Site checklist

Most website problems are not outages. A noindex left over from the staging site, a .env file anyone can download, an http:// address that no longer redirects, a missing DMARC record: the site loads, and nobody notices for weeks. From the Free plan, every website target gets a site checklist. It runs once a day and does not use a monitor slot.

What we check#

Group	Checks
Search engines	page is not noindex (meta tag or X-Robots-Tag), robots.txt does not block the whole site, sitemap, canonical address, title and meta description length, page language, missing pages return 404
Security	http:// redirects permanently to https://, one address with or without www, HSTS, only TLS 1.2 and 1.3, no mixed content, basic security headers, no public /.git or /.env, no software version numbers in headers
Speed and delivery	Brotli or gzip on the page and on CSS and JavaScript, HTTP/2 or HTTP/3, browser cache on the site's own files, at most one redirect
Previews and mobile	Open Graph tags, X card, favicon, mobile viewport
Email and DNS	MX, SPF (one record, no +all), DMARC policy, DKIM under a common selector, CAA, DNSSEC
Privacy	a cookie consent banner or Google Consent Mode on a page with tracking codes

We fetch the page the same way the uptime check does (same headers and password, see allowlisting), then a handful of small requests: robots.txt, sitemap.xml, a page that does not exist, up to six of the site's own CSS, JavaScript and image files, and /.git/HEAD and /.env. For those two we only record whether they are public; we never keep what is in them.

Each item is OK, Check or Fix, with one sentence on why it matters. What we could not find out is shown as –, never as OK: DKIM, for example, can sit under a selector only your mail provider knows.

Previews#

The Checklist tab shows how the page looks in Google search results (title, address and description, cut where Google cuts them) and when it is shared on Facebook, LinkedIn or Slack (the og: title, description and image). The image is a copy we keep, so opening the tab does not load anything from the site.

When we alert#

The checklist is a list to work through, not a stream of alerts. The first reading is the starting point; problems the site already had are shown, not alerted. After that we send a warning only when one of these gets worse:

What changes	Why it matters
The page becomes noindex	the whole site leaves Google
robots.txt starts blocking the whole site	the same, through another door
/.git or /.env becomes public	source code or passwords are exposed
http:// stops redirecting to https://	visitors land on the insecure version

Like a missing tracking code, the warning waits for a second reading 15 minutes later: a cached page or maintenance mode can return a noindex once. There is no SMS and no reminder. When it is fixed you get a resolved message. During a maintenance window the checklist does not alert.

After fixing something on the site, use Check now on the Checklist tab instead of waiting for the next daily run.