Help and methodology
Website Analyzer reviews publicly available information across ten areas. This guide explains what each part of the report means, how scoring works, and where the available data may be limited.
Use the report to understand technical findings in plain language and decide what to review with a developer.
Use it for a quick view of public technology, infrastructure, performance, security, and metadata signals.
Each part of the report describes the evidence found and, where relevant, suggests what to review.
Where the site is served from
Why it matters. Hosting and network configuration affect availability and response times.
Example. A report may identify Vercel as the host and Cloudflare as the CDN.
Public registration information
Why it matters. Registration data can help confirm a domain's history and renewal status.
Example. An established domain may show its original registration date and current expiry date.
Software detected on the site
Why it matters. This gives a quick view of how a site is built and what may need maintenance.
Example. Evidence in the page may identify React and Next.js.
Structure of the visible page
Why it matters. Clear structure helps visitors, assistive technology, and search engines understand a page.
Example. The report may note one clear H1 followed by logically ordered H2 headings.
How pages are exposed to crawlers
Why it matters. Sitemaps and robots rules influence how search engines discover a site's public pages.
Example. The report may find a sitemap index and count the URLs it contains.
HTTP protection and delivery settings
Why it matters. Headers, encryption, compression, and caching affect browser security and delivery efficiency.
Example. A report may identify HSTS, a content security policy, HTTP/2, and compression.
Support for different ways of using the web
Why it matters. Accessible markup makes content easier to use with assistive technology.
Example. The report may show how many meaningful images have alternative text.
Signals related to smaller screens
Why it matters. Mobile configuration affects whether pages display and respond appropriately on phones.
Example. A responsive viewport and appropriately sized controls are reported when detected.
Services loaded by the page
Why it matters. Third-party services can affect privacy, performance, and site functionality.
Example. The report may identify Google Analytics, Stripe, or a support widget from public page evidence.
Search and sharing metadata
Why it matters. These elements help search engines and social platforms interpret and present a page.
Example. The report may show whether a title, canonical URL, and social preview metadata are present.
The summary combines a weighted score with detected strengths and prioritized recommendations.
Each category is a fixed list of checks with set point values. The category score is the points earned divided by the points available, so every number can be traced back to a specific check. Tap the question mark beside a score in a report to see every check, its points and the evidence behind it.
The overall score is a weighted average: Security 25%, Performance 25%, SEO 20%, Best Practices 15%, and Accessibility 15%. If a category cannot be measured — for example when a CDN hides response headers — it is excluded and its weight is shared across the categories that did return data, rather than counted as zero.
A
90–100
Excellent
B+
80–89
Very good
B
70–79
Good
C+
60–69
Fair
C
50–59
Needs work
D
Below 50
Poor
The summary lists up to five detected strengths, such as HTTPS, responsive design, a CDN, modern frameworks, or useful accessibility markup.
The summary lists up to five recommendations, ordered by severity and then by category. Critical and high-priority security findings appear before lower-priority items.
Scores are a guide, not a requirement to reach 100. Review critical issues first, then consider the remaining recommendations in the context of the site.
When a CDN or firewall hides some technical details, the report says “Based on available data” and calculates the score from categories it can inspect.
Definitions for common fields in the detailed report, with a neutral example and guidance on what to review.
Where the site is served and how traffic reaches it.
VercelThe company or platform serving the site.
Good signal. A recognized, maintained hosting platform
Review. Unreliable or unsupported hosting
104.21.75.212The public network address returned for the site.
Good signal. An address with a clean reputation
Review. An address associated with spam or malware
CloudflareA network that can serve or protect a site from locations closer to visitors.
Good signal. A correctly configured CDN when the site needs one
Review. No CDN where distance materially affects delivery
Amazon Web ServicesThe organization responsible for the underlying network.
Good signal. A known provider with suitable reliability
Review. An unknown or unreliable provider
Browser protections visible in the HTTP response.
default-src 'self'Controls which sources may load scripts and other content.
Good signal. A restrictive policy suited to the site
Review. No policy or an unnecessarily broad policy
max-age=31536000Tells browsers to continue using HTTPS for a stated period.
Good signal. A long duration with appropriate subdomain coverage
Review. No HSTS policy
DENYControls whether other sites can place the page inside a frame.
Good signal. CSP frame-ancestors or a suitable X-Frame-Options value
Review. No frame restriction where one is needed
ValidEncrypts traffic between a visitor and the site.
Good signal. A valid, current certificate
Review. An expired, invalid, or missing certificate
Software and development tools evidenced by the public page.
WordPress 6.3The content management system used to edit and publish the site.
Good signal. A maintained and current platform
Review. An outdated version with known issues
React 18.2.0Libraries or frameworks used for interactive parts of the page.
Good signal. A maintained framework appropriate to the site
Review. Old or unsupported dependencies
JavaScript, PHPProgramming languages indicated by public evidence.
Good signal. Maintained language versions
Review. Unsupported versions with known issues
Webpack, ViteTools used to compile and optimize site assets.
