Scan checks
Every check the site scanner runs, and how to fix the ones without a dedicated tool.
The site scanner runs 19 checks against a public site: homepage reachability, page title, meta description, mobile viewport, canonical URL, Open Graph tags, the OG image actually loading, Twitter/X card, image alt text, favicon, custom 404 page (with soft-404 detection), privacy policy, robots.txt, AI Content Signals, sitemap, llms.txt, structured data (JSON-LD), security.txt, and email spoofing protection.
Passes score 1, warnings score ½, and the score maps to a letter grade (95+ is an A+). Most failing checks link straight to the tool that generates the fix. The checks below don't need a generator — they need a small change in your own site, so here are the recipes.
Mobile viewport
Without a viewport meta tag, phones render your page at desktop width and
zoom out — text becomes unreadable and Google flags the page as not
mobile-friendly. The fix is one line in <head>:
<meta name="viewport" content="width=device-width, initial-scale=1" />That's the whole fix. Frameworks like Next.js and TanStack Start emit it by default; hand-rolled HTML and some older templates don't.
Image alt text
Every <img> needs an alt attribute: screen readers read it aloud, image
search indexes it, and it renders when the image fails to load.
<img src="/team.jpg" alt="The four-person founding team in the workshop" />
<img src="/divider.svg" alt="" />Describe what the image shows, not what it is ("Screenshot of the
dashboard with three open alerts", not "image1.png"). Purely decorative
images get an empty alt="" — that's valid and tells screen readers to
skip it. An <img> with no alt attribute at all is the only failure
mode.
Custom 404
Two things can go wrong with error pages:
Soft 404s — the server returns HTTP 200 for URLs that don't exist
(common with SPA catch-alls that serve index.html for everything). Search
engines index your error page under every mistyped URL and can't tell real
pages from dead ones. The status code must be 404.
Bare default pages — a correct 404 status but the server's stock
error page. A visitor who follows a stale link hits a dead end with no way
back. A good 404 page keeps your site's layout and links to the homepage
and your most useful pages.
Check yours: curl -sI https://yoursite.com/definitely-not-a-page | head -1
should say 404.
Privacy policy
Once a site collects anything — analytics, a contact form, server logs retained beyond delivery — most jurisdictions (GDPR, CCPA, and others) require a privacy policy that says what is collected and why. The scanner looks for a link containing "privacy" on your homepage; the footer is the conventional place. Keep it honest and specific — a page that plainly says "we run analytics with consent, form submissions go to X, nothing else leaves your browser" beats ten pages of boilerplate.
security.txt
RFC 9116 defines a small text
file at /.well-known/security.txt that tells security researchers where
to report a vulnerability — without it, reports go to your support inbox or
nowhere. Minimum viable file (both fields are required):
Contact: mailto:security@yoursite.com
Expires: 2027-09-01T00:00:00.000ZContact: can also be an https: URL. Set Expires up to a year out and
refresh it when it lapses. See ours
for a live example.