Does your website pass its MOT?

A quick, plain-English health check for small-business websites: is it up, is it encrypted, is it running software with known holes, and can scammers send email pretending to be you?

What the test checks

Up to 31 checks across seven areas. The certificate counts the checks supported by the page and connection we observe.

Reachability: The site loads, and loads fast enough that people stay.; Up to 2 checks
Encryption: HTTPS is on, plain http redirects to it, the certificate isn't about to expire, and nothing loads insecurely.; Up to 4 checks
Security headers: The standard browser protections against clickjacking, script injection and leaking visitors' browsing.; Up to 6 checks
Software age: Old versions of jQuery, Bootstrap, AngularJS or WordPress with published security flaws.; Up to 4 checks
Email protection: SPF and DMARC records, which stop scammers sending email as your business.; Up to 2 checks
Search and sharing: Page title, description, main heading, canonical address, noindex instructions, link previews, favicon and JSON-LD business details.; Up to 8 checks
Mobile and accessibility: Viewport, page language, image alt text, HTML size and scripts that delay the page appearing.; Up to 5 checks

* Maximum per area. Some checks depend on the page and connection.

How it works

From address to action plan.

Bring your website
Type your website address.
We take a look
We load the homepage, following any redirects, check that plain http redirects to https, and read the public DNS records.
Leave with a plan
You get a certificate with a fix for every problem. Download it as a PDF or share a link that runs a fresh check.

What a result looks like

This is a made-up example, not a test of yourshop.co.uk.

A clear verdict. The important fixes first. Something useful to send to whoever looks after your website.

See what goes into the test

Example website test certificate

yourshop.co.uk

Example only. No test has been run.

FAIL

Score: 54/100 · 3 checks in this example

Pass earns full weight, advisory half, fail none. Security, encryption and email carry more weight than search and sharing.

Fix these first

Fail: No SPF record
Add an SPF TXT record listing your email provider. Your provider's help pages give the exact line.
Advisory: Browsers aren't told to always use HTTPS
Ask your host to add a Strict-Transport-Security header.

1 thing to fix now, and 1 to keep an eye on.

Encryption

Pass
The site uses HTTPS
Pages are encrypted between your site and your visitors.

Security headers

Advisory
Browsers aren't told to always use HTTPS
A visitor's first request could use an unencrypted connection.
How to fix: Ask your host to add a Strict-Transport-Security header.

Email protection

Fail
No SPF record
Mail servers cannot check which servers may send email as your domain.
How to fix: Add an SPF TXT record listing your email provider. Your provider's help pages give the exact line.

Questions

A few things before you pull in.

How many checks do you run?

Up to 31. Some depend on HTTPS, visible software versions or the domain. Your certificate shows how many were reported. We read the fetched HTML and headers; we do not test the visual layout or fetch linked files.

Is it free?

Yes. You can run a check, download the PDF and share a link for free. Rate limits apply.

Will testing harm my website?

No. We load the homepage, following any redirects, check its plain-http redirect, and read public DNS records. We do not log in, probe hidden pages or scan ports.

Do you keep the address I test?

No. We do not save tested addresses or results. A share link contains the address and runs a fresh check when opened. Our host keeps short-lived server logs, which can include share links. Read the privacy page for details.

What should I do about a Fail?

Read the "How to fix" line below the problem. Send it to your host or whoever looks after your website if you need help. Run the check again after the fix. Results are guidance, not a guarantee.

Is this a penetration test?

No. It is a passive check of public information. It cannot find every security problem and does not replace a security audit.

Why is my email protection marked as the host's job?

On a free hosting address, such as yourshop.vercel.app or yourshop.github.io, only the host can add the email DNS records. There is nothing for you to fix on that address. If your email uses your own domain, test that domain too.

Test your site now

Find out what needs attention. Know what to fix first.

Test my site