 images have valid alt attributes 8/17/2026 ### Large Resource Auditor [](/auditors/large-resource-checker "View documentation") All resources are smaller than 512000 8/17/2026 ### Latest Version Auditor [](/auditors/latest-version-checker "View documentation") Auditor is capable to process Liferay stacks only 8/17/2026 ### LLMs.txt [](/auditors/llms-txt-checker "View documentation") llms.txt and optionally llms-full.txt properly formatted 8/19/2026 ### Lorem Ipsum Auditor [](/auditors/lorem-ipsun-checker "View documentation") No lorem ipsum text found 8/17/2026 ### Meta Description Length Auditor [](/auditors/meta-description-length-checker "View documentation") Meta description length is within the recommended range (150โ€“160 characters) 8/17/2026 ### Minifier Auditor [](/auditors/minifier-checker "View documentation") All resources are properly minified 8/17/2026 ### Mixed Content Auditor [](/auditors/mixed-content-checker "View documentation") No mixed content (HTTP resources) found 8/17/2026 ### Not Found Auditor [](/auditors/not-found-checker "View documentation") Excellent 404 page implementation 8/17/2026 ### OpenGraph Auditor [](/auditors/opengraph-checker "View documentation") Required OpenGraph tags present 8/17/2026 ### Page Title Auditor [](/auditors/page-title-checker "View documentation") Page title length is within the recommended range (15โ€“70 characters) 8/17/2026 ### Permissions Policy Auditor [](/auditors/permissions-policy-checker "View documentation") Permissions-Policy is properly configured 8/17/2026 ### Pricing Auditor [](/auditors/pricing-checker "View documentation") Found Pricing/Plans page 8/17/2026 ### Referrer Policy Auditor [](/auditors/referrer-policy-checker "View documentation") Referrer-Policy present with a recommended value 8/17/2026 ### Robots Crawl Delay Auditor [](/auditors/robots-crawl-delay-checker "View documentation") robots.txt contains crawl-delay 8/17/2026 ### Schema Entities Auditor [](/auditors/schema-entities-checker "View documentation") Found 2 Schema.org entities 8/17/2026 ### Server Fingerprint Auditor [](/auditors/server-fingerprint-checker "View documentation") Server fingerprinting headers found but no version information disclosed 8/17/2026 ### Sitemap Auditor [](/auditors/sitemap-checker "View documentation") Sitemap is available and fresh 8/17/2026 ### Time To First Byte Auditor [](/auditors/ttfb-checker "View documentation") TTFB is fast (average: 268 ms, min: 17 ms, max: 1242 ms) 8/17/2026 ### TLS Version Auditor [](/auditors/tls-version-checker "View documentation") TLS 1.3 is supported 8/17/2026 ### Twitter Card Auditor [](/auditors/twitter-card-checker "View documentation") Required Twitter Card tags present 8/17/2026 ### X-Content-Type-Options Auditor [](/auditors/x-content-type-options-checker "View documentation") X-Content-Type-Options is correctly set to nosniff 8/17/2026 ### X-Frame-Options Auditor [](/auditors/x-frame-options-checker "View documentation") X-Frame-Options present with a safe value 8/17/2026 ## Why We Dogfood Dogfooding (using your own product) is crucial for building trust and ensuring quality. By continuously auditing our own website, we: ### Ensure Quality We experience the same checks and results that you do, ensuring our tools work perfectly. ### Build Trust Transparency in our own results shows we're confident in our product and committed to quality. ### Continuous Improvement We identify issues in our own site first, which helps us improve our auditors for everyone. [Try It Yourself](/) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Website Auditing Credits - Simple & Transparent Purchase credits to power your website auditing. Choose between a monthly subscription or one-time credit packages that fit your auditing needs. ๐ŸŽ ### Free Get started with 3,000 credits. No card required. Free 3,000 Credits Included โ€ข ~1 full audits - 3,000 credits to use whenever you need - Full access to 40+ auditors - 1 URL auditing - 1 Organization, 1 Project and 1 Team member Sign Up Free โšก ### One-Time Purchase Need a full audit without a subscription? This option is for you. $20.00one-time 20,000 Credits Included โ€ข ~12 full audits - 20,000 credits to use whenever you need - Full access to 40+ auditors - 1 URL auditing - 1 Organization, 1 Project and unlimited team members Sign Up to Purchase Best Value ๐Ÿ”„ ### Monthly Subscription Perfect for ongoing website monitoring and regular audits. $12.00/month 30,000 Credits Included โ€ข ~19 full audits - Get 30,000 credits refilled every month - Full access to 40+ auditors - Unlimited URL auditing - Unlimited Organizations, Projects and Team members - Cancel anytime โ€” no commitment Sign Up to Purchase ๐Ÿข ### Enterprise API access, Custom limits, SLAs, SSO, and dedicated support. Custom Custom Credits & Features - API access (integrate in your tool/service) - Unlimited projects and URLs - SSO/SAML and security reviews - Priority support and SLA - Custom integrations and onboarding [Contact Us](/contact) ## Frequently Asked Questions Common questions about website auditing credits and billing ### How do credits work? Credits are used to run auditing checks on your websites. Each auditor has a specific credit cost (typically 1-5 credits per check). Credits are deducted when you run checks, and you can purchase more as needed. ### What's the difference between subscription and one-time? Monthly subscriptions provide 10,000 credits that refill each month and auto-renew. One-time purchases give you 10,000 credits to use at your own pace without recurring charges. ### Do credits expire? Subscription credits refill monthly and don't carry over. One-time purchase credits never expire and can be used whenever you need them. You can also earn bonus credits through our referral program. ### Can I cancel my subscription? Yes, you can cancel your monthly subscription at any time from your account settings. You'll continue to have access until the end of your current billing period, and no future charges will occur. ## Ready to Power Your Auditing? Get the credits you need to keep your websites running at peak performance. Start auditing today with our comprehensive suite of auditors. Get Started Free [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Privacy Policy - 37 Audits Website Auditing How we collect, use, and protect your data in our auditing services Last updated: January 2025 ## 1. Information We Collect We collect information to provide better website auditing services: ### Account Information: - Email address and name for account creation - Billing information for paid subscriptions - Communication preferences and support interactions ### Auditing Data: - URLs you choose to monitor - Website performance metrics and uptime data - SSL certificate information and security headers - Error logs and response times from monitored websites ## 2. How We Use Your Information We use the collected information for: - Providing website auditing services and alerts - Generating performance reports and analytics - Billing and account management - Customer support and technical assistance - Improving our auditing algorithms and services - Sending important service updates and security notifications ## 3. Data Storage and Security We implement industry-standard security measures: - Data is encrypted in transit and at rest - Access to your data is restricted to authorized personnel only - Regular security audits and vulnerability assessments - Secure data centers with physical and network security - Data retention policies based on your subscription plan ## 4. Data Sharing and Disclosure We do not sell, trade, or rent your personal information. We may share data only in these circumstances: - With your explicit consent - To comply with legal obligations or court orders - To protect our rights, property, or safety - With trusted service providers who assist in our operations (under strict confidentiality agreements) - In connection with a merger, acquisition, or sale of assets (with prior notice) ## 5. Your Rights and Choices You have the right to: - Access, update, or delete your personal information - Export your auditing data at any time - Opt-out of non-essential communications - Request data portability to another service - Lodge a complaint with relevant data protection authorities ## 6. Cookies and Tracking We use cookies and similar technologies to enhance your experience, analyze usage patterns, and provide personalized content. You can control cookie settings through your browser preferences. Essential cookies required for service functionality cannot be disabled. ## 7. Third-Party Services Our auditing service may interact with third-party services and websites. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party services you use. ## 8. International Data Transfers Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. ## 9. Children's Privacy Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us immediately. ## 10. Changes to Privacy Policy We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy. ## 11. Contact Us If you have any questions about this Privacy Policy or our data practices, please contact us at ## Privacy at a Glance ### Data Encryption All data is encrypted in transit and at rest using industry-standard protocols ### No Data Selling We never sell, trade, or rent your personal information to third parties ### Data Control You own your data and can access, export, or delete it at any time ## Questions About Privacy? Our team is here to address any privacy concerns or questions you may have. Contact Us ## Cookie Management Manage your cookie preferences and consent settings ### Current Status No consent given yet Pending ### Cookie Categories #### Necessary Cookies Required Essential for the website to function properly. These cookies enable basic functionalities and security features. #### Analytics Cookies Help us understand how visitors interact with our website by collecting anonymous information. #### Functional Cookies Enable enhanced functionality and personalization, such as remembering your preferences. #### Marketing Cookies Used to track visitors and display relevant ads and marketing campaigns. Save Preferences Accept All Necessary Only Reset All Changes take effect immediately. Some features may require a page refresh to fully apply. [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact # Terms of Service - 37 Audits Website Auditing Terms and conditions for using our website auditing services Last updated: January 2025 ## 1. Acceptance of Terms By accessing and using 37 Audits website auditing services, you accept and agree to be bound by the terms and provision of this agreement. If you do not agree to abide by the above, please do not use this service. ## 2. Service Description 37 Audits provides website auditing services including but not limited to SSL certificate auditing, performance analysis, uptime auditing, and security checks. We monitor your websites and provide alerts and reports based on our auditing results. ## 3. User Accounts and Responsibilities When you create an account with us, you must provide information that is accurate, complete, and current at all times. You are responsible for: - Safeguarding your account password and all activities under your account - Ensuring the websites you monitor are owned by you or you have permission to monitor them - Complying with all applicable laws and regulations - Not using our service for any unlawful or prohibited activities ## 4. Service Availability and Limitations We strive to provide reliable auditing services, however: - We do not guarantee 100% uptime of our auditing services - Auditing frequency depends on your subscription plan - We may temporarily suspend service for maintenance or updates - Some websites may be inaccessible due to their own restrictions or configurations ## 5. Payment and Billing For paid services: - Subscription fees are billed in advance on a monthly or annual basis - All fees are non-refundable except as required by law - We may change our pricing with 30 days notice - Failure to pay may result in service suspension or termination ## 6. Data and Privacy We collect and process auditing data from your websites as described in our Privacy Policy. We implement appropriate security measures to protect your data, but cannot guarantee absolute security. You retain ownership of your data and can export or delete it at any time. ## 7. Limitation of Liability 37 Audits shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including without limitation, loss of profits, data, use, goodwill, or other intangible losses, resulting from your use of our services. ## 8. Termination We may terminate or suspend your account immediately, without prior notice or liability, for any reason whatsoever, including without limitation if you breach the Terms. Upon termination, your right to use the service will cease immediately. ## 9. Changes to Terms We reserve the right to modify or replace these Terms at any time. If a revision is material, we will try to provide at least 30 days notice prior to any new terms taking effect. ## 10. Contact Information If you have any questions about these Terms of Service, please contact us at ## Ready to Start Auditing? Join thousands of websites using 37 Audits for reliable performance auditing. Get Started [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ› # Browser Console Messages Auditor Performance Auditor [Back](/auditors) Detects JavaScript errors and console messages PerformanceJavaScript 50 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker uses a headless browser to detect JavaScript errors and console messages that may indicate issues with the website. The checker uses Playwright to load the page in a headless browser, captures all console messages and errors, monitors for JavaScript execution issues, and reports any console errors or warnings. ## What this auditor validates This checker uses a headless browser to detect JavaScript errors and console messages that may indicate issues with the website. It uses Playwright to load the page in a headless browser, captures all console messages and errors, monitors for JavaScript execution issues, and reports any console errors or warnings. ## Output Documentation | Status | Condition | Test Logic | | ----------- | -------------------- | ------------------------------------------------- | | **SUCCESS** | No console errors | No JavaScript errors or console messages detected | | **FAIL** | Console errors found | JavaScript errors or console messages detected | ## Risks and Considerations **Functionality Issues**: JavaScript errors can break website functionality, leading to poor user experience. **Performance Problems**: Console errors may indicate underlying performance issues. **User Frustration**: Broken functionality can drive users away and damage your brand reputation. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ—„๏ธ # Cache Auditor Performance Auditor [Back](/auditors) Validates cache headers for optimal web performance PerformanceResilience 50 credits Per check ~30 seconds Average runtime Active Status ## How it works A comprehensive cache validation checker that analyzes cache headers for different types of web resources according to industry best practices. It validates cache configuration for HTML pages, static assets, and API responses, with platform-specific logic for Liferay environments. ## What this auditor validates ## What It Checks The Cache Checker analyzes HTTP cache headers across different types of web resources to ensure optimal caching strategies: - **HTML Pages**: Validates that HTML responses have appropriate cache directives (max-age=0, must-revalidate, or no-cache) with proper validators (ETag/Last-Modified) - **Versioned Static Assets**: Ensures versioned resources (JS, CSS, images with version parameters) have long-term caching (max-age โ‰ฅ 1 year) with immutable directive - **Unversioned Static Assets**: Checks that unversioned resources use short cache times (โ‰ค 1 hour) or revalidation mechanisms - **API Responses**: Validates API endpoints have appropriate cache strategies with proper validators - **Platform-Specific Logic**: Automatically routes to Liferay-specific cache validation when Liferay is detected in the software stack The checker examines Cache-Control, ETag, Last-Modified, Set-Cookie, Vary, and Expires headers to identify caching issues. ## Output Documentation ## Output Documentation | Status | Description | Test Logic | | ----------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SUCCESS** | All resources have proper cache configuration according to best practices | - HTML: Cache-Control max-age=0 with must-revalidate/no-cache and has ETag/Last-Modified - Versioned assets: public, max-ageโ‰ฅ31536000, immutable, no cookies - Unversioned assets: max-ageโ‰ค3600 or uses revalidation - No Set-Cookie on cacheable responses - No problematic Vary headers | | **WARNING** | Some resources have cache configuration issues that should be addressed | - HTML cached >5 minutes without must-revalidate/no-cache - Versioned assets lack immutable or have max-age <1 year - Unversioned assets cached โ‰ฅ1 day - Missing ETag/Last-Modified on resources expected to revalidate - Excessive Vary headers (>3) that may hurt cache hit rate - Expires vs Cache-Control mismatch | | **FAIL** | Critical cache configuration problems that prevent effective caching | - Set-Cookie header present on publicly cacheable resources - Vary: \* preventing effective caching - User-specific Vary headers on HTML resources - HTML cached >1 day without revalidation - Contradictory cache directives that disable safe caching - Missing Cache-Control header entirely | ## Risks and Considerations ## Risks of Ignoring Cache Issues **Performance Degradation**: - Poor cache configuration leads to unnecessary server requests and bandwidth usage - Users experience slower page load times due to repeated downloads of unchanged resources - Increased server load and hosting costs from redundant resource serving **SEO and User Experience Impact**: - Slow loading pages negatively affect search engine rankings - Poor user experience leads to higher bounce rates and reduced conversions - Mobile users on slow connections are particularly affected **Security and Privacy Concerns**: - Set-Cookie headers on cacheable resources can expose sensitive user data - Improper Vary headers may cache user-specific content inappropriately - Long-lived HTML caching without revalidation can serve stale or sensitive content **Operational Issues**: - Difficult to deploy updates when resources are cached too aggressively - Inconsistent cache behavior across different browsers and CDNs - Debugging becomes complex when cache issues mask other problems ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐ŸŒ # CDN Coverage Auditor Performance Auditor [Back](/auditors) Checks if your website content is served through a CDN PerformanceDeliveryResilience 30 credits Per check ~30 seconds Average runtime Active Status ## How it works Analyzes whether your website and its static assets (CSS, JavaScript, images, fonts, videos) are being served through a Content Delivery Network (CDN). This checker examines the main HTML document and all first-load assets to determine CDN coverage across your entire website. ## What this auditor validates ## What This Checker Analyzes The CDN Coverage Checker performs a comprehensive analysis of your website's content delivery infrastructure by: ### HTML Document Analysis - Fetches the main HTML document from the provided URL - Checks if the HTML itself is served through a CDN by analyzing: * Hostname patterns (e.g., `.cloudfront.net`, `.fastly.net`, `.akamai.net`) * HTTP response headers (e.g., `cf-cache-status`, `x-amz-cf-id`, `x-cache`) * CNAME DNS resolution chains to detect CDN endpoints ### Static Asset Discovery The checker automatically discovers and analyzes all first-load static assets including: - **CSS files** () - **JavaScript files** ( ## Output Documentation ## Output Documentation | Status | Condition | Description | | -------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **โœ… Success** | All content served via CDN | Both the HTML document and all discovered static assets (CSS, JS, images, fonts, videos) are served through a CDN. This is the optimal configuration for performance and scalability. | | **โš ๏ธ Warning** | Partial