brittek.net
Corporate / B2B site, served through Cloudflare, with email running through custom-or-self-hosted.
Accessibility
⚠ Held back by a critical issue
69Fair
Text on your homepage doesn't meet WCAG AA contrast minimums against its background. Visitors with low vision can't read parts of the page.
axe-core / WAVE accessibility scan
Your homepage passes automated accessibility checks — no obvious blockers for screen readers or keyboard users.
Every image on your homepage has alt text — screen readers can describe them.
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
A skip-to-content link is published — keyboard users land directly on the main content.
1 additional standard didn't apply to this category
Email health75Strong
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
Branded domain email address (vs free Gmail/Yahoo)
You send email from your own domain, not a free Gmail/Yahoo address.
DMARC aggregate reporting enabled (rua=)
You're set up to receive daily DMARC reports of spoofing attempts.
SPF lookup count (10-limit deliverability check)
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
Mailto: direct contact link present
Your site exposes a mailto: link visitors can tap to start a message.
3 additional standards didn't apply to this category
Privacy86Excellent
Terms of service page presence
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
3 additional standards didn't apply to this category
Performance90Excellent
Image optimization (WebP/AVIF)
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage loads fast on mobile — the metrics Google uses for ranking are in the green.
Your homepage loads fast on desktop — Google's ranking signal is in the green.
Lazy loading on below-fold images
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
Font loading strategy (FOUT/FOIT/swap)
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
Web App Manifest (manifest.json)
Your Web App Manifest is published — visitors can install your site as a home-screen app.
4 additional standards didn't apply to this category
Security94Excellent
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Your domain isn't on Chrome's HSTS preload list. The first visit from a new browser still has a brief window where an attacker could intercept it.
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Certificate validity-period brevity
Your certificate lifetime is on the longer end (> 90 days). ACME-class certs renew every 60-90 days and rotate cleanly.
Your site is sending the standard browser-protection headers.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
None of the common admin or developer paths are publicly reachable.
Modern cipher suite preference
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Certificate key strength and signature algorithm
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your TLS handshake completes quickly — under 300ms on a cold connection.
4 additional standards didn't apply to this category
SEO94Excellent
FAQ / HowTo schema (where applicable)
No FAQ or HowTo schema found. If your pages answer common questions, marking them up gets you rich-result panels in search.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
Schema.org structured data presence
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Schema.org type validity (parsed JSON-LD)
Your structured-data tags parse cleanly against Schema.org.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
3 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
8 additional standards planned, scorer not yet implemented.
Does it respect visitor privacy?77Strong
You have a terms of service page
No terms of service page found. Without one, you have no contractual basis for the relationship with your visitors.
How many outside companies you let watch your visitors
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
3 additional standards didn't apply to this site
Is it safe to visit?79Strong
Only your approved vendors can issue your padlock
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Your site is on the browser-baked-in safe list
Your domain isn't on Chrome's HSTS preload list. The first visit from a new browser still has a brief window where an attacker could intercept it.
Visitors connect faster on the first click
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your padlock renews on a healthy schedule
Your certificate lifetime is on the longer end (> 90 days). ACME-class certs renew every 60-90 days and rotate cleanly.
Browser-level protections for visitors
Your site is sending the standard browser-protection headers.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
Private files aren't open to the public
None of the common admin or developer paths are publicly reachable.
Your domain can't be quietly hijacked
DNSSEC is enabled — your DNS responses are cryptographically signed.
The padlock uses strong, modern math
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Old recordings stay locked even if a key leaks
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Your padlock isn't using outdated keys
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your site finishes its handshake quickly
Your TLS handshake completes quickly — under 300ms on a cold connection.
4 additional standards didn't apply to this site
Can everyone use it?83Strong
Text on your homepage doesn't meet WCAG AA contrast minimums against its background. Visitors with low vision can't read parts of the page.
Your site works for visitors with disabilities
Your homepage passes automated accessibility checks — no obvious blockers for screen readers or keyboard users.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Your headings are in a sensible order
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
A skip-to-content link is published — keyboard users land directly on the main content.
1 additional standard didn't apply to this site
Is email from this domain trustworthy?83Strong
Keeps your email private in transit
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
Stops scammers from emailing customers as you
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
Lists who's allowed to email as your business
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
You email from your own domain, not Gmail
You send email from your own domain, not a free Gmail/Yahoo address.
You get reports when someone fakes your email
You're set up to receive daily DMARC reports of spoofing attempts.
Your email setup is under a hidden limit
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
A contact form people can actually find
A visible contact form is reachable from your homepage.
A clickable email link on your site
Your site exposes a mailto: link visitors can tap to start a message.
3 additional standards didn't apply to this site
Can people find this site?90Excellent
Common questions answered in a Google-friendly way
No FAQ or HowTo schema found. If your pages answer common questions, marking them up gets you rich-result panels in search.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
Hidden labels that explain your business to Google
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
A clear headline on every page
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Whether your behind-the-scenes labels are valid
Your structured-data tags parse cleanly against Schema.org.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
3 additional standards didn't apply to this site
Is it fast?92Excellent
Your photos are saved in modern formats
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
How fast your site loads on a phone
Your homepage loads fast on mobile — the metrics Google uses for ranking are in the green.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
How fast your site loads on a laptop
Your homepage loads fast on desktop — Google's ranking signal is in the green.
Photos lower on the page wait their turn
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
Your text shows up while fonts load
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
Your site can be saved to a phone's home screen
Your Web App Manifest is published — visitors can install your site as a home-screen app.
4 additional standards didn't apply to this site
Does this look like a real business?——
Site signals
Context we detected about this site — presence, reputation, and the tools it runs. These are informational and don't affect the score, up or down.