Plate IV. The inspection sheet, explained
What the Mendbird looks at on your site, why each one matters, and the question to ask if it fails. Nothing here needs a developer to understand.
34 checks9 areasEvery morning
The settings that keep visitors' connections private and stop other sites misusing yours.
At worst Major
The checkWe look at whether the site loads over https, the padlock in the address bar.
Why it mattersWithout it, browsers label the site Not secure, anything typed into a form can be read on the way, and Google ranks it lower. Certificates are free and renew themselves on almost every host.
Ask your developer“Can you add a free padlock certificate and send every visitor to the https address?”
At worst Minor
The checkWe visit the plain http address and see where it goes.
Why it mattersPeople still type addresses without https, and old links point there. If the site does not move them to the secure version, they browse without the padlock.
At worst Advisory
The checkWe look for a setting called Strict Transport Security in the site's replies.
Why it mattersIt tells browsers to only ever use the secure connection, even if someone clicks an old insecure link. It closes a small gap attackers on public wifi can use. It is one line of server settings.
At worst Advisory
The checkWe look for a content security policy in the site's replies.
Why it mattersIt lists where the site's scripts are allowed to come from. If someone manages to inject code into a page, the browser refuses to run it. It takes some care to set up, so it counts as good practice rather than urgent.
At worst Advisory
The checkWe look for a setting that stops other websites showing yours inside a frame.
Why it mattersWithout it, a scam site can show your page invisibly on top of its own and trick visitors into clicking buttons they cannot see. It is a small setting to add.
At worst Advisory
The checkWe look for a setting that tells browsers not to guess what kind of file they are getting.
Why it mattersBrowsers that guess can be tricked into running an uploaded file as a script. One line of settings switches the guessing off.
At worst Advisory
The checkWe read the site's replies and page for anything announcing exact software versions.
Why it mattersAnnouncing the exact version tells an attacker which known flaws to try first. Hiding it does not fix anything, but it stops the site advertising itself.
What your site is built with, checked against the public lists of known flaws every day.
At worst Dangerous
The checkWe work out what the site is built with and which versions, then check each one against the public lists of known flaws, updated daily.
Why it mattersMost hacked small business sites are broken into through a known flaw in an old plugin or theme, often by automated tools that try every site. Updating to a fixed version closes it.
Ask your developer“Can you update everything with a known security flaw to the version that fixes it?”
At worst Major
The checkWe check whether each version we can see is still supported by the people who make it.
Why it mattersOnce support ends, any new flaw stays open for good. The site may work fine today, but it gets less safe every month until it is moved to a supported version.
Ask your developer“Can you move the site to versions that still get security fixes?”
How quickly the page arrives and settles, especially on a phone.
At worst Major
The checkWe time how long the server takes to start sending the home page.
Why it mattersThis is the wait before anything appears. Under a second feels quick. Slow answers usually mean busy hosting or no caching, and visitors on phones give up.
Ask your developer“Why does the server take so long to answer, and would caching or better hosting help?”
At worst Minor
The checkWe measure the page itself before any pictures, scripts or styles.
Why it mattersA heavy page takes longer on mobile data and uses up people's allowance. Large pages often carry leftovers from page builders that nobody needs.
At worst Minor
The checkWe count the script files the page asks for.
Why it mattersEvery script is something a phone must download and run before the page settles. Plugins add them quietly over the years, and many sites carry ones they no longer use.
At worst Minor
The checkWe count the other websites the page loads things from, such as fonts, widgets and trackers.
Why it mattersEach one is another connection to set up and another company that can slow the page down or go offline. Fewer is faster and more private.
At worst Minor
The checkWe check whether pictures have their size set in the page.
Why it mattersWithout a size, the page moves about as each picture arrives, so people tap the wrong thing. Google counts this jumpiness against the site.
Whether mail services can tell your real emails from fakes.
At worst Major
The checkWe look up your domain's SPF record, the list of services allowed to send email as your business.
Why it mattersWithout it, your emails are more likely to land in spam, and anyone can pretend to be you more easily. If it ends in a setting that allows everyone, it protects nothing.
Ask your developer“Can you add an SPF record listing the services that send our email?”
