The 25-point
site health checklist.

01Why publish a checklist at all

Because "we do a thorough audit" is a claim, and a checklist is something you can hold us to. Every item below produces a pass, a warn, a fail, or an honest "not applicable" — with evidence (a header, a record, a measurement), never a vibe.

02The free snapshot — checks 1 to 9

The public part. These are the checks the free site report automates for any URL, capped at a short list of top issues instead of a 40-finding dump:

#	Check	What it catches
1	HTTPS, valid certificate, HTTP→HTTPS redirect	Browser warnings, mixed trust signals
2	Homepage returns 200, no redirect loop	Visitors or crawlers hitting a wall
3	Title present and not generic	"Home" as your search result
4	Meta description present	Google writing your pitch for you
5	Exactly one clear H1	Muddled page structure
6	robots.txt reachable, not blocking everything	Self-inflicted invisibility
7	sitemap.xml referenced or discoverable	Crawlers guessing at your pages
8	Core Web Vitals summary (mobile LCP / INP / CLS)	The lag your visitors feel
9	Contact form or primary CTA reachable	A site that can't take an inquiry

03Presence and crawl — checks 10 to 14

10	Redirect chain (www/apex, trailing slash) is clean	Authority split across duplicate hosts
11	Canonical on home and key templates	Competing versions of the same page
12	Basic Open Graph (title, image)	Ugly or empty link previews
13	Favicon / apple-touch icons	The default-gray-tab look
14	Custom 404 page, not the server default	Dead ends that lose the visitor

04Security and trust, public surface — checks 15 to 19

Only what is visible from the outside, described as observed — no legal expectations, no forensic claims:

15	Modern TLS, no obvious mixed content	Weakened encryption, browser warnings
16	Security headers observed (CSP/HSTS where applicable)	Missing baseline hardening
17	WordPress fingerprint: generator meta, typical paths exposed	Advertising your stack to scanners
18	Obviously outdated plugins/themes — only with public evidence	Known-exploit surface
19	Forms submit over HTTPS with spam protection signs	Intercepted or flooded inquiries

05Email and DNS — checks 20 to 22

For domains that send business email. A missing enforcement policy is a warn, not a lecture:

20	SPF record present	Anyone spoofing your domain
21	DKIM selector visible, or honestly "unverified without full DNS"	Unsigned outbound mail
22	DMARC present (monitor-only counts as a warn)	No policy on spoofed mail

06Performance and UX risk — checks 23 to 25

23	Weight of the LCP candidate; images without dimensions	The slow largest paint
24	Grossly blocking third-party JS on the home page	Scripts that stall first paint
25	Detectably broken tracking (dead GA/GTM container, consent banner blocking the CTA) — only with evidence	Flying blind or blocking your own button

07The step that isn't a check

Before any report goes out, a human review runs through the same short list every time:

• Top issues prioritized by business impact, not by whatever score a tool emitted.
• No forensic or legal claims — ever — from a public-surface read.
• The proposed fix scope is a closed list: what we'll do, at what price, in what window. No open-ended "phase one."
• If monthly care makes sense after the fix, the care log template is attached so you can see exactly what gets watched.

That's the whole apparatus: 25 checks, evidence per line, one human pass before you see it. If you want the automated public subset run against your site, the free report does it in about two minutes.