theconnellyportsmouth.com
5-year-old local business site based in United States, served through cloudflare.
Email health41Needs work
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
Branded domain email address (vs free Gmail/Yahoo)
Your published contact email is on a free service, not your own domain.
Email forwarding service detected (improvmx, forwardemail, etc.)
We didn't detect any mail forwarding — your inbox provider is unclear.
Lead magnet / signup incentive detected (free download, ebook, etc.)
We didn't find a lead magnet on your homepage — no free download, sample, or signup incentive. Visitors who aren't ready to buy have nothing to take with them.
Free-email exposure on contact page (gmail/yahoo/outlook visible)
Your published contact address is on your own domain, not a free inbox.
Mailto: direct contact link present
Your site exposes a mailto: link visitors can tap to start a message.
9 additional standards didn't apply to this category
Performance69Excellent
Image optimization (WebP/AVIF)
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS)
Your homepage is slow on mobile. The data Google uses to rank pages says real visitors wait too long for it to feel ready.
Lazy loading on below-fold images
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Font loading strategy (FOUT/FOIT/swap)
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
5 additional standards didn't apply to this category
Brand presence69Excellent
Google Business Profile presence + rating
We couldn't find a Google Business Profile linked to this domain.
Yelp presence + rating + review count
We couldn't find a Yelp listing for this business. Local-business searches and recommendation engines lean on Yelp as a signal.
Apple Maps presence (Apple Business Connect)
We couldn't find an Apple Business Connect listing. Apple Maps visitors and Siri queries can't find you cleanly.
Your domain has been registered for years — long enough to clear fraud-detection signals.
9 additional standards didn't apply to this category
Security70Excellent
WordPress REST API user enumeration exposure
Your WordPress site exposes its user list through the REST API. Attackers can enumerate every account by username — the first half of any credential-stuffing attack is already done for them.
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Certificate key strength and signature algorithm
Your certificate uses outdated key strength or a SHA-1 signature. Reissue with a modern ACME-class cert.
Embedded SCT count (Certificate Transparency)
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Your site isn't sending any of the standard browser-protection headers.
SSL certificate validity & expiration window
Your SSL certificate is valid and not close to expiring.
Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php)
None of the common admin or developer paths are publicly reachable.
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
Certificate chain completeness
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Certificate validity-period brevity
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your TLS handshake completes quickly — under 300ms on a cold connection.
5 additional standards didn't apply to this category
Privacy85Excellent
Your homepage loads a high number of third-party trackers. Each one slows the page, leaks data, and increases your compliance surface.
CCPA "Do Not Sell or Share My Personal Information" link
Your CCPA "Do Not Sell or Share" link is published — California visitors can exercise their rights.
2 additional standards didn't apply to this category
AI-readiness89Excellent
JSON-LD richness score for LLMs
Your homepage exposes organization details AI tools can pull from.
1 additional standard didn't apply to this category
Accessibility90Excellent
Your heading levels skip — for example, an H1 followed by an H3 with no H2 in between. Screen reader users lose the outline of the page.
Every image on your homepage has alt text — screen readers can describe them.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
Your accessibility statement page is published — visitors can find out what standards you commit to.
ARIA labels presence and validity
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
A skip-to-content link is published — keyboard users land directly on the main content.
1 additional standard didn't apply to this category
SEO92Excellent
Better Business Bureau accreditation
We couldn't find a BBB accreditation for this business. Older / risk-averse customers still look for the BBB seal.
Title, meta description, OG, Twitter cards, canonical
Your homepage has the title, description, OG, Twitter, and canonical tags.
Schema.org structured data presence
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Schema.org type validity (parsed JSON-LD)
Your structured-data tags parse cleanly against Schema.org.
Your pages publish breadcrumb schema — search results show the path back to important sections.
FAQ / HowTo schema (where applicable)
Your pages publish FAQ / HowTo schema — eligible for rich-result panels in search.
Internal link depth (clicks from homepage to deepest content)
Important pages are reachable in just a click or two from your homepage.
2 additional standards didn't apply to this category
View formal standards verdicts → Composite-spec rollups for press, regulators, and compliance auditors.
14 additional standards planned, scorer not yet implemented.
Is email from this domain trustworthy?32Needs work
Stops scammers from emailing customers as you
You have DMARC set up, but in monitor-only mode — it's not actually rejecting spoofed mail.
Lists who's allowed to email as your business
No SPF record is published, so nothing tells mail providers who's allowed to send as you.
You email from your own domain, not Gmail
Your published contact email is on a free service, not your own domain.
Your email is being forwarded, not hosted
We didn't detect any mail forwarding — your inbox provider is unclear.
A clickable email link on your site
Your site exposes a mailto: link visitors can tap to start a message.
8 additional standards didn't apply to this site
Does this look like a real business?59Solid
Your listing on Google Maps and search
We couldn't find a Google Business Profile linked to this domain.
We couldn't find a Yelp listing for this business. Local-business searches and recommendation engines lean on Yelp as a signal.
We couldn't find an Apple Business Connect listing. Apple Maps visitors and Siri queries can't find you cleanly.
Whether anyone's written about you lately
No news mentions of this domain in the last 30 days.