CDN coverage | Either: โ€ข Only static assets are served via CDN while HTML is not โ€ข Mixed coverage where some assets use CDN and others don't This indicates room for optimization in your CDN strategy. | | **โŒ Fail** | No CDN coverage | Neither the HTML document nor any of the discovered static assets are served through a CDN. This configuration may result in poor performance, especially for users geographically distant from your origin server. | ### Detailed Analysis Data The checker provides comprehensive data including: - **HTML CDN Status**: Whether the main document uses CDN - **Asset Breakdown**: Individual CDN status for each discovered asset - **Coverage Statistics**: Total assets found vs. assets served via CDN - **Detection Methods**: How CDN usage was identified (hostname, headers, or CNAME resolution) ## Risks and Considerations ## Risks of Poor CDN Coverage ### Performance Impact - **Increased Load Times**: Without CDN distribution, users far from your origin server experience significantly slower page loads - **Higher Time to First Byte (TTFB)**: Each request travels the full distance to your origin server - **Poor User Experience**: Slow-loading assets create frustrating user experiences, especially for mobile users ### Scalability Issues - **Origin Server Overload**: All traffic hits your origin server directly, creating potential bottlenecks - **Bandwidth Costs**: Higher bandwidth usage at your origin location increases hosting costs - **Geographic Performance Disparity**: Users in different regions experience vastly different performance ### Business Consequences - **SEO Impact**: Google's Core Web Vitals consider loading speed as a ranking factor - **Conversion Rate Loss**: Studies show that even 100ms delays can reduce conversion rates - **Competitive Disadvantage**: Slower websites lose users to faster competitors - **Mobile Performance**: Poor CDN coverage particularly impacts mobile users on slower connections ### Availability Risks - **Single Point of Failure**: No geographic redundancy if your origin server experiences issues - **DDoS Vulnerability**: Direct exposure of origin server to all traffic without CDN protection - **Limited Caching**: Missing out on edge caching benefits that reduce server load ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # Certificate Auditor Security Auditor [Back](/auditors) Validates SSL certificate validity and expiration status SecuritySSL 50 credits Per check ~30 seconds Average runtime Active Status ## How it works This auditor validates SSL certificates for HTTPS websites, ensuring they are properly configured and not expired. The checker connects to the website via HTTPS, retrieves the server's SSL certificate chain, extracts certificate information including expiration date, and validates certificate format and validity. ## What this auditor validates This checker validates SSL certificates for HTTPS websites, ensuring they are properly configured and not expired. It connects to the website via HTTPS, retrieves the server's SSL certificate chain, extracts certificate information including expiration date, and validates certificate format and validity. ## Output Documentation | Status | Condition | Test Logic | | ----------- | -------------------- | ----------------------------------------------------------------------------- | | **SUCCESS** | Certificate is valid | Valid X509 certificate found with proper expiration date | | **WARNING** | URL is not HTTPS | Certificate check not applicable for non-HTTPS URLs | | **FAIL** | Certificate issues | No certificate found, SSL connection failed, or certificate validation errors | ## Risks and Considerations **Security Vulnerabilities**: Expired or invalid certificates can expose your website to man-in-the-middle attacks and data breaches. **User Trust Loss**: Browsers will show security warnings, causing users to abandon your site. **SEO Penalties**: Search engines may rank your site lower due to security concerns. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ—œ๏ธ # Content Encoding Auditor Performance Auditor [Back](/auditors) Validates content compression for performance optimization PerformanceContent 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that websites use proper content encoding (gzip, deflate, brotli) to optimize page loading performance. The checker sends HTTP request with Accept-Encoding header, analyzes Content-Encoding response header, validates compression method and configuration, and ensures proper content compression. ## What this auditor validates This checker validates that websites use proper content encoding (gzip, deflate, brotli) to optimize page loading performance. It sends HTTP request with Accept-Encoding header, analyzes Content-Encoding response header, validates compression method and configuration, and ensures proper content compression. ## Output Documentation | Status | Condition | Test Logic | | ----------- | --------------------------- | ----------------------------------------------------- | | **SUCCESS** | Content properly compressed | Content-Encoding header with valid compression method | | **WARNING** | Unknown compression method | Content-Encoding present but with unrecognized value | | **FAIL** | No content compression | Content-Encoding header missing | ## Risks and Considerations **Poor Performance**: Uncompressed content loads slower, leading to increased bounce rates and poor user experience. **Increased Costs**: Larger file sizes consume more bandwidth and hosting resources. **SEO Impact**: Page speed affects search rankings, and uncompressed content can hurt your SEO. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿช # Cookie Auditor Security Auditor [Back](/auditors) Validates cookie security attributes and configuration Security 50 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker analyzes Set-Cookie headers for security best practices including Secure, HttpOnly, and SameSite attributes. The checker retrieves all Set-Cookie headers from HTTP response, analyzes each cookie for security attributes, validates Secure, HttpOnly, and SameSite configuration, and checks for proper domain and path settings. ## What this auditor validates This checker analyzes Set-Cookie headers for security best practices including Secure, HttpOnly, and SameSite attributes. It retrieves all Set-Cookie headers from HTTP response, analyzes each cookie for security attributes, validates Secure, HttpOnly, and SameSite configuration, and checks for proper domain and path settings. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ---------------------------- | ------------------------------------------------------------ | | **SUCCESS** | All cookies secure | All cookies have recommended security attributes | | **WARNING** | Cookies with recommendations | Cookies present with non-critical security recommendations | | **FAIL** | Cookie security issues | Cookies have severe security issues (missing HttpOnly, etc.) | ## Risks and Considerations **Security Vulnerabilities**: Insecure cookies can be stolen through XSS attacks or man-in-the-middle attacks. **Data Breaches**: Compromised cookies can lead to unauthorized access and data theft. **Compliance Violations**: Many security standards require secure cookie configuration. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿช # Cookie Consent Auditor General Auditor [Back](/auditors) Checks for proper cookie consent banners with accept/reject options LegalGDPRPrivacy 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Analyzes websites for cookie consent banners and GDPR compliance mechanisms. This checker detects the presence of cookie consent interfaces, validates the availability of both accept and reject options, and assesses whether users have proper control over their cookie preferences. ## What this auditor validates ## What This Checker Analyzes The Cookie Consent Checker performs a comprehensive analysis of cookie consent implementations on websites: ### Detection Mechanisms - **Banner Identification**: Scans for cookie consent banners using multiple CSS selectors and patterns - **Visibility Assessment**: Ensures detected consent mechanisms are actually visible to users - **Button Analysis**: Identifies and categorizes available user options (accept, reject, settings) - **Content Analysis**: Extracts banner text and analyzes the consent mechanism type ### Compliance Elements Checked - **Accept Options**: Presence of buttons to accept cookies (e.g., "Accept All", "Allow") - **Reject Options**: Presence of buttons to decline cookies (e.g., "Reject All", "Essential Only") - **Privacy Links**: Detection of privacy policy or cookie policy links - **Granular Controls**: Identification of preference management options - **Default Behavior**: Analysis of whether non-essential cookies are blocked by default ### Technical Implementation - Uses browser automation to load pages realistically - Monitors cookie setting behavior before and after user interactions - Analyzes DOM structure for consent-related elements - Supports multiple consent banner formats (modals, banners, overlays) ## Output Documentation ## Output Documentation | Status | Condition | Description | Test Logic | | ------------- | -------------------------------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | **๐ŸŸข SUCCESS** | Banner with both accept and reject options | A cookie consent banner is detected with both accept and reject functionality available | `hasConsentBanner() == true AND hasAcceptAllOption() == true AND hasRejectOption() == true` | | **๐ŸŸก WARNING** | Banner present but missing accept or reject option | A cookie consent banner is found but lacks either accept or reject functionality | `hasConsentBanner() == true AND (hasAcceptAllOption() == false OR hasRejectOption() == false)` | | **๐Ÿ”ด FAIL** | No consent banner detected | No visible cookie consent mechanism is found on the page | `hasConsentBanner() == false` | ### Response Messages - **Success**: "Cookie consent banner found with both accept and reject options" - **Warning**: "Cookie consent banner found but missing [accept/reject/both accept and reject] option(s)" - **Fail**: "No cookie consent banner detected" ### Additional Data Returned The checker provides detailed information in the response data: - Complete consent mechanism analysis (`CookieConsentData`) - Detected banner selectors and text content - Available user options and button types - Cookie behavior before and after consent actions - Privacy policy link presence - Consent mechanism classification (None, Binary Choice, Accept Only, Granular) ## Risks and Considerations ## Risks of Ignoring Cookie Consent Issues ### Legal and Regulatory Risks - **GDPR Violations**: Fines up to โ‚ฌ20 million or 4% of annual turnover for non-compliance - **Privacy Law Violations**: Breach of CCPA, LGPD, and other regional privacy regulations - **Legal Action**: Potential lawsuits from users whose privacy rights were violated - **Regulatory Investigations**: Scrutiny from data protection authorities ### Business and Reputation Risks - **User Trust Loss**: Visitors may lose confidence in your brand's data handling practices - **Reduced Conversions**: Poor consent experience can lead to higher bounce rates - **Competitive Disadvantage**: Non-compliant sites may be avoided by privacy-conscious users - **Brand Damage**: Negative publicity from privacy violations ### Technical and Operational Risks - **Analytics Gaps**: Incorrect consent implementation can lead to incomplete data collection - **Ad Revenue Loss**: Improper consent may reduce advertising effectiveness and revenue - **Integration Issues**: Third-party services may not function correctly without proper consent - **Cookie Blocking**: Modern browsers may block tracking without valid consent ### User Experience Impact - **Accessibility Issues**: Poor consent interfaces may exclude users with disabilities - **Mobile Usability**: Inadequate mobile consent experiences frustrate users - **Performance Impact**: Poorly implemented consent can slow page loading - **Confusion**: Unclear consent options lead to user frustration and abandonment ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ›ก๏ธ # Content Security Policy Auditor Security Auditor [Back](/auditors) Validates Content-Security-Policy header configuration Security 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates the Content-Security-Policy header for presence and security configuration, flagging policies containing unsafe directives that weaken XSS protection. The checker retrieves the Content-Security-Policy header from HTTP response, analyzes the policy for unsafe directives (unsafe-inline, unsafe-eval), and validates policy syntax and configuration. ## What this auditor validates This checker validates the Content-Security-Policy header for presence and security configuration, flagging policies containing unsafe directives that weaken XSS protection. It retrieves the Content-Security-Policy header from HTTP response, analyzes the policy for unsafe directives (unsafe-inline, unsafe-eval), and validates policy syntax and configuration. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------------ | -------------------------------------------------------- | | **SUCCESS** | CSP header present and secure | CSP header found with no unsafe directives | | **WARNING** | CSP contains unsafe directives | Header present but contains unsafe-inline or unsafe-eval | | **FAIL** | Missing CSP header | No Content-Security-Policy header found | ## Risks and Considerations **XSS Attacks**: Missing or weak CSP policies leave your site vulnerable to cross-site scripting attacks. **Data Theft**: Malicious scripts can steal user data, session tokens, and sensitive information. **Reputation Damage**: Security breaches can severely damage your brand reputation and user trust. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”„ # CSR/SSR Auditor Performance Auditor [Back](/auditors) Detects if website uses Client-Side or Server-Side Rendering SEOPerformance 30 credits Per check ~30 seconds Average runtime Active Status ## How it works Evaluates whether a website is Client-Side Rendered (CSR) or Server-Side Rendered (SSR) by comparing HTML content with JavaScript enabled vs disabled. ## What this auditor validates This checker evaluates whether a website is Client-Side Rendered (CSR) or Server-Side Rendered (SSR) by making two requests to the same URL: one with JavaScript enabled and one with JavaScript disabled. It then compares the HTML content from both requests to determine the rendering approach. The checker uses a size-based comparison algorithm that calculates the percentage difference between the HTML sizes. If the size difference is more than 20%, the site is considered CSR. ## Output Documentation | Status | Description | Test Logic | | ----------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SUCCESS** | Website is Server-Side Rendered (SSR). Content is pre-rendered on the server. | The checker compares HTML content size with JavaScript enabled vs disabled. If the size difference is โ‰ค 20%, the site is considered SSR. This indicates that most content is pre-rendered on the server and doesn't require JavaScript to display properly. | | **WARNING** | Website is Client-Side Rendered (CSR). Content is dynamically generated by JavaScript. | The checker detects a size difference > 20% between HTML with JavaScript enabled vs disabled. This indicates that significant content is generated dynamically by JavaScript, making the site dependent on client-side rendering. | | **ERROR** | Technical error occurred during checking (Playwright/browser issues). | Browser automation fails due to network issues, timeout, or Playwright exceptions. The checker includes retry logic for transient crashes but will return ERROR for persistent technical problems. | | **FAIL** | Unexpected error or all retry attempts exhausted. | Fallback status when all retry attempts fail or an unexpected error occurs that doesn't fit into the ERROR category. This is a catch-all for system-level failures. | ## Risks and Considerations Ignoring CSR/SSR warnings can lead to several risks: **SEO Impact** - CSR sites may have poor search engine visibility as crawlers prefer pre-rendered content; **Performance Issues** - CSR sites often have slower initial page loads and poor Core Web Vitals scores; **Accessibility Problems** - Content that requires JavaScript may be inaccessible to users with disabilities or those using assistive technologies; **Crawler Compatibility** - Search engine crawlers may not execute JavaScript properly, leading to incomplete content indexing; **User Experience** - Users on slow connections or with JavaScript disabled may see blank or broken pages. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ” # CVE Auditor Security Auditor [Back](/auditors) Scans software stack for known security vulnerabilities Security 100 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker scans the technology stack for known Common Vulnerabilities and Exposures (CVEs) using the CVE.org database to identify security risks. The checker queries CVE.org REST API for each software component, analyzes CVSS scores and severity levels, compares against configurable thresholds, and provides detailed vulnerability reporting. ## What this auditor validates This checker scans the technology stack for known Common Vulnerabilities and Exposures (CVEs) using the CVE.org database to identify security risks. It queries CVE.org REST API for each software component, analyzes CVSS scores and severity levels, compares against configurable thresholds, and provides detailed vulnerability reporting. ## Output Documentation | Status | Condition | Test Logic | | ----------- | -------------------------- | ---------------------------------------------------- | | **SUCCESS** | No CVEs found | No vulnerabilities meeting threshold criteria | | **WARNING** | CVEs found below threshold | Vulnerabilities found but below critical threshold | | **FAIL** | Critical CVEs found | Vulnerabilities found meeting or exceeding threshold | ## Risks and Considerations **Security Breaches**: Unpatched vulnerabilities can lead to data breaches, unauthorized access, and system compromise. **Compliance Violations**: Many industries require regular security assessments, and unaddressed CVEs can result in compliance failures. **Reputation Damage**: Security incidents can severely damage customer trust and brand reputation. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿท๏ธ # DNS Mail BIMI Auditor Security Auditor [Back](/auditors) Validates BIMI for brand authentication in emails Security 10 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates BIMI (Brand Indicators for Message Identification) configuration for brand authentication. ## What this auditor validates ## What it checks This checker validates BIMI (Brand Indicators for Message Identification) configuration for brand authentication. It checks: - **BIMI Record Presence**: Verifies that a TXT record exists at `default._bimi.domain` - **Valid BIMI Version**: Confirms the record starts with `v=BIMI1` - **Record Format**: Ensures the record follows the correct BIMI format The checker performs DNS TXT record lookups and validates BIMI record syntax. Note that BIMI is optional, so missing records result in warnings, not failures. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | -------------------------- | ------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | **SUCCESS** | BIMI properly configured | - BIMI record exists with valid syntax - Record starts with v=BIMI1 - Record format is correct | Domain has properly configured BIMI for brand authentication | | **WARNING** | BIMI missing or has issues | - No BIMI record found (optional) - BIMI record exists but malformed - Record does not start with v=BIMI1 | BIMI is optional; missing or malformed records result in warnings | | **FAIL** | Never occurs | - This checker never returns FAIL status | BIMI is optional and never causes failures | | **ERROR** | Technical failure | - DNS lookup failed - HTTP request failed - Network connectivity issues - Invalid domain format | Technical error occurred during BIMI validation | ## Risks and Considerations ## Risks of ignoring BIMI configuration issues If BIMI is missing or misconfigured, the following risks apply: - **Brand Impersonation**: Attackers may impersonate your brand in phishing emails - **Customer Trust Loss**: Recipients may not recognize legitimate emails from your organization - **Phishing Vulnerability**: Lack of brand authentication makes phishing attacks more effective - **Competitive Disadvantage**: Other organizations may appear more trustworthy in email clients - **Compliance Issues**: Some industries require BIMI for brand protection - **Reputation Damage**: Lack of brand authentication may affect email deliverability - **Customer Confusion**: Recipients may be unsure about email authenticity - **Business Risk**: Brand impersonation may lead to financial losses and legal issues ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact โœ๏ธ # DNS Mail DKIM Auditor Security Auditor [Back](/auditors) Validates DKIM signatures for email authentication SecurityMailDNSDKIM 20 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates DKIM (DomainKeys Identified Mail) signatures for email authentication and integrity. ## What this auditor validates ## What it checks This checker validates DKIM (DomainKeys Identified Mail) signatures for email authentication and integrity. It checks: - **DKIM Record Presence**: Verifies that DKIM TXT records exist for common selectors - **Valid DKIM Syntax**: Confirms records follow the correct DKIM format - **Selector Configuration**: Checks for common DKIM selectors (default, google, k1, selector1, selector2) - **Record Format**: Validates that records start with v=DKIM1 or contain p= parameter The checker performs DNS TXT record lookups for DKIM selectors and validates DKIM record syntax. It checks multiple common selectors and provides detailed results for each. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | | **SUCCESS** | DKIM properly configured | - DKIM records exist for all checked selectors - Records start with v=DKIM1 or contain p= parameter - Record syntax is correct | Domain has properly configured DKIM for email authentication | | **WARNING** | DKIM partially configured | - DKIM records exist for some selectors but not all - Some selectors are missing or invalid - Mixed results across different selectors | DKIM is partially configured; some selectors are missing | | **FAIL** | DKIM completely missing | - No DKIM records found for any selectors - All checked selectors are missing - No valid DKIM configuration found | Domain lacks any DKIM configuration | | **ERROR** | Technical failure | - DNS lookup failed - Network connectivity issues - Invalid domain format | Technical error occurred during DKIM validation | ## Risks and Considerations ## Risks of ignoring DKIM configuration issues If DKIM is missing or misconfigured, the following risks apply: - **Email Authentication Failure**: Emails may fail authentication checks - **Email Deliverability Issues**: Legitimate emails may be rejected or marked as spam - **Email Spoofing**: Attackers may send emails claiming to be from your domain - **Integrity Issues**: Email content may be tampered with during transmission - **Compliance Violations**: Some industries require DKIM for email security - **Reputation Damage**: Your domain may be blacklisted by email providers - **Business Communication Risk**: Important emails may not reach recipients - **Customer Trust Loss**: Recipients may lose confidence in emails from your domain ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # DNS Mail DMARC Auditor Security Auditor [Back](/auditors) Validates DMARC policy for email authentication CrawlingSecurityDNSMail 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates DMARC (Domain-based Message Authentication, Reporting and Conformance) policy configuration. ## What this auditor validates ## What it checks This checker validates DMARC (Domain-based Message Authentication, Reporting and Conformance) policy configuration. It checks: - **DMARC Record Presence**: Verifies that a DMARC TXT record exists at `_dmarc.domain` - **Valid DMARC Version**: Confirms the record starts with `v=DMARC1` - **Policy Enforcement**: Validates the policy setting (`p=quarantine` or `p=reject`) - **Reporting Configuration**: Checks for reporting URIs (`rua`, `ruf`) for monitoring - **Alignment Settings**: Validates SPF and DKIM alignment requirements (`aspf`, `adkim`) The checker performs DNS TXT record lookups and parses DMARC record syntax according to RFC 7489. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------- | | **SUCCESS** | DMARC policy properly enforced | - DMARC record exists with valid syntax - Policy set to quarantine or reject - Reporting URIs configured - Proper alignment settings | Domain has enforced DMARC policy for email security | | **WARNING** | DMARC policy in monitoring mode | - DMARC record exists but policy is none - Policy not fully enforced - Missing reporting configuration | DMARC policy is configured but not enforced | | **FAIL** | DMARC policy missing or invalid | - No DMARC record found - Invalid DMARC syntax - Missing v=DMARC1 tag - Critical configuration errors | Domain lacks proper DMARC policy configuration | | **ERROR** | Technical failure | - DNS lookup failed - Network connectivity issues - Invalid domain format | Technical error occurred during DMARC record validation | ## Risks and Considerations ## Risks of ignoring DMARC policy issues If DMARC policies are missing or misconfigured, the following risks apply: - **Email Spoofing**: Attackers can send emails claiming to be from your domain - **Brand Impersonation**: Malicious actors can impersonate your organization in phishing campaigns - **Email Deliverability Issues**: Legitimate emails may be rejected or marked as spam - **No Policy Enforcement**: Emails failing authentication checks are not properly handled - **Lack of Monitoring**: No visibility into email authentication failures and abuse - **Compliance Violations**: Failure to implement DMARC may violate industry standards - **Customer Trust Loss**: Recipients may lose confidence in emails from your domain - **Regulatory Issues**: Some industries require DMARC implementation for compliance ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ” # DNS Mail MTA-STS Auditor Security Auditor [Back](/auditors) Validates MTA-STS for secure email transmission SecurityDNSMail 20 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates MTA-STS (Mail Transfer Agent Strict Transport Security) configuration for secure email transmission. ## What this auditor validates ## What it checks This checker validates MTA-STS (Mail Transfer Agent Strict Transport Security) configuration for secure email transmission. It checks: - **MTA-STS Record Presence**: Verifies that a TXT record exists at `_mta-sts.domain` - **Valid MTA-STS Version**: Confirms the record starts with `v=STSv1` - **HTTP Policy File**: Attempts to fetch the policy file from `https://mta-sts.domain/.well-known/mta-sts.txt` - **Policy Mode**: Validates the policy mode (`enforce`, `testing`, `none`) from the policy file The checker performs DNS TXT record lookups and HTTP requests to validate the complete MTA-STS configuration. Note that MTA-STS is optional, so missing records result in warnings, not failures. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | **SUCCESS** | MTA-STS properly enforced | - MTA-STS record exists with valid syntax - Policy mode set to enforce - HTTP policy file accessible and valid | Domain has enforced MTA-STS policy for secure email transmission | | **WARNING** | MTA-STS missing or has issues | - No MTA-STS record found (optional) - MTA-STS record exists but malformed - Policy mode is testing or none - Policy file fetch failed - HTTP error when fetching policy | MTA-STS is optional; missing or misconfigured records result in warnings | | **FAIL** | Never occurs | - This checker never returns FAIL status | MTA-STS is optional and never causes failures | | **ERROR** | Technical failure | - DNS lookup failed - HTTP request failed - Network connectivity issues - Invalid domain format | Technical error occurred during MTA-STS validation | ## Risks and Considerations ## Risks of ignoring MTA-STS configuration issues If MTA-STS is missing or misconfigured, the following risks apply: - **Man-in-the-Middle Attacks**: Email transmission may be vulnerable to interception - **Downgrade Attacks**: Attackers may force email connections to use weaker encryption - **Email Interception**: Sensitive emails may be compromised during transmission - **Compliance Violations**: Some industries require MTA-STS for secure email transmission - **Trust Issues**: Email providers may flag your domain as less secure - **Data Breach Risk**: Unencrypted email transmission may lead to data exposure - **Regulatory Issues**: Failure to implement secure email transmission may violate regulations - **Business Communication Risk**: Sensitive business communications may be compromised ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ง # DNS Mail MX Auditor Security Auditor [Back](/auditors) Validates MX records for proper email routing SecurityDNSMail 30 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates MX (Mail Exchange) records for a domain to ensure proper email routing configuration. ## What this auditor validates ## What it checks This checker validates MX (Mail Exchange) records for a domain to ensure proper email routing configuration. It checks: - **MX Record Presence**: Verifies that MX records exist for the domain - **MX Record Targets**: Validates that MX records point to valid mail servers - **MX Record Priorities**: Checks the priority values for proper mail server ordering - **Domain Resolution**: Ensures the domain can resolve MX records properly The checker performs DNS lookups to retrieve all MX records for the specified domain and validates their configuration. It provides detailed information about each MX record including priority and target. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | -------------------------- | -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | **SUCCESS** | MX records found and valid | - MX records exist for the domain - All MX records have valid targets - Priorities are properly configured | Domain has properly configured MX records for email routing | | **WARNING** | Never occurs | - This checker never returns WARNING status | MX checker only returns SUCCESS or FAIL | | **FAIL** | No MX records found | - No MX records found for the domain - Domain cannot resolve MX records | Domain lacks proper email routing configuration | | **ERROR** | Technical failure | - DNS lookup failed - Network connectivity issues - Invalid domain format | Technical error occurred during MX record validation | ## Risks and Considerations ## Risks of ignoring MX record issues If MX records are missing or misconfigured, the following risks apply: - **Email Delivery Failure**: Incoming emails will be rejected or bounced back to senders - **Business Communication Loss**: Critical business emails may not reach the organization - **Customer Service Impact**: Customer inquiries and support requests may be lost - **Reputation Damage**: Senders may mark the domain as invalid, affecting future email delivery - **Compliance Issues**: Regulatory communications may not be received, leading to compliance violations - **Operational Disruption**: Internal communications and notifications may fail ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ›ก๏ธ # DNS Mail SPF Auditor Security Auditor [Back](/auditors) Validates SPF records to prevent email spoofing SecurityMailDNSSPF 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates SPF (Sender Policy Framework) records to prevent email spoofing and improve deliverability. ## What this auditor validates ## What it checks This checker validates SPF (Sender Policy Framework) records to prevent email spoofing and improve deliverability. It checks: - **SPF Record Presence**: Verifies that an SPF record exists at the root domain - **Single SPF Record**: Ensures only one SPF record is present (no duplicates) - **Valid SPF Version**: Confirms the record starts with `v=spf1` - **Terminal Mechanism**: Validates that the record contains a terminal mechanism (`all`) - **Hard/Soft All**: Checks for `-all` or `~all` mechanisms - **Record Length**: Warns if the record is close to the 512-byte DNS limit The checker performs DNS TXT record lookups and parses SPF record syntax according to RFC 7208. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | | **SUCCESS** | SPF record properly configured | - SPF record exists and is valid - Single record with proper syntax - Terminal mechanism present - Record length within limits | Domain has properly configured SPF record for email authentication | | **WARNING** | SPF record has issues | - SPF record exists but missing terminal mechanism - Record length approaching 512-byte limit - Consider using ~all or -all to limit spoofing - Record needs optimization | SPF record needs optimization or fixes | | **FAIL** | SPF record missing or invalid | - No SPF record found - Multiple SPF records present - Critical configuration errors | Domain lacks proper SPF configuration for email security | | **ERROR** | Technical failure | - DNS lookup failed - Network connectivity issues - Invalid domain format | Technical error occurred during SPF record validation | ## Risks and Considerations ## Risks of ignoring SPF record issues If SPF records are missing or misconfigured, the following risks apply: - **Email Spoofing**: Attackers can send emails claiming to be from your domain - **Phishing Attacks**: Malicious actors can impersonate your organization in phishing campaigns - **Email Deliverability Issues**: Legitimate emails may be rejected or marked as spam - **Reputation Damage**: Your domain may be blacklisted by email providers - **Business Email Compromise**: Fraudulent emails may trick employees or customers - **Compliance Violations**: Failure to implement email authentication may violate industry standards - **Customer Trust Loss**: Recipients may lose confidence in emails from your domain ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“Š # DNS Mail TLS-RPT Auditor Security Auditor [Back](/auditors) Validates TLS-RPT for email security monitoring SecurityDNSMail 30 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates TLS-RPT (TLS Reporting) configuration for monitoring email security issues. ## What this auditor validates ## What it checks This checker validates TLS-RPT (TLS Reporting) configuration for monitoring email security issues. It checks: - **TLS-RPT Record Presence**: Verifies that a TXT record exists at `_smtp._tls.domain` - **Valid TLS-RPT Version**: Confirms the record starts with `v=TLSRPTv1` - **Reporting URIs**: Validates the `rua` (reporting URI aggregate) configuration - **Record Format**: Ensures the record follows the correct TLS-RPT format The checker performs DNS TXT record lookups and validates TLS-RPT record syntax. Note that TLS-RPT is optional, so missing records result in warnings, not failures. ## Output Documentation ## Output Documentation | Status | Condition | Test Logic | Description | | ----------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | **SUCCESS** | TLS-RPT properly configured | - TLS-RPT record exists with valid syntax - Record starts with v=TLSRPTv1 - Record contains rua= parameter - Record format is correct | Domain has properly configured TLS-RPT for email security monitoring | | **WARNING** | TLS-RPT missing or has issues | - No TLS-RPT record found (optional) - TLS-RPT record exists but malformed - Record does not start with v=TLSRPTv1 - Record missing rua= parameter | TLS-RPT is optional; missing or misconfigured records result in warnings | | **FAIL** | Never occurs | - This checker never returns FAIL status | TLS-RPT is optional and never causes failures | | **ERROR** | Technical failure | - DNS lookup failed - Network connectivity issues - Invalid domain format | Technical error occurred during TLS-RPT validation | ## Risks and Considerations ## Risks of ignoring TLS-RPT configuration issues If TLS-RPT is missing or misconfigured, the following risks apply: - **No Security Monitoring**: Lack of visibility into email transmission security issues - **Undetected Attacks**: Man-in-the-middle attacks may go unnoticed - **Compliance Violations**: Some industries require TLS-RPT for email security monitoring - **Delayed Incident Response**: Security issues may not be detected promptly - **Trust Issues**: Email providers may flag your domain as less secure - **Regulatory Issues**: Failure to monitor email security may violate regulations - **Business Risk**: Unmonitored email security issues may lead to data breaches - **Reputation Damage**: Lack of security monitoring may affect domain reputation ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact โฐ # Domain Expiration Auditor Security Auditor [Back](/auditors) Monitors domain expiration dates via RDAP to prevent service disruption ResilienceSecurityMonitoring 20 credits Per check ~30 seconds Average runtime Active Status ## How it works Checks domain expiration dates using RDAP protocol to identify domains that are expiring soon and require renewal attention. ## What this auditor validates This checker monitors domain registration expiration dates by querying RDAP (Registration Data Access Protocol) servers. It automatically discovers the appropriate RDAP server for each domain's TLD using IANA bootstrap data, then queries the registry to retrieve domain information including expiration events. The checker parses the RDAP response to extract expiration dates and calculates the remaining time until expiration. ## Output Documentation | Status | Description | Test Logic | Threshold | | ----------- | ------------------------------------------------------------- | ---------------------------------- | ---------- | | **SUCCESS** | Domain is valid and expires in more than 90 days | `days_until_expiration > 90` | > 90 days | | **WARNING** | Domain expires in 90 days or less - renewal recommended | `30 < days_until_expiration <= 90` | 30-90 days | | **FAIL** | Domain expires in 30 days or less - immediate action required | `days_until_expiration <= 30` | โ‰ค 30 days | **Test Logic Details:** - **SUCCESS**: Domain has sufficient time before expiration, no immediate action needed - **WARNING**: Domain should be renewed soon to avoid last-minute issues - **FAIL**: Domain requires immediate renewal to prevent service disruption **Data Output:** - `domain`: The domain being checked - `expiration_date`: ISO 8601 formatted expiration date - `days_until_expiration`: Number of days until domain expires - `current_date`: Current date when check was performed ## Risks and Considerations **Immediate Risks (Fail Status):** Domain becomes inaccessible, complete service outage, loss of business continuity, potential data loss if DNS fails. **Short-term Risks (Warning Status):** Risk of forgetting to renew, potential service interruption during renewal process, increased stress and urgency for IT teams. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact โ“ # FAQ Auditor SEO Auditor [Back](/auditors) Detects FAQ pages using schema markup and content analysis GEOSEOCrawling 50 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker crawls websites to find FAQ pages using multiple detection methods including schema markup, microdata, and content analysis. The checker crawls website pages within the same domain, looks for JSON-LD with "@type": "FAQPage", scans for microdata with FAQPage itemtype, analyzes heading text for FAQ indicators, and limits crawling to prevent excessive requests. ## What this auditor validates This checker crawls websites to find FAQ pages using multiple detection methods including schema markup, microdata, and content analysis. It crawls website pages within the same domain, looks for JSON-LD with "@type": "FAQPage", scans for microdata with FAQPage itemtype, analyzes heading text for FAQ indicators, and limits crawling to prevent excessive requests. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ----------------- | ------------------------------------------------- | | **SUCCESS** | FAQ page found | FAQ page detected using any detection method | | **FAIL** | No FAQ page found | No FAQ page detected after crawling limit reached | ## Risks and Considerations **Poor User Support**: Missing FAQ pages can lead to increased support requests and customer frustration. **SEO Opportunities Lost**: FAQ pages are excellent for targeting long-tail keywords and improving search visibility. **Reduced Self-Service**: Users may abandon your site if they cannot find answers to common questions. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“Š # Google Analytics Auditor SEO Auditor [Back](/auditors) Validates Google Analytics gtag.js implementation and configuration SEOContentGEO 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that HTML pages contain proper Google Analytics implementation by checking for the presence of the Google Analytics Global Site Tag (gtag.js) script and its configuration. The checker analyzes the HTML page to look for gtag.js script tags with async attribute, validate Google Analytics measurement ID format (G-XXXXXXXXXX), check for proper script loading sequence and configuration, verify consistency between script src IDs and config IDs, detect legacy Universal Analytics (UA) IDs, and validate script placement in the head section. ## What this auditor validates This checker validates that HTML pages contain proper Google Analytics implementation by checking for the presence of the Google Analytics Global Site Tag (gtag.js) script and its configuration. It analyzes the HTML page to look for gtag.js script tags with async attribute, validate Google Analytics measurement ID format (G-XXXXXXXXXX), check for proper script loading sequence and configuration, verify consistency between script src IDs and config IDs, detect legacy Universal Analytics (UA) IDs, and validate script placement in the head section. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | **SUCCESS** | Google Analytics properly configured | All required gtag.js scripts found with valid measurement IDs, proper configuration, and no issues | | **WARNING** | Google Analytics detected but with configuration issues | Scripts found but with issues like missing async attribute, legacy UA IDs, or script placement problems | | **FAIL** | Google Analytics gtag.js script not found | No gtag.js scripts detected on the page | ## Risks and Considerations **Missing Analytics Data**: Without proper Google Analytics implementation, you lose valuable insights into user behavior, traffic sources, and conversion tracking. **Incomplete Tracking**: Improper configuration may result in missing or inaccurate data, leading to poor business decisions. **SEO Impact**: Missing analytics can affect your understanding of which content performs best. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿท๏ธ # Google Tag Manager Auditor SEO Auditor [Back](/auditors) Validates Google Tag Manager implementation and configuration SEOContentGEO 10 credits Per check ~30 seconds Average runtime Active Status ## How it works The Google Tag Manager Checker validates that HTML pages contain proper Google Tag Manager (GTM) implementation by checking for the presence of the GTM script, container ID, and proper configuration. GTM is a tag management system that allows you to quickly and easily update measurement codes and related code fragments on your website. The checker analyzes the HTML document to identify and validate Google Tag Manager implementation. It looks for: 1. Script Detection: Scans for inline scripts containing GTM implementation patterns 2. Container ID Validation: Extracts and validates GTM container IDs (format: GTM-XXXXXXX) 3. Script Structure Analysis: Verifies the script follows Google's recommended implementation pattern 4. DataLayer Initialization: Checks for proper dataLayer array initialization 5. GTM Events: Validates presence of gtm.start event and gtm.js event 6. Script Placement: Ensures GTM script is placed in the section for optimal loading 7. Noscript Fallback: Checks for noscript fallback implementation in the section 8. Performance Optimization: Validates async loading configuration Output Results: - Success: Google Tag Manager is properly configured and implemented - Warning: Google Tag Manager is detected but has configuration issues - Fail: Google Tag Manager script not found or completely missing ## What this auditor validates This checker validates that HTML pages contain proper Google Tag Manager implementation by checking for the presence of the Google Tag Manager script and container ID. It looks for Google Tag Manager script with the specific implementation pattern, validates Google Tag Manager container ID format (GTM-XXXXXXX), checks for proper script loading sequence and dataLayer initialization, validates script placement in head section, and ensures noscript fallback is properly configured. ## Output Documentation | Status | Condition | Test Logic | | ----------- | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | **SUCCESS** | Google Tag Manager properly configured | All required GTM scripts found with valid container IDs, proper configuration, and no issues | | **WARNING** | Google Tag Manager detected but with configuration issues | Scripts found but with issues like missing dataLayer initialization, improper script placement, or missing noscript fallback | | **FAIL** | Google Tag Manager script not found | No GTM scripts detected on the page | ## Risks and Considerations **Missing Analytics Data**: Without proper Google Tag Manager implementation, you lose valuable insights into user behavior, traffic sources, and conversion tracking. **Incomplete Tracking**: Improper configuration may result in missing or inaccurate data, leading to poor business decisions. **Performance Issues**: Incorrect GTM implementation can slow down page loading and affect user experience. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“‹ # Heading Structure Auditor SEO Auditor [Back](/auditors) Validates HTML heading hierarchy and structure SEOGEO 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that HTML headings follow proper hierarchical structure for accessibility and SEO best practices. The checker scans all heading elements (h1-h6) on the page, validates heading level progression (no skipping levels), checks for proper DOM nesting of headings, and identifies structural issues and violations. ## What this auditor validates This checker validates that HTML headings follow proper hierarchical structure for accessibility and SEO best practices. It scans all heading elements (h1-h6) on the page, validates heading level progression (no skipping levels), checks for proper DOM nesting of headings, and identifies structural issues and violations. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------ | ------------------------------------------------ | | **SUCCESS** | Well structured headings | All headings follow proper hierarchy and nesting | | **WARNING** | No headings found | Page contains no heading elements | | **FAIL** | Heading structure issues | Found heading level jumps or improper nesting | ## Risks and Considerations **Accessibility Violations**: Poor heading structure makes content difficult to navigate for users with screen readers. **SEO Penalties**: Search engines use heading structure to understand content hierarchy, affecting rankings. **Poor User Experience**: Confusing content structure can frustrate users. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # HSTS Preload Auditor Security Auditor [Back](/auditors) Validates HSTS preload header configuration Security 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates the Strict-Transport-Security header to ensure it's properly configured for HSTS preload inclusion. The checker retrieves the Strict-Transport-Security header, validates max-age, includeSubDomains, and preload directives, and ensures proper configuration for preload inclusion. ## What this auditor validates This checker validates the Strict-Transport-Security header to ensure it's properly configured for HSTS preload inclusion. It retrieves the Strict-Transport-Security header, validates max-age, includeSubDomains, and preload directives, and ensures proper configuration for preload inclusion. ## Output Documentation | Status | Condition | Test Logic | | ----------- | --------------------------- | ----------------------------------------------------------- | | **SUCCESS** | HSTS preload configured | Header includes max-ageโ‰ฅ1yr, includeSubDomains, and preload | | **WARNING** | HSTS present but incomplete | Header present but missing required preload directives | | **FAIL** | HSTS header missing | No Strict-Transport-Security header found | ## Risks and Considerations **Security Vulnerabilities**: Without HSTS, users may be vulnerable to protocol downgrade attacks and man-in-the-middle attacks. **User Data Exposure**: Unencrypted connections can expose sensitive user data. **Compliance Issues**: Many security standards require HSTS implementation. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”„ # HTTP Redirect Auditor Security Auditor [Back](/auditors) Validates HTTP to HTTPS redirect configuration Security 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that websites properly redirect HTTP requests to HTTPS to ensure secure connections are enforced. The checker converts HTTPS URL to HTTP for testing, sends HTTP request and monitors redirect response, validates redirect status codes and target URLs, and ensures redirects go to HTTPS. ## What this auditor validates This checker validates that websites properly redirect HTTP requests to HTTPS to ensure secure connections are enforced. It converts HTTPS URL to HTTP for testing, sends HTTP request and monitors redirect response, validates redirect status codes and target URLs, and ensures redirects go to HTTPS. ## Output Documentation | Status | Condition | Test Logic | | ----------- | --------------------- | -------------------------------------------------- | | **SUCCESS** | Proper HTTPS redirect | HTTP redirects to HTTPS with 301 or 307/308 status | | **WARNING** | Temporary redirect | HTTP redirects to HTTPS with 302 status | | **FAIL** | Redirect issues | No redirect or redirects to non-HTTPS URL | ## Risks and Considerations **Security Vulnerabilities**: HTTP traffic is unencrypted and vulnerable to interception and man-in-the-middle attacks. **SEO Penalties**: Search engines prefer HTTPS and may rank HTTP sites lower. **User Trust Issues**: Modern browsers show security warnings for HTTP sites, reducing user confidence. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐ŸŒ # HTTP Version Auditor General Auditor [Back](/auditors) Detects supported HTTP protocol versions General 30 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker detects which HTTP protocol versions are supported by the website, including HTTP/2 and HTTP/3 capabilities. The checker analyzes Alt-Svc header for HTTP/3 support, actively negotiates HTTP/2 connections, detects server capabilities and protocol support, and validates modern HTTP protocol adoption. ## What this auditor validates This checker detects which HTTP protocol versions are supported by the website, including HTTP/2 and HTTP/3 capabilities. It analyzes Alt-Svc header for HTTP/3 support, actively negotiates HTTP/2 connections, detects server capabilities and protocol support, and validates modern HTTP protocol adoption. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ---------------- | -------------------------------------------- | | **SUCCESS** | HTTP/3 supported | HTTP/3 advertised via Alt-Svc header | | **WARNING** | HTTP/2 supported | HTTP/2 supported but no HTTP/3 advertisement | | **FAIL** | Only HTTP/1.x | Only HTTP/1.x detected, no modern protocols | ## Risks and Considerations **Performance Issues**: Older HTTP versions (1.x) are slower and less efficient than modern protocols. **Poor User Experience**: Slower loading times can lead to increased bounce rates and reduced engagement. **Competitive Disadvantage**: Modern HTTP versions provide better performance and security. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ–ผ๏ธ # Image Alt Auditor SEO Auditor [Back](/auditors) Validates image alt attributes for accessibility compliance SEO 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker analyzes all images on a webpage to ensure they have proper alt attributes for accessibility compliance and SEO optimization. The checker scans all img elements on the page, checks for presence and content of alt attributes, categorizes images as having valid alt, missing alt, or empty alt, and provides detailed reporting of problematic images. ## What this auditor validates This checker analyzes all images on a webpage to ensure they have proper alt attributes for accessibility compliance and SEO optimization. It scans all img elements on the page, checks for presence and content of alt attributes, categorizes images as having valid alt, missing alt, or empty alt, and provides detailed reporting of problematic images. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------------------ | ------------------------------------------------------------ | | **SUCCESS** | All images have valid alt attributes | All images found have non-empty alt attributes | | **FAIL** | Images missing valid alt attributes | Found images without alt attributes or with empty alt values | ## Risks and Considerations **Accessibility Violations**: Missing alt text makes your site inaccessible to users with screen readers, potentially violating accessibility laws. **SEO Penalties**: Search engines cannot understand image content, affecting your search rankings. **User Experience**: Visually impaired users cannot understand your content. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ฆ # Large Resource Auditor Performance Auditor [Back](/auditors) Detects oversized resources affecting page performance GeneralPerformanceSEOResilience 100 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker identifies resources (images, scripts, stylesheets) that exceed size thresholds and may impact page loading performance. The checker uses Playwright to load the page and extract resource URLs, checks content length of all resources (images, scripts, CSS, videos), identifies resources exceeding 500KB threshold, and provides detailed reporting of large resources. ## What this auditor validates This checker identifies resources (images, scripts, stylesheets) that exceed size thresholds and may impact page loading performance. It uses Playwright to load the page and extract resource URLs, checks content length of all resources (images, scripts, CSS, videos), identifies resources exceeding 500KB threshold, and provides detailed reporting of large resources. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ----------------------------- | ------------------------------------------ | | **SUCCESS** | All resources under threshold | No resources larger than 500KB found | | **FAIL** | Large resources detected | Found resources exceeding 500KB size limit | ## Risks and Considerations **Poor Performance**: Large resources slow down page loading, leading to increased bounce rates and poor user experience. **SEO Penalties**: Page speed is a ranking factor, and slow sites may rank lower in search results. **Increased Costs**: Large resources consume more bandwidth and hosting resources. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿš€ # Latest Version Auditor Security Auditor [Back](/auditors) Validates software stack version against latest releases Security 50 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates software stack version information against the latest available releases to ensure your stack is up-to-date. ## What this auditor validates This checker validates Liferay version information against the latest available releases to ensure the platform is up-to-date. It identifies Liferay in the technology stack, fetches latest version information from Liferay releases API, compares current version against latest available, and provides update recommendations. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------ | ---------------------------------------------------- | | **SUCCESS** | Liferay up to date | Current version matches or exceeds latest release | | **WARNING** | Liferay update available | Newer version available but not critical | | **FAIL** | Liferay version issues | Version information unavailable or comparison failed | ## Risks and Considerations **Security Vulnerabilities**: Outdated Liferay versions may contain known security vulnerabilities that have been patched in newer releases. **Performance Issues**: Newer versions often include performance improvements and bug fixes. **Compatibility Problems**: Outdated versions may not be compatible with modern browsers or third-party integrations. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿค– # LLMs.txt SEO Auditor [Back](/auditors) Validates llms.txt files for AI-friendly content optimization SEOAIContent 50 credits Per check ~30 seconds Average runtime Active Status ## How it works The LLMs.txt checker validates the presence and format of llms.txt files on websites. These files provide LLM-friendly content and follow a specific markdown format to help language models understand website content. The checker ensures your site is optimized for AI-powered search engines and language models by validating required elements like H1 titles, blockquote summaries, and properly structured sections with links. ## What this auditor validates This checker validates the presence and format of llms.txt files according to the llms.txt specification. It checks for required elements including a non-empty H1 title, file accessibility via HTTP GET, and validates the markdown format. The checker also analyzes recommended elements like blockquote summaries, H2 sections with organized content, and properly formatted markdown links. It detects special elements such as the "Optional" section which has specific meaning in the specification. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ---------------------------------------------------- | ----------------------------------------------------------------------------------- | | **SUCCESS** | llms.txt properly formatted | File accessible with valid H1 title, proper markdown format, and no critical issues | | **WARNING** | llms.txt found but with missing recommended elements | File exists but missing blockquote summary, H2 sections, or links | | **FAIL** | llms.txt missing or has format issues | File not found, inaccessible, missing required H1 title, or has empty H1 title | ## Risks and Considerations **AI Search Visibility**: Without a properly formatted llms.txt file, your content may not be effectively indexed by AI-powered search engines and language models. **Reduced AI Understanding**: Missing or malformed llms.txt files can prevent AI systems from properly understanding and categorizing your website content. **Competitive Disadvantage**: As AI search becomes more prevalent, sites without llms.txt may lose visibility to competitors who have optimized for AI discovery. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ # Lorem Ipsum Auditor SEO Auditor [Back](/auditors) Detects placeholder text that should be replaced SEO 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker scans web pages for Lorem Ipsum placeholder text that should be replaced with actual content before going live. The checker scans page text content for Lorem Ipsum patterns, detects various spellings and spacing variations, counts occurrences of placeholder text, and identifies pages with incomplete content. ## What this auditor validates This checker scans web pages for Lorem Ipsum placeholder text that should be replaced with actual content before going live. It scans page text content for Lorem Ipsum patterns, detects various spellings and spacing variations, counts occurrences of placeholder text, and identifies pages with incomplete content. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------- | ------------------------------------------------ | | **SUCCESS** | No placeholder text found | No Lorem Ipsum text detected on the page | | **FAIL** | Placeholder text found | Lorem Ipsum text detected and should be replaced | ## Risks and Considerations **Professional Appearance**: Lorem Ipsum text makes your site appear unprofessional and incomplete. **Poor User Experience**: Users expect real content and may leave if they see placeholder text. **SEO Issues**: Search engines may penalize pages with placeholder content. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ # Meta Description Length Auditor SEO Auditor [Back](/auditors) Validates meta description length for optimal SEO performance SEO 10 credits Per check ~30 seconds Average runtime Active Status ## How it works The Meta Description Length Checker validates that HTML pages contain a meta description tag with an appropriate length for optimal search engine optimization (SEO) performance. Meta descriptions are crucial for how your content appears in search engine results pages (SERPs) and can significantly impact click-through rates. The checker analyzes the HTML document's section to identify and validate the meta description tag. It performs the following checks: 1. Meta Tag Detection: Scans for tag in the document head 2. Content Extraction: Extracts the content attribute value and trims whitespace 3. Length Calculation: Counts the character length of the description text 4. Length Validation: Compares the length against SEO best practices (150-160 characters) 5. Range Assessment: Categorizes the length into optimal, acceptable, or problematic ranges Output Results: - Success: Meta description length is within the optimal range (150-160 characters) - Warning: Meta description length is slightly outside the optimal range (120-180 characters) - Fail: Meta description is missing or length is far outside the optimal range ## What this auditor validates This checker validates that HTML pages contain a meta description tag with an appropriate length for optimal search engine optimization (SEO) performance. It extracts the meta description tag from the HTML document head section, measures the character length of the description content, and evaluates it against SEO best practices. The checker specifically looks for the tag, extracts its content attribute value, trims whitespace, and compares the length against recommended ranges for optimal display in search engine results pages. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------- | | **SUCCESS** | Meta description length is optimal | Length between 150-160 characters (recommended range for optimal SERP display) | | **WARNING** | Meta description length slightly off | Length between 120-180 characters (acceptable but not optimal range) | | **FAIL** | Meta description length issues | Length far outside recommended range (<120 or >180 characters) or missing meta description tag entirely | ## Risks and Considerations **Poor Click-Through Rates**: Meta descriptions that are too short or too long may be truncated or poorly displayed in search results, reducing user engagement and click-through rates. **SEO Performance Impact**: Search engines may not display your description as intended, affecting your search visibility and ranking potential. **User Experience Issues**: Users may not understand what your page offers before clicking, leading to higher bounce rates and reduced conversions. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ฆ # Minifier Auditor Performance Auditor [Back](/auditors) Checks if web resources are minified for optimal performance PerformanceResilience 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Analyzes web pages and their linked resources (CSS and JavaScript) to determine if they are properly minified for optimal performance and reduced file sizes. ## What this auditor validates This checker analyzes HTML pages and their linked CSS and JavaScript resources to determine their minification status. It uses sophisticated heuristics including line length analysis, whitespace ratio calculation, structure density analysis, and comment ratio detection to identify whether content has been properly minified. The checker fetches the main HTML page, extracts all CSS and JavaScript URLs, and concurrently analyzes each resource to provide a comprehensive minification assessment. ## Output Documentation | Status | Description | Test Logic | | ----------- | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SUCCESS** | All resources (HTML, CSS, JavaScript) are properly minified | HTML is minified AND all CSS files are minified AND all JavaScript files are minified. All resources meet the minification thresholds for line length, whitespace ratio, structure density, and comment ratio. | | **WARNING** | Some resources are minified while others are not | At least one resource is minified (minifiedResources > 0) but not all resources meet the minification criteria. This indicates partial optimization where some resources benefit from minification while others remain unoptimized. | | **FAIL** | No minification found - all resources appear to be unminified | No resources meet the minification criteria (minifiedResources = 0). All HTML, CSS, and JavaScript content fails to meet the established thresholds for line length, whitespace ratio, structure density, and comment ratio, indicating no optimization has been applied. | ## Risks and Considerations **Performance Impact**: Unminified resources significantly increase page load times and bandwidth usage, especially on mobile devices and slower connections. **SEO Impact**: Search engines consider page speed as a ranking factor, so unminified resources can negatively affect search rankings. **User Experience**: Slower loading times lead to higher bounce rates and reduced user engagement. **Cost Implications**: Larger file sizes increase bandwidth costs for both users and hosting providers. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # Mixed Content Auditor Security Auditor [Back](/auditors) Detects HTTP resources on HTTPS pages and CSP upgrade directive Security 30 credits Per check ~30 seconds Average runtime Active Status ## How it works Detects HTTP resources loaded on HTTPS pages and checks for Content Security Policy upgrade-insecure-requests directive to prevent mixed content vulnerabilities. ## What this auditor validates ## What This Checker Validates This checker crawls your HTTPS landing pages to identify **mixed content** vulnerabilities by: ### Network Monitoring - Monitors all network requests during page load - Detects any HTTP:// URLs being requested from HTTPS pages - Captures resource types (images, scripts, stylesheets, etc.) ### DOM Analysis - Scans HTML elements for HTTP URLs in src/href attributes: * `![](http://...)` * ## Output Documentation ## Checker Output Documentation | Output | Condition | Description | Action Required | | -------------- | ------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | **โœ… SUCCESS** | No mixed content found | All resources (images, scripts, stylesheets, etc.) are loaded over HTTPS or use relative URLs | โœ… No action needed - your site is secure | | **โš ๏ธ WARNING** | Mixed content found + CSP upgrade directive | HTTP resources detected, but `Content-Security-Policy: upgrade-insecure-requests` header is present | ๐Ÿ” **Monitor**: CSP will auto-upgrade HTTP to HTTPS, but consider updating URLs to HTTPS directly | | **โŒ FAIL** | Mixed content found + no CSP protection | HTTP resources detected without CSP `upgrade-insecure-requests` directive | ๐Ÿšจ **Fix Required**: Update all HTTP URLs to HTTPS or add CSP upgrade directive | ### Test Logic 1. **Page Load**: Navigate to HTTPS page with network monitoring 2. **Resource Detection**: Capture all HTTP requests and scan DOM for HTTP URLs 3. **CSP Analysis**: Check response headers and meta tags for `upgrade-insecure-requests` 4. **Result Determination**: - No HTTP resources โ†’ SUCCESS - HTTP resources + CSP upgrade โ†’ WARNING - HTTP resources + no CSP โ†’ FAIL ## Risks and Considerations ## Security Risks of Mixed Content ### **High Risk - Active Mixed Content** - **JavaScript over HTTP**: Can be modified by attackers to inject malicious code - **Stylesheets over HTTP**: Can be manipulated to hide content or create fake interfaces - **Iframes over HTTP**: Can load malicious content in trusted context ### **Medium Risk - Passive Mixed Content** - **Images over HTTP**: Can be replaced with malicious content or tracking pixels - **Audio/Video over HTTP**: Can be replaced with inappropriate content ### **Business Impact** - **Browser Warnings**: Modern browsers show "Not Secure" warnings - **SEO Penalties**: Search engines may downrank sites with security issues - **User Trust**: Visitors may leave due to security warnings - **Compliance**: May violate security standards and regulations - **Data Interception**: HTTP resources can be intercepted and modified by attackers ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ” # Not Found Auditor SEO Auditor [Back](/auditors) Checks 404 page implementation and SEO best practices SEOResilience 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates that your website has a proper 404 error page strategy in place following SEO best practices. This checker ensures that non-existent pages return the correct HTTP status code, provide helpful content to users, and are properly configured to avoid negative SEO impact. ## What this auditor validates ## What This Checker Validates This checker analyzes your website's 404 error page implementation by testing a non-existent URL and evaluating the response against SEO best practices: ### 1. HTTP Status Code Validation - **Proper 404 Response**: Ensures the server returns HTTP 404 (Not Found) or 410 (Gone) status codes - **Soft 404 Detection**: Identifies "soft 404s" where non-existent pages incorrectly return 200 OK status ### 2. Custom 404 Page Content - **Meaningful Content**: Verifies the page contains substantial, helpful content (not just generic error messages) - **Error Indicators**: Looks for appropriate messaging like "page not found", "oops", or "error" - **Content Length**: Ensures the page has enough content to be useful (minimum 50 characters) ### 3. User Experience Elements - **Search Functionality**: Checks for search boxes to help users find what they need - **Navigation Links**: Identifies navigation menus or multiple helpful links - **Helpful Links**: Looks for common useful links (home, contact, help, products, etc.) ### 4. SEO Compliance - **NoIndex Meta Tag**: Verifies presence of to prevent search engines from indexing 404 pages ### Testing Methodology The checker generates a unique non-existent URL by appending a timestamp-based path to your domain, then analyzes the response for all the above criteria. ## Output Documentation ## Output Documentation | Status | Message | Test Logic | Score Range | | ----------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | **SUCCESS** | "Excellent 404 page implementation" | All 5 best practices implemented: โ€ข Returns proper 404/410 status code โ€ข Contains meaningful custom content โ€ข Includes search functionality โ€ข Has navigation links โ€ข Contains helpful links โ€ข Includes noindex meta tag | 5/5 points | | **WARNING** | "Good 404 page but could be improved" | Partial implementation with room for improvement: โ€ข Returns proper 404/410 status code โ€ข Some but not all UX/SEO features present โ€ข Missing 1-2 best practices (search, navigation, helpful links, or noindex) | 2-4/5 points | | **FAIL** | "Soft 404 detected: returns 200 OK for non-existent pages" | Critical status code issue: โ€ข Non-existent page returns 200 OK instead of 404 โ€ข Creates SEO problems and analytics issues โ€ข Requires immediate attention | Any score with wrong status | | **FAIL** | "Invalid status code for 404 page: {code}" | Unexpected HTTP status: โ€ข Returns status other than 200, 404, or 410 โ€ข May indicate server misconfiguration โ€ข Could be 500, 302, etc. | Any score with invalid status | | **FAIL** | "Poor 404 page implementation" | Minimal or inadequate implementation: โ€ข Returns correct 404 status but lacks user-friendly features โ€ข Missing most UX elements (search, navigation, helpful content) โ€ข Basic functionality only | 0-1/5 points | | **FAIL** | "Error checking 404 page: {error}" | Technical error during testing: โ€ข Connection timeout or network issues โ€ข Server unreachable or DNS problems โ€ข Malformed URL or other technical failures | N/A | ### Scoring Details Each feature contributes 1 point to the total score: - โœ… **Custom Content** (1 pt): Meaningful 404 message with substantial content - โœ… **Search Box** (1 pt): Search functionality to help users find content - โœ… **Navigation Links** (1 pt): Navigation menu or multiple helpful links - โœ… **Helpful Links** (1 pt): Links to common pages (home, contact, help, etc.) - โœ… **NoIndex Tag** (1 pt): present **Note**: Proper HTTP status code (404/410) is a prerequisite - without it, the check fails regardless of other features. ## Risks and Considerations ## Risks of Poor 404 Implementation ### SEO Risks - **Soft 404 Penalties**: Search engines may penalize sites that return 200 OK for non-existent pages, treating them as low-quality duplicate content - **Index Pollution**: 404 pages without noindex tags can get indexed, diluting your site's content quality in search results - **Crawl Budget Waste**: Search engines waste crawl budget on broken pages instead of valuable content - **Ranking Impact**: Poor error handling can negatively affect overall site authority and search rankings ### User Experience Risks - **High Bounce Rate**: Users encountering unhelpful 404 pages are more likely to leave your site immediately - **Lost Conversions**: Visitors who could be redirected to relevant content instead abandon their journey - **Brand Perception**: Generic or broken error pages create a poor impression of your brand's professionalism - **Navigation Confusion**: Users become lost without proper navigation or search options on error pages ### Technical Risks - **Monitoring Blind Spots**: Soft 404s make it harder to identify and fix broken links or technical issues - **Analytics Distortion**: Incorrect status codes can skew website analytics and error reporting - **Third-party Integration Issues**: Some tools and services may not properly handle soft 404 responses ### Business Impact - **Reduced User Engagement**: Poor error handling leads to decreased time on site and page views - **Lower Customer Satisfaction**: Frustrated users are less likely to return or recommend your site - **Missed Opportunities**: Inability to guide users to relevant content represents lost business potential ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ฑ # OpenGraph Auditor General Auditor [Back](/auditors) Validates OpenGraph meta tags for social media sharing General 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that HTML pages contain proper OpenGraph meta tags for optimal social media sharing and preview generation. The checker scans for OpenGraph meta tags (og:title, og:type, og:image, og:url), validates tag values and URL formats, checks for semantic consistency and best practices, and identifies missing required tags and configuration issues. ## What this auditor validates This checker validates that HTML pages contain proper OpenGraph meta tags for optimal social media sharing and preview generation. It scans for OpenGraph meta tags (og:title, og:type, og:image, og:url), validates tag values and URL formats, checks for semantic consistency and best practices, and identifies missing required tags and configuration issues. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------------- | ------------------------------------------------------------ | | **SUCCESS** | Required OpenGraph tags present | All required tags found with valid values | | **WARNING** | OpenGraph tags with issues | Tags present but with configuration problems or empty values | | **FAIL** | Missing required OpenGraph tags | Required tags missing from the page | ## Risks and Considerations **Poor Social Media Presence**: Without proper OpenGraph tags, your content may appear unprofessional or incomplete when shared on social platforms. **Reduced Engagement**: Users are less likely to click on posts with poor previews. **Brand Inconsistency**: Inconsistent social media appearance can damage brand perception. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ“ # Page Title Auditor SEO Auditor [Back](/auditors) Validates page title length and SEO optimization SEOGEO 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that HTML page titles follow best practices for SEO and usability, ensuring they are within the recommended character length range. The checker extracts the title tag from the HTML, measures the title length in characters, and evaluates against SEO best practices (15-70 characters optimal). ## What this auditor validates This checker validates that HTML page titles follow best practices for SEO and usability, ensuring they are within the recommended character length range. It extracts the title tag from the HTML, measures the title length in characters, and evaluates against SEO best practices (15-70 characters optimal). ## Output Documentation | Status | Condition | Test Logic | | ----------- | ----------------------- | ------------------------------------------------------------ | | **SUCCESS** | Title length is optimal | Title length between 15-70 characters | | **WARNING** | Title length issues | Title too short (<15 chars) or too long (>70 chars but โ‰ค100) | | **FAIL** | Title problems | No title tag, empty title, or excessively long (>100 chars) | ## Risks and Considerations **Poor SEO Performance**: Titles that are too short or too long may not display properly in search results, reducing click-through rates. **User Experience Issues**: Unclear or truncated titles can confuse users and reduce engagement. **Brand Recognition**: Poor titles can affect how users perceive and remember your brand. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # Permissions Policy Auditor Security Auditor [Back](/auditors) Validates Permissions-Policy header for secure browser feature controls SecurityHeaders 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Validates the Permissions-Policy HTTP header configuration to ensure proper security controls for browser features and APIs ## What this auditor validates ## What it checks This checker validates the **Permissions-Policy** HTTP header configuration on websites. The Permissions-Policy header is a security mechanism that allows websites to control which browser features and APIs can be used by the page and its embedded content. ### Key aspects checked: - **Header Presence**: Verifies that the Permissions-Policy header is present in the HTTP response - **Syntax Validation**: Validates the header format and directive syntax - **Directive Recognition**: Checks if all directives are recognized and valid - **Security Analysis**: Analyzes security implications of directive configurations - **Allowlist Validation**: Validates the allowlist format for each directive ### Common directives analyzed: - **Media**: `camera`, `microphone`, `speaker-selection` - **Location & Sensors**: `geolocation`, `accelerometer`, `gyroscope` - **Payment**: `payment`, `web-share` - **Display**: `fullscreen`, `picture-in-picture` - **Storage**: `storage-access`, `browsing-topics` - **Privacy-sensitive**: `clipboard-read`, `clipboard-write`, `document-domain` The checker parses the header format: `directive=("self" "https://example.com")` and validates each component. ## Output Documentation ## Output Documentation | Status | Description | Test Logic | | ----------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SUCCESS** | Permissions-Policy header is properly configured with valid directives and secure settings | - Header is present and not empty - All directives have valid syntax - No unrecognized directives - No security concerns detected - Allowlist format is correct | | **WARNING** | Header is present but has potential issues that should be addressed | - Contains unrecognized directives (may be valid but not in known list) - Security-sensitive directives have overly permissive configurations - Deprecated directives are used (autoplay, encrypted-media) - Missing explicit configuration for important security directives | | **FAIL** | Header is missing or contains critical errors | - Permissions-Policy header is completely missing - Header value is empty or blank - Syntax errors in directive format - Invalid allowlist syntax - Malformed directive=allowlist format | ### Test Logic Details **Success Conditions:** - Header exists and contains valid content - All directives match known patterns - Security analysis shows no concerns - Allowlist parsing succeeds for all directives **Warning Conditions:** - Unrecognized directives (not in KNOWN_DIRECTIVES set) - Security-sensitive features with overly permissive allowlists - Use of deprecated but still functional directives - Missing explicit configuration for critical security features **Fail Conditions:** - Complete absence of header - Empty or whitespace-only header value - Regex pattern matching fails for directive format - Allowlist parsing throws exceptions - Invalid syntax that cannot be parsed ## Risks and Considerations ## Risks of ignoring Permissions-Policy warnings ### Security Vulnerabilities - **Feature Abuse**: Without proper restrictions, malicious scripts can access sensitive browser features like camera, microphone, or geolocation - **Privacy Breaches**: Unrestricted access to privacy-sensitive APIs can lead to unauthorized data collection - **Cross-Origin Exploitation**: Poorly configured allowlists may allow unauthorized domains to access restricted features ### Compliance Issues - **GDPR Violations**: Failure to properly restrict data collection features may violate privacy regulations - **Security Audits**: Missing or misconfigured security headers can fail security assessments - **Browser Warnings**: Modern browsers may show security warnings for sites without proper feature controls ### User Trust Impact - **Browser Blocking**: Browsers may block certain features if policies are not properly configured - **User Experience**: Unexpected feature access can confuse users and damage trust - **Security Indicators**: Missing security headers may cause browsers to show "not secure" indicators ### Technical Debt - **Future Compatibility**: Deprecated directives may break in future browser versions - **Maintenance Overhead**: Poorly configured policies require more maintenance and troubleshooting - **Performance Impact**: Unnecessary feature access can impact page performance ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ’ฐ # Pricing Auditor SEO Auditor [Back](/auditors) Detects pricing and subscription plan pages on websites SEO 50 credits Per check ~30 seconds Average runtime Active Status ## How it works The Pricing Checker crawls websites to detect the presence of pricing pages, subscription plans, or billing information. This checker is essential for businesses that need to verify their pricing information is discoverable and properly structured for potential customers and search engines. The checker performs a comprehensive website crawl to identify pricing-related content using multiple detection strategies: 1. Website Crawling: Systematically crawls up to 500 pages within the same domain to find pricing content 2. Schema.org Detection: Identifies structured data markup for pricing information including: - JSON-LD scripts with Offer, AggregateOffer, or PriceSpecification types - Microdata markup for pricing-related schema types - Product/Service schemas with price information 3. Content Analysis: Scans page content for pricing-related keywords in: - Headings (H1-H4) containing pricing terminology - Navigation links with pricing-related text - Buttons and call-to-action elements 4. Multi-language Support: Recognizes pricing terms in both English and Portuguese 5. Link Discovery: Follows internal links within the same domain to expand search coverage Output Results: - Success: Pricing/Plans page found with proper structure - Warning: Pricing information detected but may need improvement - Fail: No pricing/plans page found after comprehensive crawl ## What this auditor validates This checker crawls websites to detect the presence of pricing pages, subscription plans, or billing information using comprehensive detection strategies. It performs a systematic crawl of up to 500 pages within the same domain, analyzing both structured data and content patterns. The checker looks for pricing-related schema markup (JSON-LD and microdata) including Offer, AggregateOffer, PriceSpecification, Product, Service, and Organization types with pricing information. It also scans page content for pricing-related keywords in headings, navigation links, and call-to-action elements, supporting both English and Portuguese terminology. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | | **SUCCESS** | Pricing/Plans page found | Detected pricing page using schema markup (JSON-LD/microdata) or content analysis (headings/navigation with pricing keywords) | | **FAIL** | No pricing page found | No pricing page detected after crawling up to 500 pages within the same domain using all detection methods | ## Risks and Considerations **Lost Sales Opportunities**: Hidden or unclear pricing information can drive potential customers away, as users expect to find pricing easily. **Poor User Experience**: Users typically look for pricing information early in their decision-making process, and its absence can create frustration and lead to site abandonment. **Competitive Disadvantage**: Transparent pricing builds trust and can be a significant competitive advantage, while hidden pricing may suggest hidden costs or lack of transparency. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # Referrer Policy Auditor Security Auditor [Back](/auditors) Validates Referrer-Policy header for privacy protection Security 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates the Referrer-Policy header to ensure proper configuration for privacy protection and referrer information control. The checker retrieves the Referrer-Policy header from HTTP response, validates policy values against known standards, identifies discouraged or legacy policy values, and ensures proper privacy configuration. ## What this auditor validates This checker validates the Referrer-Policy header to ensure proper configuration for privacy protection and referrer information control. It retrieves the Referrer-Policy header from HTTP response, validates policy values against known standards, identifies discouraged or legacy policy values, and ensures proper privacy configuration. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------ | -------------------------------------------------- | | **SUCCESS** | Recommended policy | Referrer-Policy set to recommended value | | **WARNING** | Discouraged policy | Referrer-Policy set to discouraged or legacy value | | **FAIL** | Policy missing | Referrer-Policy header not found | ## Risks and Considerations **Privacy Violations**: Without proper referrer policy, sensitive information may be leaked to third-party sites. **User Trust Issues**: Privacy concerns can damage user trust and brand reputation. **Compliance Problems**: Many privacy regulations require proper referrer policy configuration. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿค– # Robots Crawl Delay Auditor SEO Auditor [Back](/auditors) Validates robots.txt crawl-delay directive presence SEOCrawling 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that websites have a robots.txt file with crawl-delay directive to control search engine crawling frequency. The checker fetches the robots.txt file from the website, scans for crawl-delay directive, and validates the directive format and presence. ## What this auditor validates This checker validates that websites have a robots.txt file with crawl-delay directive to control search engine crawling frequency. It fetches the robots.txt file from the website, scans for crawl-delay directive, and validates the directive format and presence. ## Output Documentation | Status | Condition | Test Logic | | ----------- | --------------------------- | ------------------------------------------------- | | **SUCCESS** | Crawl-delay directive found | robots.txt contains crawl-delay directive | | **WARNING** | No crawl-delay directive | robots.txt exists but lacks crawl-delay directive | | **FAIL** | robots.txt not found | robots.txt file inaccessible or missing | ## Risks and Considerations **Server Overload**: Without crawl-delay, search engines may overwhelm your server with requests, causing performance issues. **Increased Costs**: Excessive crawling can increase bandwidth and hosting costs. **Poor User Experience**: Server overload can slow down your website for actual users. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿท๏ธ # Schema Entities Auditor SEO Auditor [Back](/auditors) Validates Schema.org structured data implementation SEOGEO 100 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates the presence and implementation of Schema.org structured data using JSON-LD, Microdata, and RDFa formats. The checker scans HTML for JSON-LD script tags with Schema.org context, analyzes microdata with itemscope/itemtype attributes, checks RDFa markup with typeof attributes, and validates Schema.org entity types and structure. ## What this auditor validates This checker validates the presence and implementation of Schema.org structured data using JSON-LD, Microdata, and RDFa formats. It scans HTML for JSON-LD script tags with Schema.org context, analyzes microdata with itemscope/itemtype attributes, checks RDFa markup with typeof attributes, and validates Schema.org entity types and structure. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------ | --------------------------------------------- | | **SUCCESS** | Schema entities found | At least one valid Schema.org entity detected | | **FAIL** | No schema entities found | No Schema.org entities detected on the page | ## Risks and Considerations **Poor Search Visibility**: Without structured data, search engines may not understand your content as well, affecting rich snippets and search rankings. **Missed SEO Opportunities**: Structured data can enhance search results with rich snippets, improving click-through rates. **Content Understanding**: Search engines rely on structured data to better understand and categorize your content. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ” # Server Fingerprint Auditor Security Auditor [Back](/auditors) Checks for server info disclosure in HTTP headers SecurityPrivacy 10 credits Per check ~30 seconds Average runtime Active Status ## How it works Detects server fingerprinting headers that may expose sensitive server information including software versions, technology stacks, and implementation details. ## What this auditor validates ## What This Checker Analyzes This checker examines HTTP response headers that commonly expose server fingerprinting information, which can be used by attackers to identify vulnerabilities and plan targeted attacks. ### Headers Examined: - **Server**: Reveals web server software and version (e.g., "Apache/2.4.41", "nginx/1.18.0") - **X-Powered-By**: Exposes backend technology and version (e.g., "PHP/7.4.3", "ASP.NET") - **X-AspNet-Version**: Discloses .NET Framework version (e.g., "4.0.30319") ### Detection Logic: The checker uses regex pattern matching to identify version numbers in header values. Any sequence matching `\d+(?:\.\d+)*(?:[-+][a-zA-Z0-9\-.]*)?` is considered version information. ### Security Best Practices: - Remove or minimize server identification headers - Use generic values without version information - Configure web servers to suppress detailed software information ## Output Documentation ## Checker Results | Status | Condition | Description | Action Required | | -------------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | โœ… **Success** | No fingerprinting headers found | None of the monitored headers (Server, X-Powered-By, X-AspNet-Version) are present in the response | **No action needed** - Server is properly configured to minimize information disclosure | | โš ๏ธ **Warning** | Headers present without version info | One or more fingerprinting headers are present but contain only generic information without version numbers | **Recommended** - Consider removing these headers entirely for maximum security | | โŒ **Failure** | Headers contain version information | One or more headers expose specific version numbers, software details, or implementation information | **Action required** - Remove or sanitize headers to prevent information disclosure | ### Examples: - **Success**: No Server, X-Powered-By, or X-AspNet-Version headers - **Warning**: `Server: Apache` (no version), `X-Powered-By: ASP.NET` (no version) - **Failure**: `Server: Apache/2.4.41`, `X-Powered-By: PHP/7.4.3`, `X-AspNet-Version: 4.0.30319` ## Risks and Considerations ## Security Risks ### High Risk - Version Information Exposed When server headers contain version information, attackers can: - **Exploit Known Vulnerabilities**: Target specific CVEs for the disclosed software versions - **Launch Targeted Attacks**: Craft attacks specific to the identified technology stack - **Reconnaissance**: Build detailed profiles of your infrastructure for advanced persistent threats - **Compliance Issues**: Violate security frameworks that require information disclosure minimization ### Medium Risk - Generic Headers Present Even without version info, server headers still provide: - **Technology Fingerprinting**: Help attackers identify the general technology stack - **Attack Surface Mapping**: Allow reconnaissance of potential entry points - **Social Engineering**: Enable more convincing phishing attempts targeting your tech stack ### Business Impact: - Increased vulnerability to targeted cyber attacks - Potential data breaches and system compromises - Regulatory compliance violations (GDPR, PCI-DSS, SOX) - Reputational damage from security incidents - Financial losses from downtime and remediation costs ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ—บ๏ธ # Sitemap Auditor SEO Auditor [Back](/auditors) Validates XML sitemap availability and freshness SEOCrawling 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates that websites have properly configured XML sitemaps that are accessible and up-to-date for search engine crawling. The checker discovers sitemap URLs from robots.txt and common locations, validates sitemap XML format and structure, checks sitemap freshness based on lastmod dates, and analyzes both sitemap index and URL set formats. ## What this auditor validates This checker validates that websites have properly configured XML sitemaps that are accessible and up-to-date for search engine crawling. It discovers sitemap URLs from robots.txt and common locations, validates sitemap XML format and structure, checks sitemap freshness based on lastmod dates, and analyzes both sitemap index and URL set formats. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ------------------------------ | --------------------------------------------- | | **SUCCESS** | Sitemap available and fresh | Valid sitemap found with recent lastmod dates | | **WARNING** | Sitemap available but outdated | Sitemap found but lastmod dates are old | | **FAIL** | Sitemap issues | No sitemap found or sitemap inaccessible | ## Risks and Considerations **Poor Search Indexing**: Without a sitemap, search engines may miss important pages, reducing your search visibility. **Slow Discovery**: New or updated content may take longer to appear in search results. **SEO Performance**: Missing or outdated sitemaps can negatively impact your search rankings. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ”’ # TLS Version Auditor Security Auditor [Back](/auditors) Checks TLS protocol versions for security vulnerabilities SecuritySSL 50 credits Per check ~30 seconds Average runtime Active Status ## How it works Analyzes the TLS protocol versions supported by a web server to identify security vulnerabilities. This checker performs a comprehensive scan of TLS 1.0, 1.1, 1.2, and 1.3 support to ensure servers are configured with secure encryption protocols only. ## What this auditor validates ## What This Checker Analyzes This checker performs a comprehensive analysis of the TLS (Transport Layer Security) protocol versions supported by your web server. It connects to your server and attempts to negotiate connections using different TLS protocol versions to determine which ones are enabled. ### TLS Versions Tested: - **TLS 1.0** (RFC 2246, 1999) - Deprecated and insecure - **TLS 1.1** (RFC 4346, 2006) - Deprecated and insecure - **TLS 1.2** (RFC 5246, 2008) - Secure but aging - **TLS 1.3** (RFC 8446, 2018) - Latest and most secure ### Technical Details: The checker establishes SSL socket connections to your server on the appropriate port (443 for HTTPS, or custom port if specified) and attempts TLS handshakes with each protocol version individually. It uses Java's SSLContext and SSLSocket APIs to perform these negotiations, simulating how real clients would connect to your server. The scan process: 1. Resolves the target hostname and port from the provided URL 2. Creates SSL contexts configured for each TLS version 3. Attempts handshake negotiations for each protocol 4. Records which versions succeed and which fail 5. Analyzes results according to current security best practices ## Output Documentation ## Checker Output Documentation | Status | Condition | Description | Recommended Action | | -------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | โœ… **SUCCESS** | Only TLS 1.3 supported | Server supports TLS 1.3 exclusively and does not accept any legacy protocol versions. This represents the highest level of security configuration. | **Maintain current configuration.** Ensure monitoring is in place to detect any configuration drift. | | โš ๏ธ **WARNING** | Only TLS 1.2 supported | Server supports TLS 1.2 but not TLS 1.3, and crucially does not support deprecated versions TLS 1.0/1.1. While secure, TLS 1.3 would provide better performance and security. | **Plan TLS 1.3 upgrade.** Research server/load balancer capabilities for TLS 1.3 support and plan implementation timeline. | | โŒ **FAIL** | TLS 1.0 or 1.1 detected | Server accepts connections using deprecated TLS 1.0 or 1.1 protocols, regardless of whether it also supports newer versions. This creates immediate security vulnerabilities. | **Immediate action required.** Disable TLS 1.0 and 1.1 support in server configuration. Test thoroughly before deployment. | | โŒ **FAIL** | No TLS versions detected | Unable to establish TLS connections using any tested protocol versions, or the server/URL is unreachable. | **Investigate connectivity.** Verify server is running, URL is correct, and firewall rules allow TLS connections on the expected port. | ### Additional Response Data: - **protocolSupport**: Object showing which TLS versions are supported (true/false for each) - **insecureVersions**: Array listing specifically which deprecated versions were detected - **recommendedVersion**: The highest secure version detected - **host/port**: Connection details used for the scan ## Risks and Considerations ## Security Risks of Ignoring TLS Version Issues ### Critical Risks (Immediate Action Required): **TLS 1.0 and 1.1 Support Detected:** - **Data Interception**: These protocols contain known cryptographic weaknesses that can be exploited by attackers to decrypt sensitive data in transit - **Man-in-the-Middle Attacks**: Vulnerable to protocol downgrade attacks where attackers force connections to use weaker encryption - **Compliance Violations**: PCI DSS, HIPAA, and other standards explicitly prohibit TLS 1.0/1.1 for handling sensitive data - **Browser Warnings**: Modern browsers display security warnings or block connections to sites using deprecated TLS versions - **Reputation Damage**: Security scanners and audits will flag your site as insecure, potentially damaging customer trust ### Performance and Future-Proofing Risks: **Missing TLS 1.3 Support:** - **Reduced Performance**: TLS 1.3 offers significant performance improvements with faster handshakes and reduced latency - **Enhanced Security**: Missing out on the latest cryptographic improvements and attack mitigations - **Future Compatibility**: As TLS 1.3 adoption grows, lacking support may cause compatibility issues with newer clients ### Business Impact: - **SEO Penalties**: Search engines may rank sites with poor security configurations lower - **Customer Loss**: Users may abandon transactions when seeing security warnings - **Legal Liability**: Data breaches exploiting known TLS vulnerabilities can result in legal consequences - **Audit Failures**: Security audits and penetration tests will identify TLS configuration as a high-priority vulnerability ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact โšก # Time To First Byte Auditor Performance Auditor [Back](/auditors) Measures website response time performance Performance 10 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker measures the Time To First Byte (TTFB) performance metric to evaluate website response speed and server performance. The checker sends HTTP request to the website, measures time from request to first byte received, and categorizes performance based on response time thresholds. It follows the recomendation of https://web.dev/articles/optimize-ttfb ## What this auditor validates This checker measures the Time To First Byte (TTFB) performance metric to evaluate website response speed and server performance. It sends HTTP request to the website, measures time from request to first byte received, and categorizes performance based on response time thresholds. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ---------------- | ---------------------------------- | | **SUCCESS** | TTFB is fast | Response time โ‰ค 600ms | | **WARNING** | TTFB is moderate | Response time > 600ms and โ‰ค 1000ms | | **FAIL** | TTFB is slow | Response time > 1000ms | ## Risks and Considerations **Poor User Experience**: Slow response times lead to user frustration and increased bounce rates. **SEO Penalties**: Google considers page speed as a ranking factor, so slow sites may rank lower. **Lost Revenue**: Slow sites typically have lower conversion rates and reduced user engagement. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿฆ # Twitter Card Auditor SEO Auditor [Back](/auditors) Validates Twitter Card meta tags for social media sharing optimization SEOSocial Networks 10 credits Per check ~30 seconds Average runtime Active Status ## How it works The Twitter Card Checker validates that HTML pages contain proper Twitter Card meta tags according to Twitter's Card specification. Twitter Cards enhance how your content appears when shared on Twitter, providing rich previews with images, titles, and descriptions. The checker analyzes the HTML document's section to identify and validate Twitter Card meta tags. It looks for: 1. Meta Tag Detection: Scans for tags with name or property attributes starting with "twitter:" 2. Required Tag Validation: Ensures mandatory tags (twitter:card and twitter:title) are present and have non-empty values 3. Card Type Validation: Verifies that twitter:card values are valid (summary, summary_large_image, app, player) 4. URL Validation: Checks that image and URL references are absolute URLs 5. Semantic Validation: Validates card-type-specific requirements (e.g., summary_large_image requires twitter:image) 6. Accessibility Check: Ensures image alt text is provided when images are present 7. Duplicate Detection: Identifies duplicate meta tags that could cause conflicts Output Results: - Success: All required Twitter Card tags are present and properly configured - Warning: Twitter Card tags are present but have configuration issues - Fail: Required Twitter Card tags are missing or completely empty ## What this auditor validates This checker validates that HTML pages contain proper Twitter Card meta tags for optimal Twitter sharing and preview generation. It scans for Twitter Card meta tags (twitter:card, twitter:title, etc.), validates card types and required attributes, checks for semantic consistency and URL formats, and identifies missing required tags and configuration issues. ## Output Documentation | Status | Condition | Test Logic | | ----------- | ---------------------------------- | -------------------------------------------- | | **SUCCESS** | Required Twitter Card tags present | All required tags found with valid values | | **WARNING** | Twitter Card tags with issues | Tags present but with configuration problems | | **FAIL** | Missing required Twitter Card tags | Required tags missing or empty | ## Risks and Considerations **Poor Social Media Presence**: Without Twitter Cards, your content may appear unprofessional when shared on Twitter. **Reduced Engagement**: Poor previews can reduce click-through rates from Twitter. **Brand Inconsistency**: Inconsistent Twitter appearance can damage brand perception. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ” # X-Content-Type-Options Auditor Security Auditor [Back](/auditors) Validates X-Content-Type-Options header for MIME sniffing protection Security 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates the X-Content-Type-Options header to ensure it's properly configured to prevent MIME sniffing attacks. The checker retrieves the X-Content-Type-Options header from HTTP response, validates that the header value is set to "nosniff", and checks for proper header configuration. ## What this auditor validates This checker validates the X-Content-Type-Options header to ensure it's properly configured to prevent MIME sniffing attacks. It retrieves the X-Content-Type-Options header from HTTP response, validates that the header value is set to "nosniff", and checks for proper header configuration. ## Output Documentation | Status | Condition | Test Logic | | ----------- | --------------------------- | --------------------------------------- | | **SUCCESS** | Header correctly configured | X-Content-Type-Options set to "nosniff" | | **FAIL** | Header issues | Header missing or has invalid value | ## Risks and Considerations **MIME Sniffing Attacks**: Without proper configuration, browsers may execute malicious content disguised as safe file types. **Security Vulnerabilities**: Attackers can exploit MIME sniffing to deliver malware or execute unauthorized code. **Data Breaches**: Malicious content execution can lead to data theft and system compromise. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact ๐Ÿ›ก๏ธ # X-Frame-Options Auditor Security Auditor [Back](/auditors) Validates X-Frame-Options header for clickjacking protection Security 20 credits Per check ~30 seconds Average runtime Active Status ## How it works This checker validates the X-Frame-Options header to ensure it's properly configured to prevent clickjacking attacks. The checker retrieves the X-Frame-Options header from HTTP response, validates header values (DENY, SAMEORIGIN, ALLOW-FROM), and checks for proper security configuration. ## What this auditor validates This checker validates the X-Frame-Options header to ensure it's properly configured to prevent clickjacking attacks. It retrieves the X-Frame-Options header from HTTP response, validates header values (DENY, SAMEORIGIN, ALLOW-FROM), and checks for proper security configuration. ## Output Documentation | Status | Condition | Test Logic | | ----------- | -------------------------- | ----------------------------------------------------- | | **SUCCESS** | Header properly configured | X-Frame-Options set to DENY or SAMEORIGIN | | **WARNING** | Legacy header value | X-Frame-Options uses ALLOW-FROM or unrecognized value | | **FAIL** | Header missing | X-Frame-Options header not found | ## Risks and Considerations **Clickjacking Attacks**: Without proper X-Frame-Options, attackers can embed your site in malicious frames to trick users. **User Data Theft**: Clickjacking can lead to unauthorized actions and data theft. **Brand Reputation**: Security incidents can damage user trust and brand reputation. ## Ready to start auditing? Add this auditor to your monitoring setup and start identifying issues on your websites today. [Get Started Free](/)[Explore More Auditors](/auditors) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Blog](/blog) # The Great CDN Failure: When Global Infrastructure Lets You Down Thiago Moreira 7/24/2025 10 min read cdninfrastructureoutagesresiliencemonitoring A deep dive into how CDN outages can bring down thousands of websites simultaneously. Learn from major incidents and discover how to build resilience into your monitoring strategy. # The Great CDN Failure: When Global Infrastructure Lets You Down On June 8, 2021, the internet broke. Well, not exactly, but it felt that way. A single CDN provider's outage brought down major websites including Amazon, Reddit, Twitch, and thousands of others. This incident perfectly illustrates why monitoring your CDN is just as important as monitoring your own servers. ## What is a CDN and Why It Matters ### Content Delivery Network Basics A CDN is a network of servers distributed globally that: - Cache your website's static content - Serve content from locations closest to users - Reduce server load and improve performance - Provide redundancy and reliability ### The Double-Edged Sword While CDNs improve performance and reliability, they also create a single point of failure. When your CDN goes down, your website can become: - Completely inaccessible - Extremely slow to load - Partially broken (missing images, CSS, JavaScript) ## Major CDN Outages: Lessons Learned ### The Fastly Incident (June 2021) **Duration**: 1 hour **Impact**: Thousands of major websites offline **Cause**: Configuration error during routine maintenance **Estimated losses**: $6+ billion globally **Affected sites included**: - Amazon - Reddit - Twitch - The New York Times - UK Government websites - Spotify ### The Cloudflare Outage (July 2020) **Duration**: 27 minutes **Impact**: 50% of Cloudflare's network offline **Cause**: Router configuration error **Customer impact**: Millions of websites affected ### The AWS CloudFront Issues (Multiple incidents) Various outages affecting: - Netflix streaming - Disney+ launches - Major e-commerce platforms - Enterprise applications ## The Customer Experience During CDN Failures ### What Users See When your CDN fails, customers experience: - **Blank pages**: CSS and JavaScript fail to load - **Broken layouts**: Images and fonts missing - **Slow performance**: Traffic routes to origin servers - **Complete outages**: If origin servers can't handle the load ### The Panic Response During the Fastly outage, businesses experienced: - **Immediate revenue loss**: E-commerce sites went offline during peak hours - **Customer confusion**: Users thought individual sites were broken - **Support ticket floods**: Help desks overwhelmed with "site down" reports - **Social media chaos**: Companies scrambling to communicate status ## Why Traditional Monitoring Fails ### The Blind Spot Problem Most monitoring solutions check if your origin server is responding, but they don't verify: - CDN edge server health - Content delivery performance - Geographic availability variations - Cache hit/miss ratios ### False Sense of Security Your monitoring might show "all green" while: - CDN edges are serving stale content - Performance has degraded significantly - Users in certain regions can't access your site - SSL certificates at edge locations have expired ## Comprehensive CDN Monitoring Strategy ### 1. Multi-Location Testing Monitor your site from multiple geographic locations to ensure: - Global availability - Consistent performance - Regional CDN health - Failover functionality ### 2. CDN-Specific Metrics Track key CDN performance indicators: - **Cache hit ratio**: Percentage of requests served from cache - **Origin shield effectiveness**: Reduction in origin server load - **Edge response times**: Performance at CDN locations - **Bandwidth usage**: Traffic patterns and spikes ### 3. Real User Monitoring (RUM) Collect data from actual users to understand: - Real-world performance variations - Geographic performance differences - Device-specific issues - Network condition impacts ### 4. Synthetic Monitoring Use automated tests to continuously verify: - Content delivery functionality - Performance from key locations - Failover mechanisms - SSL certificate validity at edges ## Building CDN Resilience ### 1. Multi-CDN Strategy Don't put all your eggs in one basket: - Use multiple CDN providers - Implement automatic failover - Load balance between providers - Test failover scenarios regularly ### 2. Origin Server Preparation Ensure your origin can handle traffic spikes: - Scale server capacity appropriately - Implement robust caching strategies - Optimize database performance - Plan for CDN bypass scenarios ### 3. Monitoring Integration Connect CDN monitoring with: - Incident response systems - Customer communication tools - Performance dashboards - Business intelligence platforms ## CDN Monitoring Tools and Techniques ### Essential Monitoring Points - **Edge server availability**: Are CDN nodes responding? - **Content freshness**: Is cached content up to date? - **Performance metrics**: Response times from various locations - **Error rates**: 4xx and 5xx errors from CDN edges - **SSL certificate status**: Valid certificates at all locations ### Alert Configuration Set up alerts for: - CDN provider status page updates - Performance degradation beyond thresholds - Increased error rates - Cache hit ratio drops - Origin server load spikes ### Dashboard Essentials Create dashboards showing: - Global performance map - CDN vs. origin performance comparison - Traffic distribution across edges - Error rate trends - Cost optimization opportunities ## The Business Case for CDN Monitoring ### Cost of CDN Failures - **Direct revenue loss**: Sales during outages - **Customer acquisition cost**: Lost visitors may not return - **Brand reputation**: Trust erosion from unreliability - **Operational costs**: Emergency response and communication ### ROI of Comprehensive Monitoring - **Faster incident detection**: Minutes vs. hours - **Proactive issue resolution**: Fix problems before customers notice - **Performance optimization**: Data-driven CDN configuration - **Cost optimization**: Right-size CDN usage based on real data ## Preparing for the Next CDN Crisis ### Incident Response Planning 1. **Detection**: Automated monitoring and alerting 2. **Assessment**: Quickly determine scope and impact 3. **Communication**: Inform customers and stakeholders 4. **Mitigation**: Activate backup plans and workarounds 5. **Recovery**: Restore normal operations 6. **Post-mortem**: Learn and improve for next time ### Communication Strategy Prepare templates for: - Customer notifications - Social media updates - Internal team communications - Stakeholder reports ## Conclusion CDN failures are inevitable, but their impact on your business doesn't have to be catastrophic. By implementing comprehensive CDN monitoring, building resilience into your architecture, and preparing for incidents, you can minimize the impact of the next great CDN failure. Remember: Your CDN is only as reliable as your ability to monitor and respond to its failures. Don't wait for the next global outage to expose your blind spots. ### More Articles [How Midnight Fire Drills Inspired Me to Build 37 AuditsMoments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients.9/6/20253 min read](/blog/how-midnight-fire-drills-inspired-me-to-build-37-audits)[SSL Certificate Expiration: The Silent Website KillerLearn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business.8/26/20253 min read](/blog/ssl-certificate-expiration-silent-killer) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Blog](/blog) # The Hidden Costs of Website Downtime: A Customer's Nightmare Thiago Moreira 8/21/2025 2 min read downtimemonitoringbusiness-impactcase-study Discover how unexpected website outages can devastate customer trust, revenue, and brand reputation. Learn from real-world examples of businesses that lost millions due to poor monitoring. # The Hidden Costs of Website Downtime: A Customer's Nightmare When your website goes down, the clock starts tickingโ€”and so do the costs. As someone who has experienced the devastating impact of unmonitored website failures, I can tell you that the true cost of downtime extends far beyond lost sales. ## The Immediate Impact **Revenue Loss**: Every minute your site is down, you're losing potential customers. For e-commerce sites, this can mean thousands of dollars per hour. **Customer Trust**: Nothing erodes customer confidence faster than a website that's unreliable. Once lost, trust takes months or even years to rebuild. ## Real-World Examples ### Case Study 1: The E-commerce Disaster A mid-sized online retailer experienced a 6-hour outage during Black Friday. The result? - **$2.3 million in lost sales** - **40% increase in customer service calls** - **15% drop in customer retention over the following quarter** ### Case Study 2: The SaaS Platform Meltdown A popular SaaS platform went down for 3 hours during peak business hours: - **500+ customers affected** - **$180,000 in refunds and credits** - **Permanent loss of 12% of their customer base** ## The Ripple Effect Website downtime doesn't just affect immediate sales. It creates a cascade of problems: 1. **SEO Impact**: Search engines penalize unreliable sites 2. **Social Media Backlash**: Customers vent frustrations publicly 3. **Competitor Advantage**: Users switch to more reliable alternatives 4. **Employee Productivity**: Internal teams can't access critical tools ## Prevention is Key The solution isn't just having a websiteโ€”it's having a **monitored** website. Proactive monitoring can: - Detect issues before customers notice - Provide instant alerts to your team - Pinpoint root cause with a push of a button - Track performance trends over time ## Conclusion In today's digital-first world, website reliability isn't optionalโ€”it's essential. The cost of implementing comprehensive monitoring is a fraction of what you'll lose from a single significant outage. Don't wait for disaster to strike. Start monitoring your website today. ### More Articles [How Midnight Fire Drills Inspired Me to Build 37 AuditsMoments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients.9/6/20253 min read](/blog/how-midnight-fire-drills-inspired-me-to-build-37-audits)[SSL Certificate Expiration: The Silent Website KillerLearn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business.8/26/20253 min read](/blog/ssl-certificate-expiration-silent-killer) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Blog](/blog) # How Midnight Fire Drills Inspired Me to Build 37 Audits Thiago Moreira 9/6/2025 3 min read downtimedamage-controlbusiness-impactinception-moment Moments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients. Some of the best ideas come not from peace of mindโ€”but from moments of chaos. As the head of Customer Experience at Liferay in Latin America, I lived through more than a few of those nights. **37 Audits** was born out of exactly that: two high-stakes incidents that made me realize just how exposed we were when we operated *reactively* instead of *proactively*. --- ## When a 59MB Video Took Down the Cluster It started with a seemingly harmless publication: a client added a video to their homepage. Nothing unusual โ€” except they uploaded the **59MB file directly into the CMS**. No CDN, no lazy loading, no streaming. The result? The homepage was serving that video to every visitor straight from the app server. Traffic spiked. Resources were drained. And within minutes, the entire cluster was brought to its knees. The homepage had effectively become a **denial-of-service vector** โ€” completely unintentionally. We spent hours triaging and troubleshooting until we figured out that the root cause was the video. But it stuck with me: this wasnโ€™t a bug. It was a mix of **knowledge gaps and the absence of safeguards** that turned into major downtime. A situation that could have been totally avoided became another fire-drill episode. That was the moment I realized: we didnโ€™t have anything in place to proactively detect these kinds of issues. --- ## The Night a CVE Blew Up on X.com A few weeks later, I was getting ready to log off late at night when my phone buzzed. On the other end was someone from one of the **largest oil companies in the world** โ€” and they werenโ€™t calling to chat. They told me they were being **exposed on X (formerly Twitter)**, right that second, because of a **known CVE** in the version of Liferay they were running. And I had no idea it was coming. From that moment on, we were in full damage control mode. I scrambled to get the infosec team involved, opened a Slack channel, and tried to contain the fallout. But the reality hit me: we were completely reactive. We found out only *after* the exposure happened. And that wasnโ€™t a place I wanted to be again. A few questions came to my sleepy brain: - Why didnโ€™t we catch this before it exploded? - Why wasnโ€™t this automatically flagged? --- ## From Crisis Mode to Continuous Audits Those two moments were turning points. I didnโ€™t want to stay in a cycle of firefighting. I wanted a way to catch these issues **before** they caused outages, data leaks, or brand damage. Thatโ€™s when I started building small scripts to check my customersโ€™ websites โ€” scripts that eventually led to **37 