Website health check · example
Example report: Harbour Lane Bakery
harbourlanebakery.example is a made-up business on an address that cannot belong to anyone. Every figure below is invented to show what a report looks like.
Checked 28 October 2026 at 09:00 (UK time), from the outside, as a visitor would see it.
Fix firstSpeed
Your home page is slow on a phone
Google's Lighthouse scored its speed 41 out of 100, on a simulated mid range phone. The main content took 6.2 seconds to appear. The page and everything it loads came to 4.2 MB. People on a phone often leave a page that keeps them waiting.
What to do: Make the largest picture at the top smaller (save it as WebP, sized for a phone screen), and load less code before the page appears. Run your address at pagespeed.web.dev to see Lighthouse's own list of the heaviest files.
Would you rather someone did this for you? Our website service can.
Fix firstEmail forgery
Anyone can send email that looks like it comes from you
There is no DMARC record, so mail services have no instruction to refuse fakes sent in your name. A fake invoice from your address would look real.
What to do: Add a TXT record named _dmarc at your domain company. Start with "v=DMARC1; p=none; rua=mailto:" and your address to receive reports, then move to p=quarantine and then p=reject once your real email passes.
Would you rather someone did this for you? Our website service can.
Fix firstCookies and other companies
Tracking cookies are set before your visitors agree
On a first visit, before anyone chooses anything, your server sets _ga (Google Analytics). Under the UK's cookie rules (PECR), cookies that are not strictly necessary need the visitor's consent first. This is general information, not legal advice.
What to do: Set these only after the visitor agrees, through your cookie banner, or remove them.
Would you rather someone did this for you? Our website service can.
Worth doingSpeed
Some visitors may struggle to use your page
Lighthouse's accessibility score is 84 out of 100. It checks things like colour contrast, descriptions on pictures and labels on buttons and form fields.
What to do: Run your address at pagespeed.web.dev and work through the list under Accessibility, starting at the top.
Would you rather someone did this for you? Our website service can.
Worth doingSecurity
2 of 6 security headers are set
Security headers are short instructions your site sends with every page, telling browsers how to protect your visitors. Missing: Content security policy, Framing rule, Referrer policy and Permissions policy.
What to do: Ask your web host or developer to add: Content-Security-Policy, listing the sites your pages may load code from (start with default-src 'self' and add what you use); X-Frame-Options: DENY, or frame-ancestors 'none' in your content security policy (stops other sites showing your pages inside theirs); Referrer-Policy: strict-origin-when-cross-origin; Permissions-Policy: camera=(), microphone=(), geolocation=().
Would you rather someone did this for you? Our website service can.
Worth doingSearch basics
Your page title is very short
It is 4 characters, which says little about what you do.
What to do: Say who you are and what you do, for example "Your Business: what you do, where".
Would you rather someone did this for you? Our website service can.
Worth doingSearch basics
Your home page has no description
Without one, search engines pick a few lines from the page themselves, which may not sell you well.
What to do: Write one or two sentences, about 150 characters, saying what you offer and to whom.
Would you rather someone did this for you? Our website service can.
Worth doingSearch basics
Your page does not describe your business to search engines
Structured data is a short block of code that states your business name, address and opening hours in a form search engines read directly.
What to do: Add a LocalBusiness or Organization block (schema.org); many website builders have a setting or plug in for it.
Would you rather someone did this for you? Our website service can.
Worth doingCookies and other companies
Your home page loads Google Analytics
Each of these companies learns that someone visited, and their code usually sets its own cookies once it runs. Our check reads your page without running its code, so it cannot see those cookies.
What to do: Make sure your cookie banner holds analytics and advertising code until the visitor agrees, and name each company in your privacy notice.
Would you rather someone did this for you? Our website service can.
Worth doingCookies and other companies
Your fonts come from Google Fonts
Each visit sends your visitor's internet address to that company.
What to do: Host the font files on your own site instead; it is often faster too.
Would you rather someone did this for you? Our website service can.
Could not checkCookies and other companies
1 other address supply parts of your page
Your home page loads 3 other sites in all. The list is at the end of this report.
What to do: Check you know what each one is, and name the companies in your privacy notice.
Would you rather someone did this for you? Our website service can.
Fine as it isSecurity
Your secure connection is set up well
Every visit moves to https and the certificate is valid for 64 more days.
What to do: Nothing to change.
Would you rather someone did this for you? Our website service can.
Fine as it isEmail forgery
Your emails are signed (DKIM)
We found a DKIM key at 1 common name (google). DKIM lets mail services check an email really came from you.
What to do: Nothing to change.
Would you rather someone did this for you? Our website service can.
Lighthouse scores
Google's Lighthouse, run through PageSpeed Insights on a simulated mid range phone. Out of 100; scores move a little from one run to the next.
| Speed | 41 |
|---|---|
| Accessibility | 84 |
| Best practices | 92 |
| Search basics | 90 |
Other sites your home page loads
By address, as your page names them.
| fonts.googleapis.com | Google Fonts |
| www.googletagmanager.com | Google Analytics |
| cdn.example-booking.example | other |
What this check does not do
- It looks only at your home page, plus your robots.txt, sitemap and public email records.
- It reads your page as it arrives; apart from Lighthouse, it does not run the page's code as a browser does, so cookies set by scripts are not seen.
- Lighthouse is run for us by Google's PageSpeed Insights. If Google does not answer in time, the report says so and gives our own server's timing instead.
- It never signs in, fills in forms or tests for weaknesses. It is not a security test, and it is not legal advice.
- It does not tell you where you rank in search results, and fixing what it finds does not promise any ranking.