How long your domain has existed
Your domain has been registered for years — long enough to clear fraud-detection signals.
A contact form people can actually find
A visible contact form is reachable from your homepage.
5 additional standards didn't apply to this site
Is it fast?69Excellent
Your photos are saved in modern formats
Your images are served as JPEG or PNG when modern formats (WebP, AVIF) would cut their size by 30–60% with no visible loss.
How fast your site loads on a phone
Your homepage is slow on mobile. The data Google uses to rank pages says real visitors wait too long for it to feel ready.
Photos lower on the page wait their turn
Images below the fold aren't lazy-loaded — visitors download them up front even if they never scroll that far.
Pages get squeezed before they're sent
Your server compresses pages with Brotli or gzip — visitors download a fraction of the raw size.
Your text shows up while fonts load
Your fonts swap in cleanly — text is readable in the system font while custom fonts download.
Your site uses a modern web connection
Your server speaks HTTP/2 — page loads multiplex over a single connection.
5 additional standards didn't apply to this site
Is it safe to visit?70Excellent
WordPress isn't leaking your usernames
Your WordPress site exposes its user list through the REST API. Attackers can enumerate every account by username — the first half of any credential-stuffing attack is already done for them.
Only your approved vendors can issue your padlock
There's no CAA record at your registrar saying which companies are allowed to issue certificates for you.
Visitors connect faster on the first click
Your server doesn't staple OCSP. Visitors' browsers may have to contact the CA themselves, slowing first connects.
Strict mode for your padlock check
Neither OCSP stapling nor Must-Staple is in play. A revoked cert wouldn't be caught quickly.
Your padlock isn't using outdated keys
Your certificate uses outdated key strength or a SHA-1 signature. Reissue with a modern ACME-class cert.
Your certificate is publicly logged
Your certificate carries only one embedded SCT — modern browsers want at least two. Reissue from a CA that includes them.
Browser-level protections for visitors
Your site isn't sending any of the standard browser-protection headers.
Your padlock isn't about to expire
Your SSL certificate is valid and not close to expiring.
Private files aren't open to the public
None of the common admin or developer paths are publicly reachable.
Old TLS versions are turned off
Only modern TLS (1.2 and above) is offered — TLS 1.0 and 1.1 are turned off.
Your padlock loads cleanly on every device
Your server sends the full certificate chain — every device builds the path to a trusted root cleanly.
Your padlock renews on a healthy schedule
Your certificate uses a short validity window (≤ 90 days) — auto-renewal keeps revocation fast and frictionless.
Your padlock comes from a reputable vendor
Your certificate is issued by a tier-1 publicly trusted CA (Let's Encrypt, DigiCert, Google Trust, Sectigo, etc.).
Your site finishes its handshake quickly
Your TLS handshake completes quickly — under 300ms on a cold connection.
5 additional standards didn't apply to this site
Does it respect visitor privacy?85Excellent
How many outside companies you let watch your visitors
Your homepage loads a high number of third-party trackers. Each one slows the page, leaks data, and increases your compliance surface.
You have a terms of service page
Your terms of service page is reachable from the homepage.
California privacy opt-out link
Your CCPA "Do Not Sell or Share" link is published — California visitors can exercise their rights.
2 additional standards didn't apply to this site
Can everyone use it?90Excellent
Your headings are in a sensible order
Your heading levels skip — for example, an H1 followed by an H3 with no H2 in between. Screen reader users lose the outline of the page.
Your photos have written descriptions
Every image on your homepage has alt text — screen readers can describe them.
Text on your homepage meets WCAG AA contrast minimums — readable by visitors with low vision.
You have an accessibility statement
Your accessibility statement page is published — visitors can find out what standards you commit to.
Your buttons and forms are labeled for screen readers
Interactive elements have proper ARIA labels — screen reader users get a clear description of each control.
A skip-to-content link is published — keyboard users land directly on the main content.
1 additional standard didn't apply to this site
Can people find this site?91Excellent
Whether you're listed with the Better Business Bureau
We couldn't find a BBB accreditation for this business. Older / risk-averse customers still look for the BBB seal.
Whether you're letting AI assistants read your site
You aren't blocking any AI crawlers in your robots.txt.
How well your site feeds AI the right facts
Your homepage exposes organization details AI tools can pull from.
How your site appears when shared or in search results
Your homepage has the title, description, OG, Twitter, and canonical tags.
Hidden labels that explain your business to Google
Your homepage publishes Schema.org structured data — search engines and AI tools can read what your site is directly.
A clear headline on every page
Your homepage has a clear H1 heading — search engines and screen readers know what the page is about.
Whether your behind-the-scenes labels are valid
Your structured-data tags parse cleanly against Schema.org.
A trail showing where visitors are on your site
Your pages publish breadcrumb schema — search results show the path back to important sections.
Common questions answered in a Google-friendly way
Your pages publish FAQ / HowTo schema — eligible for rich-result panels in search.
How easy it is to reach your deepest pages
Important pages are reachable in just a click or two from your homepage.
A summary file for AI assistants
Your /llms.txt file is published — AI assistants can read your summary.
3 additional standards didn't apply to this site