Good signal. A maintained build process
Review. Unoptimized assets where a build process would help
How search engines and social platforms interpret the page.
Best Coffee in Seattle | Joe's CafeThe page title commonly shown in search results and browser tabs.
Good signal. A descriptive title of a suitable length
Review. A missing, generic, or excessively long title
Fresh roasted coffee and pastries in downtown Seattle since 1995.A summary that search engines may show beneath the title.
Good signal. A specific description of a suitable length
Review. Missing, unclear, or excessively long text
og:title, og:description, og:imageMetadata controlling previews on many social platforms.
Good signal. Complete metadata with an appropriate image
Review. Missing tags that leave previews incomplete
LocalBusinessStructured data that describes entities and page content.
Good signal. Valid schema relevant to the page
Review. Missing or invalid markup where structured data applies
Public signals related to delivery efficiency.
EnabledA protocol that can transfer multiple resources efficiently over one connection.
Good signal. HTTP/2 or HTTP/3
Review. HTTP/1.1 where it creates a measurable limitation
Brotli enabledReduces text-file size before transfer.
Good signal. Brotli or gzip for suitable assets
Review. Uncompressed text assets
max-age=31536000Controls how long browsers may reuse downloaded files.
Good signal. Appropriate long-lived caching for versioned assets
Review. No caching for assets that rarely change
WebP formatUses modern formats and suitable dimensions to reduce image transfer size.
Good signal. WebP or AVIF at appropriate dimensions
Review. Oversized or unnecessarily heavy images
Signals related to phone layouts and assistive technology.
width=device-width, initial-scale=1Tells mobile browsers how to size and scale the page.
Good signal. A responsive viewport configuration
Review. A missing or unsuitable viewport
90% of imagesDescriptive text available to people who cannot see meaningful images.
Good signal. Useful alt text for meaningful images
Review. Missing descriptions for meaningful images
4.5:1The measured difference between foreground text and its background.
Good signal. At least 4.5:1 for normal text
Review. Contrast below the relevant accessibility threshold
44px minimum control sizeControls large and separated enough for accurate touch input.
Good signal. Comfortable target sizes and spacing
Review. Small or tightly packed controls
Some technologies are deliberately hidden, some sites restrict automated requests, and some features are simply absent. “Not detected” means the available evidence was insufficient.
No. Start with critical security or accessibility findings, then assess lower-priority recommendations against the site's purpose and constraints.
The site is fetched when an analysis runs. Some supporting information, including registration data, may be cached. The report shows when its data was fetched.
Speed is one search signal among many. Content, links, relevance, domain history, and other factors also affect search results.
How the summary, technical evidence, security score, and limited-data notices are presented.
Each complete analysis begins with a letter grade, a score out of 100, detected strengths, and the most relevant action items.
The detailed report includes infrastructure data and the evidence used for security, accessibility, mobile, and performance scores.
The security score is based on HTTP response headers that a public visitor can observe. It is not a penetration test.
85–100
Strong coverage
70–84
Good coverage
40–69
Partial coverage
0–39
Limited coverage
The Security figure in the overall score is measured separately, as a points checklist: HTTPS 30, Content Security Policy 25, HSTS 15, clickjacking protection 12, MIME-sniffing protection 10 and Referrer-Policy 8, out of 100. Partial credit applies where a header exists but is weak, such as an HSTS max-age under a year or a policy allowing unsafe-inline.
Sites behind services such as Cloudflare, Akamai, Fastly, or AWS CloudFront may not expose every technical detail to an external request. In those cases, the report uses the evidence it can verify and labels the score “Based on available data.”
It is based on publicly available HTML, response headers, DNS information, and visible page content. Sites may hide some technical details, so the report distinguishes confirmed evidence from unavailable data.
The grade represents a weighted score: Security 25%, Performance 25%, SEO 20%, Best Practices 15%, and Accessibility 15%. A is 90 or above, B+ is 80–89, B is 70–79, C+ is 60–69, C is 50–59, and D is below 50.
A CDN or web application firewall may prevent an external request from seeing some headers or content. The report scores the evidence it can inspect and does not guess at hidden details.
Security, performance, and SEO findings are ordered by severity from Critical to Low. Security appears first when two findings have the same priority.
Yes. You can use the report to review publicly visible strengths, action items, technology, and infrastructure, or to compare the same signals across sites.
Large sites, slow responses, sitemap discovery, registration lookup, and protective networks can increase analysis time. Individual checks use time limits so a slow source does not hold the report indefinitely.
Review the security action items in priority order. The report identifies missing HTTP headers and links each score to the evidence found, but it is not a penetration test.
The analyzer only examines information available to an ordinary public visitor. It does not log in, bypass access controls, or probe non-public systems.
The summary only includes strengths supported by the analysis. It does not add filler when fewer clear strengths are detected.
Category scores describe individual areas. The overall score combines them using the published weights, so a lower score in Security or Performance has more effect than a lower score in a 15% category.
If a term is unclear, a result appears incorrect, or you have a suggestion for the analyzer, send us a note.
Contact Website Analyzer