LetMeCheck.ai
    Start free
    Scanning › What we check

    What we check

    Every test in a free website check, explained in plain English.

    ON THIS PAGE

    A website check runs a set of tests against your live site and gives each one a result: passed, warning, failed, or not checked. This page explains what each test looks for and why it matters.

    The free website check#

    These 10 tests run on every free check. No account needed.

    Check
    What we look at
    Why it matters
    HTTPS and SSL
    Whether your site uses HTTPS with a valid certificate
    Without it, logins and forms can be read in transit
    Exposed secret keys
    Keys and tokens in the code your site sends to the browser
    Anyone can copy them and use your accounts
    Security headers
    Browser protections your site should switch on
    They block whole groups of attacks
    Source code exposed
    Source map files that hand your original code to anyone
    They make your app easier to attack
    Can Google see your content
    Whether your text is in the page or only appears after scripts run
    If Google can't read it, it can't rank it
    Title, description and social preview
    What shows in search results and when someone shares a link
    It decides whether people click
    Builder leftovers
    Default titles, icons and text left by the tool that built your site
    It makes a real site look unfinished
    AI crawlers allowed
    Whether AI tools such as ChatGPT can read your site
    It decides if you can show up in AI answers
    Mobile speed
    How fast the page loads on a phone
    Slow pages lose visitors
    Real 404 pages
    Whether a missing page says "not found"
    Fake pages confuse search engines

    Extra checks in your account#

    With an account, you can complete a report with more tests.

    Security#

    • Extra security headers: Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy
    • Cookie safety: whether cookies are marked Secure, HttpOnly and SameSite
    • Open CORS: whether any website can call your API
    • Mixed content: http:// files loaded on an https:// page
    • Outdated libraries: old front-end libraries with known holes
    • Server version leak: server software versions that are shown to visitors
    • Database platform: a reminder to check who can read and write your data
    • Email spoofing: SPF and DMARC records, which stop others sending email as you
    • security.txt: a file that tells researchers how to contact you

    SEO#

    • Title and description, social preview, heading structure
    • Whether pages can be indexed, canonical links and your sitemap
    • Whether the www and non-www versions of your address agree

    Performance#

    • Server response time, page weight and image size
    • Whether the page is ready for mobile
    • Accessibility basics

    AI visibility#

    • Whether your page can be read without JavaScript
    • An llms.txt file, Organization structured data
    • A clear introduction and answers to common questions on the page

    Full checks#

    Full checks read the code in a GitHub repository you connect. They look for exposed keys, open database rules, risky packages and similar problems that don't show on your live site. See Quick check vs full check.

    What the results mean#

    Result
    Meaning
    Passed
    We tested it and found no problem
    Warning
    A smaller problem, or something worth a look
    Failed
    A problem we confirmed
    Not checked
    We couldn't complete the test, so it doesn't count against you
    NOTE

    A test can be not checked if your site blocked us, timed out or the service we rely on was busy. Run the check again to try once more.

    Related#

    Last updated

    Need help?

    Stuck on something? Our team will help.

    Contact support →

    What's new?

    New checks, improvements and fixes.

    See the changelog →

    Was this page helpful?