epiruspost.gr
News / Publisher site, served through Cloudflare, with email running through custom-or-self-hosted.
Email health73Excellent
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
DMARC aggregate reporting enabled (rua=)
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
Lead magnet / signup incentive detected (free download, ebook, etc.)
We didn't find a lead magnet on your homepage — no free download, sample, or signup incentive. Visitors who aren't ready to buy have nothing to take with them.
Email provider class (Workspace / 365 / Zoho / self-hosted / shared)
We couldn't confidently identify which service is hosting your email.
DMARC is enforcing — spoofed mail from your domain gets quarantined or rejected.
SPF is set and lists your sending services as approved senders.
Branded domain email address (vs free Gmail/Yahoo)
You send email from your own domain, not a free Gmail/Yahoo address.
Free-email exposure on contact page (gmail/yahoo/outlook visible)
Your published contact address is on your own domain, not a free inbox.
SPF lookup count (10-limit deliverability check)
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
Mailto: direct contact link present
Your site exposes a mailto: link visitors can tap to start a message.
Email forwarding service detected (improvmx, forwardemail, etc.)
Mail to this domain is being forwarded — you have working email reachability.
4 additional standards didn't apply to this category
SEO74Excellent
Title, meta description, OG, Twitter cards, canonical
Your homepage is missing one or more of the standard social-share and search-preview tags.
No breadcrumb schema is published. Search engines can't show breadcrumb trails under your listings, and visitors lose the trail to important pages.
FAQ / HowTo schema (where applicable)
No FAQ or HowTo schema found. If your pages answer common questions, marking them up gets you rich-result panels in search.
Schema.org structured data presence
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Schema.org type validity (parsed JSON-LD)
Your structured-data tags parse cleanly against Schema.org.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
3 additional standards didn't apply to this category
Brand presence74Excellent
Wayback Machine site age & last snapshot
Your site has been online for years — public archives have a long history of it.
14 additional standards didn't apply to this category
Security77Excellent
Your site isn't sending any of the standard browser-protection headers.
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Certificate validity-period brevity
Your certificate lifetime is on the longer end (> 90 days). ACME-class certs renew every 60-90 days and rotate cleanly.
WordPress REST API user enumeration exposure
Your WordPress site exposes its user list through the REST API. Attackers can enumerate every account by username — the first half of any credential-stuffing attack is already done for them.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
Some common admin or developer paths are reachable from the public internet.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
Modern cipher suite preference
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Certificate key strength and signature algorithm
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your server staples a fresh OCSP response — visitors don't have to round-trip to the CA on first connect.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your TLS handshake completes quickly — under 300ms on a cold connection.
3 additional standards didn't apply to this category
Accessibility79Excellent
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
Text on your homepage doesn't meet WCAG AA contrast minimums against its background. Visitors with low vision can't read parts of the page.
Your accessibility statement page is published — visitors can find out what standards you commit to.
Every image on your homepage has alt text — screen readers can describe them.
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
1 additional standard didn't apply to this category
Privacy82Excellent
Cookie banner presence + CMP detection
No cookie banner detected, but trackers are present. If you serve EU or California traffic, this is a compliance gap.
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
Cookie scan — actual cookies set on first load
Your homepage sets only essential cookies before consent. Non-essential cookies fire after opt-in.
1 additional standard didn't apply to this category
AI-readiness89Excellent
AI plugin manifest (.well-known/ai-plugin.json)
Your AI plugin manifest is published — AI assistants can integrate with your service.
JSON-LD richness score for LLMs
Your homepage exposes organization details AI tools can pull from.
Performance94Excellent
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage is mid-pack on mobile. Reasonable but Google's ranking signal rewards faster sites.
Image optimization (WebP/AVIF)
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Lazy loading on below-fold images
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
Font loading strategy (FOUT/FOIT/swap)
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
5 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
15 additional standards planned, scorer not yet implemented.
Does this look like a real business?68Excellent
A contact form people can actually find
We couldn't find a visible contact form on your homepage.
Whether anyone's written about you lately
No news mentions of this domain in the last 30 days.
How long your site has been online
Your site has been online for years — public archives have a long history of it.
8 additional standards didn't apply to this site
Is email from this domain trustworthy?74Excellent
Keeps your email private in transit
No MTA-STS or TLS-RPT policy is published — incoming mail could be downgraded to plaintext.
