The Complete Website Health Check: 20 Things to Test in 2026
Most small business owners check their website by loading the homepage on their phone and thinking “looks fine.” That misses about 95 percent of what actually matters.
Your website has layers that visitors and search engines evaluate without you ever seeing the results. Security headers that protect against data theft. Compliance signals that regulators check. SEO elements that determine whether Google shows your business or your competitor. Performance metrics that affect whether visitors stay or leave.
Here are 20 things worth checking, in order of importance.
Security
1. HTTPS. Your site should load on https, not http. Check your browser address bar for the padlock icon. If it shows “Not Secure,” your site is unencrypted and visitors can see a warning.
2. Security headers. These are invisible instructions your server sends to browsers. They protect visitors from clickjacking, content injection, and data theft. Test yours free at securityheaders.com. You want at least a B grade; an A or A+ is ideal.
3. Mixed content. Even with HTTPS, if your site loads images, scripts, or stylesheets over plain HTTP, browsers may show security warnings. Check the browser console (right-click, Inspect, Console tab) for mixed content errors.
4. Server technology exposure. Does your site reveal what software it runs? Headers that say “Apache 2.4” or “PHP 8.1” tell attackers what vulnerabilities to target. A good security configuration hides this information.
Compliance
5. Privacy policy. Required by UK GDPR, CCPA, and most other privacy laws. Must include: what data you collect, why, who you share it with, how long you keep it, and how people can exercise their rights. Link it from every page.
6. Cookie consent. If you use Google Analytics, Facebook Pixel, or any third-party tracking, you must get consent before those tools load. Not after. A banner that asks permission while trackers are already running does not count.
7. Terms of service. Not legally required everywhere, but protects your business if disputes arise. Should cover what your service does, payment terms, liability limitations, and governing law.
8. Contact information. Businesses in many jurisdictions must display contact details. Beyond the legal requirement, 44 percent of visitors leave a site if they cannot find contact information.
SEO
9. Page title. The text that appears in the browser tab and in Google search results. Should be under 60 characters and describe what the page is about. Your homepage title should include your business name and what you do.
10. Meta description. The text that appears under your title in Google results. If you do not set one, Google generates its own — usually badly. Keep it under 155 characters.
11. H1 heading. Every page should have exactly one H1 heading that describes what the page is about. Multiple H1 tags or missing H1 tags confuse search engines.
12. Image alt text. Every image should have alt text describing what it shows. This helps search engines understand your images and is essential for visitors using screen readers.
13. Structured data. Schema markup tells Google exactly what your business is, where it is, and what it does. Without it, you are a plain blue link. With it, you can appear in rich results with ratings and business details.
14. Open Graph image. When someone shares your link on LinkedIn, Facebook, or X, this is the image that appears. Without one, the shared link looks unprofessional or shows a random image from your page.
Performance
15. Page load time. Aim for under 3 seconds. Every additional second costs approximately 7 percent of conversions. Test at gtmetrix.com or pagespeed.web.dev.
16. Mobile responsiveness. Google indexes the mobile version of your site first. If your site is difficult to use on a phone, you lose both visitors and search rankings.
17. Render-blocking resources. CSS and JavaScript files that prevent the page from displaying until they have loaded. Moving them to load asynchronously can dramatically improve how fast your page appears.
Trust signals
18. Social media links. Do your social profiles exist and are they linked from your site? Visitors check these to verify you are a real business.
19. Favicon. The small icon in the browser tab. Missing favicons look unprofessional and make your site harder to find among open tabs.
20. Consistent branding. Same logo, same colours, same tone across every page. Inconsistency signals a site that is not maintained or trustworthy.
Checking all 20 of these manually takes about an hour. Or you can do it in 30 seconds.
Want to check your website? LaunchKitty scans your site across 14 dimensions in 30 seconds. Free scan, no signup needed. Scan your website now.