At worst Minor
The checkWe look up your domain's DMARC record.
Why it mattersIt tells mail services like Gmail and Outlook what to do with email that pretends to come from you. Gmail and Yahoo now expect it from businesses that send email.
Ask your developer“Can you add a DMARC record, starting with p=none so nothing gets lost?”
For your information
The checkWe check whether your domain receives email at all.
Why it mattersIf it does not, there is nothing to set up here. Sending your email from another address is fine.
Your domain name: who holds it, when it runs out, and whether it still points at your site.
At worst Dangerous
The checkWe read the domain's registration to see when it is paid up until.
Why it mattersIf a domain lapses, the site and every email address on it stop working, and someone else can buy it. Most lapses happen because a renewal card expired. Check it is set to renew.
Ask your developer“Is our domain set to renew automatically, and is the card on file up to date?”
At worst Dangerous
The checkWe look up the public logs of padlock certificates to see when the newest one for your address runs out, and who issued it.
Why it mattersPadlocks usually renew themselves a few weeks before they run out. If the renewal fails, browsers show visitors a full page warning instead of your site. We warn you two weeks ahead, while there is still time.
Ask your developer“Our padlock certificate runs out soon and has not renewed by itself. Can you renew it now and find out why it did not renew?”
At worst Advisory
The checkWe check the domain's registration for a lock against being moved to another company.
Why it mattersThe lock stops someone moving your domain away without your say so. Most companies switch it on for free. Domains ending in .uk work differently, so we do not check them for it.
For your information
The checkWe read which company the domain is registered through.
Why it mattersThat is where you log in to renew it, change its settings or move it. It is worth knowing, and worth making sure the login belongs to the business rather than a past developer.
At worst Advisory
The checkWe try to read the domain's public registration record.
Why it mattersSometimes the registry does not answer. It is worth checking your renewal date with whoever you pay for the domain.
At worst Dangerous
The checkWe look at whether the address shows a domain parking or for sale page.
Why it mattersVisitors see adverts instead of your business. The domain may have lapsed, or it is no longer pointed at the website.
Ask your developer“Is our domain still ours and paid up, and why is it not showing our website?”
Notes on the visit itself.
At worst Advisory
The checkWe note when the host shows us a robot check instead of the page.
Why it mattersReal visitors are not affected, but it means we could only check the domain and email this time, not the page itself.
Anything telling search engines to stay away.
At worst Major
The checkWe look for a noindex note on the home page.
Why it mattersA noindex note tells Google to drop the page from search results. It is often left behind by accident when a site goes live after being built.
Ask your developer“Why is our home page marked noindex, and can you remove it?”
At worst Major
The checkWe read the site's robots.txt file, which tells search engines where they may look.
Why it mattersIf it blocks everything, the whole site slowly disappears from Google. Like noindex, it is usually left over from building the site.
Ask your developer“Can you change robots.txt so search engines may visit the site?”
Whether everyone can use the site, on any screen, including people who cannot see it.
At worst Major
The checkWe look for the setting that tells phones to fit the page to the screen.
Why it mattersWithout it, phones show a tiny desktop version that people must pinch and zoom. Most visits to small business sites now come from phones.
Ask your developer“Can you make the site fit phone screens?”
At worst Minor
The checkWe check the page says what language it is in.
Why it mattersScreen readers use it to pick the right voice and pronunciation. Without it, English can be read out with the wrong accent or rules.
At worst Minor
The checkWe count pictures that have no description for people who cannot see them.
Why it mattersBlind visitors hear the description read aloud, and Google reads it too. Decorative pictures can have an empty description, which is fine.
At worst Minor
The checkWe count links that have no words, often icons such as social media logos.
Why it mattersA screen reader can only announce link, with no idea where it goes. A short hidden label fixes it.
At worst Minor
The checkWe count buttons with no words, such as a menu or search icon.
Why it mattersNobody using a screen reader knows what the button does. It is often the menu button, which locks them out of the whole site.
At worst Minor
The checkWe check every form box has a label that says what to type.
Why it mattersWithout labels, people who cannot see the form do not know what each box is for, so they cannot contact you or book.