SSL & HTTPS
Valid certificate, HTTPS enforced.
Enter your website and get a clear, honest report card: security, speed, SEO, email, accessibility and more. In plain English, with the fixes.
Valid certificate, HTTPS enforced.
Built to work on phones.
No DMARC: anyone can send mail as you.
Main content appears after 4.8 s.
Only 1 of 5 protections switched on.
No page for your top service.
You get a letter grade, what's broken, why it matters in plain English, and an offer of help if you want it. The same check also grades you as a business.
Browsers label sites without a valid certificate "Not secure", and many visitors leave on the spot.
Old encryption settings let attackers downgrade or eavesdrop on connections, card processors require modern TLS (PCI), and browsers block insecure content on secure pages..
An expired or unlocked domain takes your website and email down with it, and an abandoned subdomain can be claimed by a stranger to publish pages or phishing under your name..
Security headers are free, one-line instructions that tell browsers to block common attacks like clickjacking and injected scripts.
Tracking visitors before they agree is what privacy laws (GDPR, California's CCPA and others) actually fine, and a missing privacy policy gets ads rejected.
Without SPF, DKIM and DMARC, anyone can send email that looks like it came from you.
Being on a spam blacklist means your emails get blocked and filters may warn people away from your site.
More than half of mobile visitors give up on a page that takes over three seconds to load, and Google uses speed in its rankings.
About one in four US adults lives with a disability.
If search engines can't read your titles, descriptions and headings, you don't show up when locals search for what you do.
Most visits to small business sites come from phones.
Outdated software is the most common way small business sites get hacked.
Owners who scored well and chose to show it. Every result is private unless its owner makes it public, and we only ever list good news here.
whatsnotworking is owner-initiated only. It never crawls the web or checks sites nobody asked about. Each check reads your homepage and, at most, 20 of your own pages it links to, once, and every request it makes is listed on your report.
The site you typed: its homepage, its sitemap and up to 20 pages its menu links to. Never another website, never hidden pages.
A normal page view, your public DNS records, your SSL certificate. No logins, no forms submitted, no attacks.
Our requests say "WhatsNotWorkingBot", and a robots.txt rule naming it keeps us off your site.
Repeat checks of the same site within 15 minutes reuse the last result instead of hitting it again.