Home › Tools › Website Health Check

Web & SEO

Website health check

Put in a web address and get a scored report on its HTTPS, security, speed and search-engine basics, with a plain-English fix for anything that isn’t right.

Try digitalgreenhouse.com.au or example.com. A full address checks that page; a bare domain checks the home page.

The check runs from our server in Australia, because a browser can’t read another site’s headers, certificate or robots.txt. It loads the page (following its redirects), the plain http address, robots.txt and the sitemap, much as a search engine would. Our code doesn’t keep a record of what you check or who asked; a result is reused for 10 minutes so a repeat check doesn’t hit the site again.
Using an AI agent or a script? Call this tool as an API

AI agents and scripts can call this tool directly, to check their work or look something up, and get JSON back with the same answer this page gives. No key needed.

GET https://digitalgreenhouse.com.au/api/tools/website-health-check?url=digitalgreenhouse.com.au
  • url — string, required. Web address of the page to check. A bare domain checks its home page over HTTPS. Also accepted as u, domain, d.

The API answers from our server, and our code doesn’t store what you send. Fair-use limits apply. API guide · all endpoints (JSON) · OpenAPI

What the health check looks at

  • HTTPS and security. Whether the site loads over HTTPS with a certificate browsers trust, how long the certificate has left, whether plain http redirects to HTTPS, whether HSTS is on, which of the five recommended security headers are set, whether anything on the page still loads over http, and whether the server gives away its software versions.
  • Speed. How long the server takes to start answering (measured from our server in Australia, so it’s close to what Australian visitors get), how many redirects come before the page, how big the HTML is, whether it’s compressed, and how many scripts and stylesheets hold up the first paint.
  • Search and sharing. Whether the page loads with a 200 and is allowed into Google, its title, meta description, main heading, canonical link, mobile viewport and language, the Open Graph tags that make shared links look right, structured data, image alt text, the favicon, robots.txt and the XML sitemap.

How the score works

Each check is a pass, something to improve, or something to fix. A pass earns full marks, an “improve” half, and a “fix” none. Checks that matter more, such as HTTPS, being allowed in Google and a mobile viewport, count for more than the small things like a favicon. The score is out of 100: 90 and up is an A, 80 a B, 65 a C, 50 a D, and anything lower an F.

It’s a quick check of one page, not a full audit. It doesn’t download images or scripts, run the page’s JavaScript, or crawl other pages, so a site can score well here and still be slow to load or have broken pages elsewhere.

Why is my site’s response time slower here than on my computer?
We time the first byte of the page from our server in Australia, with nothing cached. Your own browser may have parts of the site cached, or be closer to the server. If the site is hosted overseas, the time includes the trip there and back, which is what your Australian visitors get too.
My site scores badly on security headers. Is it unsafe?
Not necessarily. The headers are extra protection that browsers apply when the server asks for it: they stop other sites showing yours in a frame, stop browsers guessing file types, and limit what leaks to other sites. Most small-business sites don’t send them. Adding them is usually a few lines in the server settings or .htaccess.
It says my page has noindex. What does that mean?
The page is asking search engines not to list it. That’s right for a thank-you page or a staging copy, but if it’s on your home page, Google won’t show your site at all. Website builders sometimes leave it switched on from before launch; look for a setting such as “hide from search engines”.
Can it check a site behind a login, or on my office network?
No. It only checks public websites on the normal ports (80 and 443), and it refuses private and internal addresses. It sees what a first-time visitor sees, so a page behind a login shows up as the login page.
Can I check lots of sites, or run it every day?
It’s limited to a few checks a minute, so it isn’t built for bulk scanning. If you’d like your sites watched for you, including certificate expiry and downtime, talk to us.

Related tools

Meta & Open Graph toolkit →Write the title, description and sharing tags, with previews. DNS record lookup →A, MX, TXT, NS and more for any domain. MX & email setup check →Is a domain’s email set up properly?

AI workshops for teams

Get your team confident with AI.

Interactive half-day and full-day workshops in Copilot, Claude or ChatGPT, run at your office - in Sydney, or anywhere we can fly to.

Book a workshop How the workshops run