beyoustyles.com
E-commerce site based in United States, served through cloudflare, with email running through custom-or-self-hosted.
Email health56Solid
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
DMARC aggregate reporting enabled (rua=)
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
Free-email exposure on contact page (gmail/yahoo/outlook visible)
You're showing a free Gmail / Yahoo / Outlook address on your site. Visitors can't tell whether the inbox really belongs to you, and search engines treat the listing as less trustworthy.
Lead magnet / signup incentive detected (free download, ebook, etc.)
We didn't find a lead magnet on your homepage — no free download, sample, or signup incentive. Visitors who aren't ready to buy have nothing to take with them.
Mailto: direct contact link present
We couldn't find a tap-to-email link anywhere on your site.
Email provider class (Workspace / 365 / Zoho / self-hosted / shared)
We couldn't confidently identify which service is hosting your email.
SPF is set and lists your sending services as approved senders.
Branded domain email address (vs free Gmail/Yahoo)
You send email from your own domain, not a free Gmail/Yahoo address.
SPF lookup count (10-limit deliverability check)
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
Email forwarding service detected (improvmx, forwardemail, etc.)
Mail to this domain is being forwarded — you have working email reachability.
4 additional standards didn't apply to this category
Privacy60Solid
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
CCPA "Do Not Sell or Share My Personal Information" link
No CCPA "Do Not Sell or Share My Personal Information" link found. If you have California visitors and sell or share data, this is required.
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
2 additional standards didn't apply to this category
AI-readiness68Excellent
JSON-LD richness score for LLMs
We couldn't find any organization details in your page's structured data.
1 additional standard didn't apply to this category
Security73Excellent
Your site isn't sending any of the standard browser-protection headers.
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Certificate key strength and signature algorithm
Your certificate uses outdated key strength or a SHA-1 signature. Reissue with a modern ACME-class cert.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
WordPress REST API user enumeration exposure
Your WordPress REST API doesn't leak usernames — attackers can't list accounts without already being authenticated.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
None of the common admin or developer paths are publicly reachable.
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Certificate validity-period brevity
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your TLS handshake completes quickly — under 300ms on a cold connection.
5 additional standards didn't apply to this category
Performance76Excellent
Your server still serves over the older HTTP/2 protocol — not the newer, faster HTTP/3.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Lazy loading on below-fold images
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
Image optimization (WebP/AVIF)
Your images use modern formats (WebP / AVIF) — visitors download a fraction of the bytes.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage loads fast on mobile — the metrics Google uses for ranking are in the green.
7 additional standards didn't apply to this category
Brand presence81Excellent
We couldn't find a Trustpilot listing. Many consumers check Trustpilot before buying — a missing listing reads as a missing reputation.
Instagram presence (link from site → IG profile)
Your Instagram profile is linked from your site.
12 additional standards didn't apply to this category
Accessibility86Excellent
Your heading levels skip — for example, an H1 followed by an H3 with no H2 in between. Screen reader users lose the outline of the page.
Every image on your homepage has alt text — screen readers can describe them.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
A skip-to-content link is published — keyboard users land directly on the main content.
2 additional standards didn't apply to this category
SEO87Excellent
Your homepage doesn't have a visible H1 heading. Without it, search engines and screen readers have no anchor for what the page is about.
Schema.org structured data presence
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
Schema.org type validity (parsed JSON-LD)
Your structured-data tags parse cleanly against Schema.org.
Your pages publish breadcrumb schema — search results show the path back to important sections.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
4 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
17 additional standards planned, scorer not yet implemented.
Does it respect visitor privacy?60Solid
You have a privacy policy page
No privacy policy page found. Required by GDPR, CCPA, and most app store listings.
California privacy opt-out link
No CCPA "Do Not Sell or Share My Personal Information" link found. If you have California visitors and sell or share data, this is required.
How many outside companies you let watch your visitors
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
You have a terms of service page
Your terms of service page is reachable from the homepage.
2 additional standards didn't apply to this site
Is email from this domain trustworthy?61Solid
Stops scammers from emailing customers as you
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
Keeps your email private in transit
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
You get reports when someone fakes your email
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
A clickable email link on your site
We couldn't find a tap-to-email link anywhere on your site.
What's actually running your email
We couldn't confidently identify which service is hosting your email.
Lists who's allowed to email as your business
SPF is set and lists your sending services as approved senders.
You email from your own domain, not Gmail
You send email from your own domain, not a free Gmail/Yahoo address.
Your email setup is under a hidden limit
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
Your email is being forwarded, not hosted
Mail to this domain is being forwarded — you have working email reachability.
3 additional standards didn't apply to this site
Does this look like a real business?68Excellent
We couldn't find a Trustpilot listing. Many consumers check Trustpilot before buying — a missing listing reads as a missing reputation.
Whether anyone's written about you lately
No news mentions of this domain in the last 30 days.
A contact form people can actually find
A visible contact form is reachable from your homepage.
8 additional standards didn't apply to this site
Is it safe to visit?73Excellent
Browser-level protections for visitors
Your site isn't sending any of the standard browser-protection headers.
Only your approved vendors can issue your padlock
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Visitors connect faster on the first click
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your padlock isn't using outdated keys
Your certificate uses outdated key strength or a SHA-1 signature. Reissue with a modern ACME-class cert.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
WordPress isn't leaking your usernames
Your WordPress REST API doesn't leak usernames — attackers can't list accounts without already being authenticated.
Private files aren't open to the public
None of the common admin or developer paths are publicly reachable.
Old TLS versions are turned off
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your padlock renews on a healthy schedule
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your site finishes its handshake quickly
Your TLS handshake completes quickly — under 300ms on a cold connection.
5 additional standards didn't apply to this site
Is it fast?76Excellent
Your site uses the newest connection style
Your server still serves over the older HTTP/2 protocol — not the newer, faster HTTP/3.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Photos lower on the page wait their turn
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
Your photos are saved in modern formats
Your images use modern formats (WebP / AVIF) — visitors download a fraction of the bytes.
How fast your site loads on a phone
Your homepage loads fast on mobile — the metrics Google uses for ranking are in the green.
7 additional standards didn't apply to this site
Can people find this site?82Excellent
A clear headline on every page
Your homepage doesn't have a visible H1 heading. Without it, search engines and screen readers have no anchor for what the page is about.
How well your site feeds AI the right facts
We couldn't find any organization details in your page's structured data.
Hidden labels that explain your business to Google
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
Whether you're letting AI assistants read your site
You aren't blocking any AI crawlers in your robots.txt.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
Whether your behind-the-scenes labels are valid
Your structured-data tags parse cleanly against Schema.org.
A trail showing where visitors are on your site
Your pages publish breadcrumb schema — search results show the path back to important sections.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
5 additional standards didn't apply to this site
Can everyone use it?86Excellent
Your headings are in a sensible order
Your heading levels skip — for example, an H1 followed by an H3 with no H2 in between. Screen reader users lose the outline of the page.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
A skip-to-content link is published — keyboard users land directly on the main content.
2 additional standards didn't apply to this site