You get reports when someone fakes your email
No DMARC aggregate-reporting address is published — you wouldn't see spoofing attempts.
What's actually running your email
We couldn't confidently identify which service is hosting your email.
Stops scammers from emailing customers as you
DMARC is enforcing — spoofed mail from your domain gets quarantined or rejected.
Lists who's allowed to email as your business
SPF is set and lists your sending services as approved senders.
You email from your own domain, not Gmail
You send email from your own domain, not a free Gmail/Yahoo address.
Your email setup is under a hidden limit
Your SPF record uses fewer than 10 DNS lookups — under the spec limit.
A clickable email link on your site
Your site exposes a mailto: link visitors can tap to start a message.
Your email is being forwarded, not hosted
Mail to this domain is being forwarded — you have working email reachability.
3 additional standards didn't apply to this site
Is it safe to visit?77Excellent
Browser-level protections for visitors
Your site isn't sending any of the standard browser-protection headers.
Only your approved vendors can issue your padlock
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your padlock renews on a healthy schedule
Your certificate lifetime is on the longer end (> 90 days). ACME-class certs renew every 60-90 days and rotate cleanly.
WordPress isn't leaking your usernames
Your WordPress site exposes its user list through the REST API. Attackers can enumerate every account by username — the first half of any credential-stuffing attack is already done for them.
Private files aren't open to the public
Some common admin or developer paths are reachable from the public internet.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
Old TLS versions are turned off
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
The padlock uses strong, modern math
The handshake negotiates a modern AEAD cipher (AES-GCM or ChaCha20-Poly1305).
Old recordings stay locked even if a key leaks
Forward secrecy is guaranteed by the negotiated handshake — past traffic stays unreadable even if your key leaks.
Your padlock isn't using outdated keys
Your certificate uses strong modern math (ECDSA P-256+ or RSA-2048+ with SHA-256+).
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Visitors connect faster on the first click
Your server staples a fresh OCSP response — visitors don't have to round-trip to the CA on first connect.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your site finishes its handshake quickly
Your TLS handshake completes quickly — under 300ms on a cold connection.
3 additional standards didn't apply to this site
Can people find this site?79Excellent
How your site appears when shared or in search results
Your homepage is missing one or more of the standard social-share and search-preview tags.
A trail showing where visitors are on your site
No breadcrumb schema is published. Search engines can't show breadcrumb trails under your listings, and visitors lose the trail to important pages.
Common questions answered in a Google-friendly way
No FAQ or HowTo schema found. If your pages answer common questions, marking them up gets you rich-result panels in search.
Whether you're letting AI assistants read your site
You aren't blocking any AI crawlers in your robots.txt.
Hidden labels that explain your business to Google
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
A clear headline on every page
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Whether your behind-the-scenes labels are valid
Your structured-data tags parse cleanly against Schema.org.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
A direct line for AI assistants to your business
Your AI plugin manifest is published — AI assistants can integrate with your service.
How well your site feeds AI the right facts
Your homepage exposes organization details AI tools can pull from.
3 additional standards didn't apply to this site
Can everyone use it?79Excellent
No skip-to-content link is published. Keyboard users have to tab through every nav item on every page before reaching the content.
Text on your homepage doesn't meet WCAG AA contrast minimums against its background. Visitors with low vision can't read parts of the page.
You have an accessibility statement
Your accessibility statement page is published — visitors can find out what standards you commit to.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Your headings are in a sensible order
Your heading levels are properly nested — H1, then H2s, then H3s — and screen readers can navigate the outline.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
1 additional standard didn't apply to this site
Does it respect visitor privacy?82Excellent
Cookie consent banner for European visitors
No cookie banner detected, but trackers are present. If you serve EU or California traffic, this is a compliance gap.
How many outside companies you let watch your visitors
Your homepage loads a reasonable number of third-party services — clean privacy footprint.
You have a terms of service page
Your terms of service page is reachable from the homepage.
What your site actually drops on visitors' phones
Your homepage sets only essential cookies before consent. Non-essential cookies fire after opt-in.
1 additional standard didn't apply to this site
Is it fast?94Excellent
How fast your site loads on a phone
Your homepage is mid-pack on mobile. Reasonable but Google's ranking signal rewards faster sites.
Your photos are saved in modern formats
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Photos lower on the page wait their turn
Below-fold images use loading="lazy" — they download only when the visitor scrolls toward them.
Your text shows up while fonts load
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
5 additional standards didn't apply to this site