What the audit checks

Opens a real TLS connection to the host and inspects what comes back, rather than trusting a header.

HTTPS availability

Whether the final URL is encrypted at all.

Certificate trust

Validates the chain and reports the issuer and subject.

Certificate expiry

Fails under 14 days, warns under 30, so renewals never surprise you.

TLS version

Flags anything below TLS 1.2 as deprecated.

HTTP/2

Reads the ALPN protocol negotiated during the handshake.

HSTS

Checks presence, max-age length and includeSubDomains.

HTTP to HTTPS redirect

Confirms the unencrypted entry point actually upgrades.

Parses the response headers, including the contents of the CSP rather than just its presence.

Content-Security-Policy

Detects unsafe-inline and unsafe-eval, which quietly defeat the policy.

Clickjacking protection

Accepts either frame-ancestors or X-Frame-Options.

X-Content-Type-Options

MIME sniffing left enabled.

Referrer-Policy

Full URLs leaking to third-party origins.

Permissions-Policy

Camera, microphone and geolocation left open to embedded content.

Cross-Origin-Opener-Policy

Window references retained across origins.

Version disclosure

Server, X-Powered-By and similar headers advertising exact versions.

Cookie flags

Secure, HttpOnly and SameSite across every Set-Cookie.

Queries public DNS for the registrable domain — the checks most technical audits skip because they are not visible in the browser.

Nameserver redundancy

A single nameserver is a single point of failure.

SPF

Presence plus whether it ends in a meaningful all mechanism.

DMARC

Presence and whether the policy is monitoring-only or actually enforcing.

CAA

Whether any CA in the world can issue for the domain.

MX

Reported for context, since SPF and DMARC severity depends on it.

Reads the delivered markup and the two well-known files crawlers look for.

Title

Presence and whether the length survives a search result.

Meta description

Presence and length.

Canonical URL

Duplicate-content dilution across URL variants.

Heading structure

Exactly one H1.

Open Graph

og:title and og:image for shared links.

robots.txt and sitemap.xml

Reachability from the site root.

Accidental noindex

A robots meta tag quietly removing the page from search.

Charset

A declared character encoding.

Static checks that can be made from markup alone. We are explicit that this is not a WCAG conformance audit — a real one needs a person and a screen reader.

Document language

A lang attribute on the html element.

Image alt text

Counts images with no alt attribute at all.

Form labels

Fields with nothing a screen reader can announce.

Zoomable viewport

user-scalable=no and low maximum-scale, which fail WCAG 1.4.4.

Icon-only links

Links containing only an icon and no accessible name.

Skip link

A skip-to-content link as the first focusable element.

Positive tabindex

Values that override the natural focus order.

Measures how the document itself arrives. Deliberately weighted low, because a lab measurement of one document is not a field performance profile.

Time to first byte

Measured on the first request, before redirects.

Compression

Whether text was served compressed at all.

Document weight

The HTML alone, before assets.

Cache-Control

An explicit freshness policy.

Redirect chain

Each hop is a full round trip.

Render-blocking scripts

External scripts without async or defer.

Lazy loading

Images with no loading attribute.