Scan checks

Every check the site scanner runs, and how to fix the ones without a dedicated tool.

The site scanner runs 19 checks against a public site: homepage reachability, page title, meta description, mobile viewport, canonical URL, Open Graph tags, the OG image actually loading, Twitter/X card, image alt text, favicon, custom 404 page (with soft-404 detection), privacy policy, robots.txt, AI Content Signals, sitemap, llms.txt, structured data (JSON-LD), security.txt, and email spoofing protection.

Passes score 1, warnings score ½, and the score maps to a letter grade (95+ is an A+). Most failing checks link straight to the tool that generates the fix. The checks below don't need a generator — they need a small change in your own site, so here are the recipes.

Mobile viewport

Without a viewport meta tag, phones render your page at desktop width and zoom out — text becomes unreadable and Google flags the page as not mobile-friendly. The fix is one line in <head>:

<meta name="viewport" content="width=device-width, initial-scale=1" />

That's the whole fix. Frameworks like Next.js and TanStack Start emit it by default; hand-rolled HTML and some older templates don't.

Image alt text

Every <img> needs an alt attribute: screen readers read it aloud, image search indexes it, and it renders when the image fails to load.

<img src="/team.jpg" alt="The four-person founding team in the workshop" />
<img src="/divider.svg" alt="" />

Describe what the image shows, not what it is ("Screenshot of the dashboard with three open alerts", not "image1.png"). Purely decorative images get an empty alt="" — that's valid and tells screen readers to skip it. An <img> with no alt attribute at all is the only failure mode.

Custom 404

Two things can go wrong with error pages:

Soft 404s — the server returns HTTP 200 for URLs that don't exist (common with SPA catch-alls that serve index.html for everything). Search engines index your error page under every mistyped URL and can't tell real pages from dead ones. The status code must be 404.

Bare default pages — a correct 404 status but the server's stock error page. A visitor who follows a stale link hits a dead end with no way back. A good 404 page keeps your site's layout and links to the homepage and your most useful pages.

Check yours: curl -sI https://yoursite.com/definitely-not-a-page | head -1 should say 404.

Privacy policy

Once a site collects anything — analytics, a contact form, server logs retained beyond delivery — most jurisdictions (GDPR, CCPA, and others) require a privacy policy that says what is collected and why. The scanner looks for a link containing "privacy" on your homepage; the footer is the conventional place. Keep it honest and specific — a page that plainly says "we run analytics with consent, form submissions go to X, nothing else leaves your browser" beats ten pages of boilerplate.

security.txt

RFC 9116 defines a small text file at /.well-known/security.txt that tells security researchers where to report a vulnerability — without it, reports go to your support inbox or nowhere. Minimum viable file (both fields are required):

Contact: mailto:security@yoursite.com
Expires: 2027-09-01T00:00:00.000Z

Contact: can also be an https: URL. Set Expires up to a year out and refresh it when it lapses. See ours for a live example.