Public signal scan / automated
Run the free automated check below for an immediate snapshot of the public signals your website is giving out.
It checks availability and HTTPS, selected security headers, search and page setup, domain and email DNS, and basic technical response information. It works with WordPress and other websites, and does not need WordPress admin access. Enter the website address in the checker below to run it.
Scan console / enter a website
Public signals only
Enter a website address to run a quick public check of availability, HTTPS, security headers, search setup, domain email DNS and technical signals.
Free / automated
Public website snapshot
Immediate evidence from signals the checker can reach without access to WordPress.
Paid / human reviewed
WordPress Launch Check
A human-reviewed launch-readiness decision for a WordPress site approaching launch.
Scan scope / five categories
What the free website check tests
The checker uses five categories to organise a weighted snapshot of public website signals:
01 / Connect
Availability & HTTPS
It checks whether the website is reachable, whether the final page uses HTTPS, the public TLS certificate’s health and expiry, HTTP-to-HTTPS behaviour, and www/apex consistency where both hostnames apply. A missing www host is not treated as a fault by itself.
02 / Protect
Security
It reviews selected security headers, clickjacking and Content-Security-Policy protections, and obvious mixed-content references. Where WordPress is visible from the page itself, the report may show public platform or plugin signals. The standard scan does not attempt login, user enumeration, WordPress endpoint exposure checks or vulnerability probing.
03 / Read
Search & Page Setup
It looks for accidental noindex instructions, a page title and meta description, canonical URL, document language, a main heading (H1), mobile viewport, robots.txt and sitemap discovery. A sitemap can help discovery, but its absence does not prevent a website from being indexed.
04 / Resolve
Domain & Email
It checks public MX, SPF and DMARC records and reports domain-registration expiry when the relevant registry makes usable RDAP data available. Some registries redact or do not provide expiry information, so an unavailable result is not scored as a failure.
05 / Observe
Technical Information
It reports one origin response time, response compression, decoded HTML size, cache/header information and useful public technology signals. These are server-to-server and source-level observations, not Core Web Vitals or a full browser performance test.
Possible CMS and visible plugin asset-path signals are informational. They are not automatically faults or evidence of a vulnerability, and they do not reduce the score.
Interpretation / evidence
What the health-check score means
The score is a weighted snapshot across Availability & HTTPS, Security, Search & Page Setup, Domain & Email, and Technical Information. It reflects only evidence available to this checker at that moment; unavailable and information-only observations are excluded.
It is not a Google ranking score or a security certification. Informational CMS and plugin signals do not count against it. A lower score is a prompt to investigate the individual results, not proof that the whole website is broken.
Boundary / not visible to a public scan
What this check can’t see
A public scan is useful, but it cannot see inside WordPress or prove that every part of a website works. It cannot fully determine:
- WordPress admin or Site Health information.
- Whether WordPress, plugins and themes are up to date.
- Database health or malware status.
- Whether usable backups exist.
- Whether enquiry and contact forms successfully deliver submissions.
- Browser performance or Core Web Vitals.
- Full accessibility compliance.
- The website’s complete security posture.
Those questions need more focused testing, access to the website, or a fuller audit. The free check is an automated public snapshot, not the paid, human-reviewed launch-readiness decision provided by the WordPress Launch Check. It does not attempt login, user enumeration or deeper WordPress endpoint and vulnerability probing.
Questions / scan detail
Website health check FAQs
Is the website health check really free?
Yes. The Website Health Check is completely free to run. Your results appear immediately, and you do not need to enter an email address.
Do you need access to my WordPress admin?
No. The checker uses the public page and other basic public website signals without a WordPress login. It does not try to log in or enumerate users.
What does the health-check score mean?
It is a weighted snapshot of the public evidence available across the five report categories at that moment. It is not a Google ranking score or a security certification.
Is this a full security audit?
No. It checks HTTPS and selected public security headers, but it cannot confirm malware status, internal WordPress security or the website’s complete security posture.
Does the check test website speed?
It measures one origin response time from this server. That can flag a slow response, but it is not a full browser speed test and does not measure images, scripts or the visitor’s experience.
Does it test Core Web Vitals?
No. Core Web Vitals need browser-based measurements. The origin response time shown here is a different, narrower signal.
Can it tell whether my contact forms are working?
No. A public page request cannot prove that a form submits, stores the right details or delivers its notification successfully.
Can I check a site that is not built with WordPress?
Yes. The public checks apply to websites generally. WordPress-specific observations are passive information from relevant signals already visible in the page.
Why does the checker show visible plugins or CMS signals?
Public page source can contain CMS or plugin asset paths. The checker reports those signals as information only; visibility does not automatically mean there is a fault or vulnerability.
Do I need to provide my email address?
No. You can run the Website Health Check and see your results without providing an email address.
What should I do after the check?
Read the individual results first. If your WordPress site is approaching launch and you need a human-reviewed readiness decision, use the WordPress Launch Check. For a one-off fault, use WordPress Support; for ongoing help, consider Hosting & Care; or get in touch if you are unsure.