Audits**, a platform that continuously audits websites for: - ๐Ÿšจ Unoptimized resources - ๐Ÿ” Outdated software versions - ๐Ÿ” SEO issues - ๐Ÿ›ก๏ธ Security header misconfigurations - โš™๏ธ And much more... What used to be **late-night surprises** are now **proactive audits**. And what used to keep me up at night now gets flagged, categorized, and resolvedโ€”*before* it ever hits production. ### More Articles [SSL Certificate Expiration: The Silent Website KillerLearn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business.8/26/20253 min read](/blog/ssl-certificate-expiration-silent-killer)[The Hidden Costs of Website Downtime: A Customer's NightmareDiscover how unexpected website outages can devastate customer trust, revenue, and brand reputation. Learn from real-world examples of businesses that lost millions due to poor monitoring.8/21/20252 min read](/blog/hidden-costs-website-downtime) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Blog](/blog) # JavaScript Errors: The Silent Conversion Killers Hiding in Your Code Thiago Moreira 7/21/2025 11 min read javascripterrorsmonitoringconversionsdebugging Uncover how client-side JavaScript errors are secretly destroying your user experience and conversion rates. Learn to detect, monitor, and fix these invisible problems. # JavaScript Errors: The Silent Conversion Killers Hiding in Your Code Your website looks perfect. Your server monitoring shows all green. Your analytics report healthy traffic. But something sinister is happening in your users' browsersโ€”JavaScript errors are silently killing conversions, and you might not even know it. ## The Invisible Problem ### Why JavaScript Errors Go Unnoticed Unlike server errors that trigger alerts and appear in logs, JavaScript errors: - Happen only in user browsers - Don't affect server performance metrics - Often fail silently without visual indicators - Vary by browser, device, and user environment ### The Scale of the Problem Studies show that: - **Average website has 10+ JavaScript errors** per page load - **23% of users** experience at least one JavaScript error during their visit - **JavaScript errors increase bounce rates by 15-25%** - **Conversion rates drop 8-12%** on pages with frequent errors ## Common JavaScript Error Scenarios ### 1. The Broken Checkout Process **Scenario**: E-commerce site's payment form stops working **Cause**: Third-party payment script conflicts with site JavaScript **User Experience**: - Form appears to submit but nothing happens - Users try multiple times, getting frustrated - Abandon cart and shop elsewhere **Business Impact**: - 40% drop in checkout completion - $50,000 monthly revenue loss - Increased customer service calls ### 2. The Analytics Black Hole **Scenario**: Tracking scripts fail to load or execute **Cause**: Ad blockers, network issues, or script conflicts **Hidden Impact**: - Underreported conversion data - Incorrect attribution - Poor marketing decisions based on bad data - Wasted advertising spend ### 3. The Mobile Disaster **Scenario**: Site works perfectly on desktop, breaks on mobile **Cause**: Touch event handling errors, viewport issues **User Experience**: - Buttons don't respond to taps - Forms can't be submitted - Navigation menus don't work - Content doesn't display properly ## Types of JavaScript Errors to Monitor ### 1. Syntax Errors ```javascript // Missing closing bracket function calculateTotal(price, tax { return price + (price * tax); } ``` **Impact**: Entire script fails to execute ### 2. Reference Errors ```javascript // Undefined variable console.log(undefinedVariable); ``` **Impact**: Function execution stops ### 3. Type Errors ```javascript // Calling method on null object document.getElementById('nonexistent').click(); ``` **Impact**: Feature becomes non-functional ### 4. Network Errors - Failed to load external scripts - CDN timeouts - CORS policy violations - Resource not found (404) errors ### 5. Third-Party Script Failures - Social media widgets - Analytics tracking - Payment processors - Chat systems - Advertising scripts ## Real-World Error Impact Stories ### Case Study 1: The SaaS Signup Disaster A B2B SaaS company discovered their signup form had a JavaScript error affecting 15% of users: - **Error**: Form validation script failed on certain browsers - **Symptom**: Users couldn't submit registration forms - **Duration**: 3 months undetected - **Impact**: * 450 lost signups * $180,000 in lost annual recurring revenue * Damaged reputation from "broken" website reports ### Case Study 2: The Mobile Shopping Catastrophe An online retailer's mobile site had touch event errors: - **Error**: Product image gallery didn't work on iOS Safari - **Symptom**: Users couldn't view product details - **Duration**: 6 weeks undetected - **Impact**: * 60% mobile bounce rate increase * $300,000 in lost mobile sales * Negative app store reviews ### Case Study 3: The Analytics Nightmare A marketing agency discovered their client's tracking was broken: - **Error**: Google Analytics script conflicts - **Symptom**: 40% of conversions not tracked - **Duration**: 4 months undetected - **Impact**: * Incorrect campaign performance data * $75,000 in wasted ad spend * Wrong strategic decisions based on bad data ## The Challenge of JavaScript Error Detection ### Why Traditional Monitoring Fails Server-side monitoring can't detect: - Client-side script execution failures - Browser-specific compatibility issues - User interaction problems - Third-party script failures - Network-related JavaScript loading issues ### The Complexity of Modern Web Apps Today's websites include: - Multiple JavaScript frameworks - Dozens of third-party scripts - Complex user interactions - Dynamic content loading - Single-page application logic ## Comprehensive JavaScript Error Monitoring ### 1. Error Tracking Implementation ```javascript // Basic error tracking window.addEventListener('error', function(e) { // Log error details console.error('JavaScript Error:', { message: e.message, filename: e.filename, lineno: e.lineno, colno: e.colno, stack: e.error?.stack }); }); // Promise rejection tracking window.addEventListener('unhandledrejection', function(e) { console.error('Unhandled Promise Rejection:', e.reason); }); ``` ### 2. Key Metrics to Monitor - **Error frequency**: Errors per page view - **Error impact**: Percentage of users affected - **Error types**: Categorization of error patterns - **Browser breakdown**: Error rates by browser/version - **Page-specific errors**: Which pages have most errors - **User journey impact**: Errors affecting conversion funnels ### 3. Advanced Error Context Capture additional information: - User agent and browser version - Screen resolution and device type - User actions leading to error - Network connection quality - A/B test variations - User authentication status ## JavaScript Error Prevention Strategies ### 1. Defensive Programming ```javascript // Safe property access const userEmail = user?.profile?.email || 'default@example.com'; // Safe function calls if (typeof analytics !== 'undefined' && analytics.track) { analytics.track('Page View'); } // Error boundaries in React class ErrorBoundary extends React.Component { componentDidCatch(error, errorInfo) { // Log error to monitoring service logErrorToService(error, errorInfo); } } ``` ### 2. Third-Party Script Management - Load scripts asynchronously when possible - Implement fallbacks for critical functionality - Monitor third-party service status - Use Content Security Policy (CSP) headers - Regularly audit and remove unused scripts ### 3. Cross-Browser Testing - Test on multiple browsers and versions - Use automated browser testing tools - Monitor browser usage analytics - Implement progressive enhancement - Provide graceful degradation ## Monitoring Tools and Implementation ### Error Tracking Services Popular options include: - **Sentry**: Comprehensive error tracking with context - **Bugsnag**: Error monitoring with release tracking - **Rollbar**: Real-time error tracking and alerting - **LogRocket**: Session replay with error correlation ### Custom Monitoring Solutions Build internal tracking for: - Business-specific error patterns - Custom performance metrics - Integration with existing systems - Compliance and data privacy requirements ### Alert Configuration Set up alerts for: - Error rate spikes above normal thresholds - New error types not seen before - Errors affecting critical user journeys - Third-party script failures - Browser-specific error patterns ## The Business Impact of JavaScript Error Monitoring ### Quantifiable Benefits - **Conversion rate improvements**: 5-15% increase typical - **Reduced support tickets**: 20-30% fewer "site broken" reports - **Better user experience**: Higher satisfaction scores - **Improved SEO**: Better Core Web Vitals scores - **Data accuracy**: More reliable analytics and tracking ### ROI Calculation **Investment**: - Error monitoring tools: $50-500/month - Implementation time: 10-20 hours - Ongoing maintenance: 2-4 hours/month **Returns**: - Prevented revenue loss: $10,000-100,000+/month - Reduced development costs: Faster bug fixes - Improved customer satisfaction: Reduced churn - Better decision making: Accurate data ## Building a JavaScript Error Response Process ### 1. Detection and Alerting - Automated error detection - Intelligent alert thresholds - Escalation procedures - Integration with incident management ### 2. Triage and Prioritization - Impact assessment (users affected, revenue impact) - Error severity classification - Resource allocation - Timeline estimation ### 3. Resolution and Prevention - Root cause analysis - Fix implementation and testing - Deployment and monitoring - Post-incident review and learning ## Conclusion JavaScript errors are the silent killers of online success. They hide in plain sight, destroying user experiences and conversion rates while remaining invisible to traditional monitoring systems. The solution isn't just to fix errors when you find themโ€”it's to build comprehensive monitoring that catches them before they impact your business. Every JavaScript error you prevent is a conversion you save and a customer you keep. Don't let silent errors kill your success. Start monitoring your JavaScript today, and watch your conversion rates recover. ### More Articles [How Midnight Fire Drills Inspired Me to Build 37 AuditsMoments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients.9/6/20253 min read](/blog/how-midnight-fire-drills-inspired-me-to-build-37-audits)[SSL Certificate Expiration: The Silent Website KillerLearn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business.8/26/20253 min read](/blog/ssl-certificate-expiration-silent-killer) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Blog](/blog) # Performance Monitoring: Why Page Speed Kills Conversions Thiago Moreira 7/26/2025 9 min read performancepage-speedconversionsoptimizationmonitoring Explore the direct correlation between website performance and business success. Learn how slow loading times are costing you customers and revenue every day. # Performance Monitoring: Why Page Speed Kills Conversions In the digital age, speed isn't just a nice-to-haveโ€”it's a business imperative. Every second your website takes to load is costing you customers, conversions, and cash. ## The Speed-Success Connection ### The Numbers Don't Lie - **53% of mobile users** abandon sites that take longer than 3 seconds to load - **1-second delay** in page response can result in a 7% reduction in conversions - **Amazon loses $1.6 billion** annually for every second of delay ### Google's Speed Obsession Google uses page speed as a ranking factor because they know: - Fast sites provide better user experience - Users prefer quick-loading results - Speed correlates with user satisfaction ## The Customer Journey Breakdown ### First Impressions Matter When a potential customer clicks on your link: - **0-2 seconds**: "This looks promising" - **3-5 seconds**: "Come on, load already" - **6+ seconds**: "I'm out of here" ### The Mobile Reality With 60%+ of web traffic coming from mobile devices: - Users expect instant gratification - Network conditions vary wildly - Patience is even shorter than desktop ## Real Performance Horror Stories ### Case Study: The Fashion Retailer An online clothing store discovered their product pages took 8 seconds to load: - **Bounce rate**: 78% - **Conversion rate**: 0.8% - **Customer complaints**: Daily After optimization: - **Load time**: 2.1 seconds - **Bounce rate**: 32% - **Conversion rate**: 4.2% - **Revenue increase**: 425% ### Case Study: The Travel Booking Site A travel website's search results page was painfully slow: - **Average load time**: 12 seconds - **Completed bookings**: 15% of searches - **Customer support tickets**: 200+ daily about "broken" search Post-optimization results: - **Load time**: 3.2 seconds - **Completed bookings**: 67% of searches - **Support tickets**: 90% reduction ## Hidden Performance Killers ### 1. Unoptimized Images - Large file sizes - Wrong formats (PNG instead of WebP) - No compression - Missing responsive sizing ### 2. Third-Party Scripts - Social media widgets - Analytics tracking - Chat systems - Advertising code ### 3. Poor Hosting - Shared hosting limitations - Geographic distance from users - Inadequate server resources - No CDN implementation ### 4. Database Issues - Unoptimized queries - Missing indexes - Excessive database calls - Poor caching strategies ## The Monitoring Solution ### What to Monitor - **Page load times** from multiple locations - **Core Web Vitals** (LCP, FID, CLS) - **Server response times** - **Third-party service performance** - **Mobile vs. desktop performance** ### Key Metrics to Track 1. **Time to First Byte (TTFB)**: Server responsiveness 2. **First Contentful Paint (FCP)**: When users see content 3. **Largest Contentful Paint (LCP)**: Main content loading 4. **Cumulative Layout Shift (CLS)**: Visual stability ### Alert Thresholds Set up alerts when: - Page load time exceeds 3 seconds - Core Web Vitals fall below "Good" thresholds - Server response time increases by 50% - Error rates spike above normal levels ## Performance Optimization Quick Wins ### 1. Image Optimization - Compress images without quality loss - Use modern formats (WebP, AVIF) - Implement lazy loading - Serve responsive images ### 2. Caching Strategy - Browser caching for static assets - CDN for global content delivery - Server-side caching for dynamic content - Database query caching ### 3. Code Optimization - Minify CSS, JavaScript, and HTML - Remove unused code - Optimize critical rendering path - Use efficient frameworks and libraries ### 4. Third-Party Audit - Review all external scripts - Load non-critical scripts asynchronously - Consider self-hosting important assets - Remove unnecessary integrations ## The ROI of Performance Monitoring ### Investment - Monitoring tools: $50-500/month - Optimization work: 20-40 hours initially - Ongoing maintenance: 2-4 hours/month ### Returns - Increased conversion rates: 10-50% - Better search rankings: 5-20% traffic increase - Reduced bounce rates: 20-40% - Improved customer satisfaction: Priceless ## Conclusion Website performance isn't a technical nice-to-haveโ€”it's a business necessity. Every millisecond matters, and continuous monitoring is the only way to ensure your site performs at its best. Don't let slow performance kill your conversions. Start monitoring today and watch your business accelerate. ### More Articles [How Midnight Fire Drills Inspired Me to Build 37 AuditsMoments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients.9/6/20253 min read](/blog/how-midnight-fire-drills-inspired-me-to-build-37-audits)[SSL Certificate Expiration: The Silent Website KillerLearn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business.8/26/20253 min read](/blog/ssl-certificate-expiration-silent-killer) [https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q](https://www.googletagmanager.com/ns.html?id=GTM-PTDZCD6Q) 37 Audits Get Started Contact [Back to Blog](/blog) # SSL Certificate Expiration: The Silent Website Killer Thiago Moreira 8/26/2025 3 min read sslsecuritycertificatesmonitoringpreventionauditing Learn why SSL certificate expiration is one of the most common yet preventable causes of website outages. Discover the warning signs and how to protect your business. # SSL Certificate Expiration: The Silent Website Killer Picture this: It's Monday morning, and your customers are greeted with scary browser warnings when they try to visit your website. Your SSL certificate expired over the weekend, and nobody noticed until it was too late. ## The SSL Certificate Crisis SSL certificates are like digital passports for your website. They: - Encrypt data between your site and visitors - Verify your website's identity - Enable the secure "https://" connection - **Expire without warning** ## Why Certificates Expire Unnoticed ### The "Set It and Forget It" Mentality Most businesses install SSL certificates and assume they'll last forever. The reality? They typically expire every 1-3 years, and renewal isn't automatic. ### Poor Documentation Teams often fail to document: - When certificates were installed - Who manages renewals - Where renewal notifications are sent ### Staff Turnover The person who originally set up your SSL certificate may have left the company, taking critical knowledge with them. --- ## The Customer Experience Disaster When SSL certificates expire, customers see terrifying warnings like: - "Your connection is not private" - "Attackers might be trying to steal your information" - "This site is not secure" **Result**: 70% of users immediately leave the site and may never return. --- ## Real Impact Stories ### The Online Store That Lost Christmas An e-commerce site's SSL certificate expired on December 23rd. They didn't notice until December 26th because: - The IT team was on holiday - Monitoring alerts went to an old email address - Customer complaints were dismissed as "user error" **Damage**: $400,000 in lost holiday sales and 200+ angry customer reviews. ### The SaaS Platform's Trust Crisis A B2B software company's certificate expired during a product demo to their biggest potential client. The prospect: - Questioned their technical competence - Worried about data security - Chose a competitor instead **Lost opportunity**: $2.8 million annual contract. --- ## Prevention Strategies ### 1. Automated Monitoring Set up monitoring that checks certificate expiration dates daily and alerts you 30, 14, and 7 days before expiration. ### 2. Multiple Alert Channels Don't rely on email alone. Use: - SMS notifications - Slack/Teams integration - Dashboard alerts - Phone calls for critical alerts ### 3. Certificate Inventory Maintain a spreadsheet or database tracking: - All domains and subdomains - Certificate providers - Expiration dates - Renewal procedures - Responsible team members ### 4. Automated Renewal Where possible, use services that automatically renew certificates (like Let's Encrypt with proper automation). ## Monitoring Best Practices A good SSL monitoring system should: - Check certificates multiple times per day - Verify the entire certificate chain - Test from multiple geographic locations - Provide detailed expiration information - Send escalating alerts as expiration approaches ## The Bottom Line SSL certificate expiration is 100% preventable with proper monitoring. The cost of monitoring is minimal compared to the potential damage of an expired certificate. Don't let a silent killer destroy your online presence. Audit your SSL certificates today with our [Certificate Checker](/checkers/certificate-expiration-checker). ### More Articles [How Midnight Fire Drills Inspired Me to Build 37 AuditsMoments of crisis led me to build 37 Audits: a platform that proactively detects issues before they become costly outages or reputational disasters. This post shares the real-world origin story behind the tool โ€” and how moving from reactive to proactive monitoring became a game changer for me and my clients.9/6/20253 min read](/blog/how-midnight-fire-drills-inspired-me-to-build-37-audits)[The Hidden Costs of Website Downtime: A Customer's NightmareDiscover how unexpected website outages can devastate customer trust, revenue, and brand reputation. Learn from real-world examples of businesses that lost millions due to poor monitoring.8/21/20252 min read](/blog/hidden-costs-website-downtime)