What VitalSite checks

Your site doesn’t tell browsers "always use HTTPS with me" — without this, a visitor’s first connection can be tricked onto an unencrypted version of your site.

There’s no rule telling the browser which scripts are allowed to run on your site — this is one of the strongest defenses against injected malicious code.

The browser isn’t told to trust the file types your server declares, which can let a malicious file disguise itself as something safe.

Your site doesn’t control what information leaks to other websites when someone clicks a link away from your page.

Your site doesn’t explicitly turn off browser features (camera, location, etc.) it doesn’t use, leaving a slightly larger attack surface than necessary.

The site couldn’t be reached securely at all — visitors would see a "not secure" warning or fail to connect.

Some cookies can be sent over an unencrypted connection, which is a real risk on public wifi.

A cookie is readable by JavaScript on the page — if an attacker ever injects a malicious script, they could steal that cookie (e.g. a login session).

A cookie doesn’t say whether it should be sent from other websites, which is part of the defense against cross-site request forgery attacks.

There’s no DNS record saying which mail servers are allowed to send email "from" your domain — without it, it’s easier for someone to spoof your business in a phishing email.

Same idea as SPF — this DNS record tells email providers what to do with messages that fail authentication, pretending to be from you.

We recognized a request to a known analytics, advertising, or session-recording service (Google Analytics, Meta Pixel, Hotjar, and others) — one finding per vendor found, not per request.

A tracker fired before the visitor interacted with your cookie banner at all — a common and often-cited compliance gap.

Cookies were set for a domain that isn’t yours — worth confirming it’s declared in your privacy notice.

The page has no title at all — it’ll show up blank or as a raw URL in search results and browser tabs.

The title is outside the roughly 10–60 character sweet spot — too short wastes an opportunity, too long gets truncated in search results.

No summary text for search engines to show under your title in results — they’ll pick something themselves, often badly.

The description is over ~160 characters and will get cut off in search results.

The page has no main heading — a signal search engines and screen readers both rely on to understand what the page is about.

The page has more than one main heading, which dilutes the "this is what this page is about" signal.

The page doesn’t declare its own preferred URL, which matters if the same content is reachable at more than one address.

Either there’s no robots.txt file at all, or — more seriously — it tells every search engine to stay away from the entire site.

We couldn’t find a sitemap.xml, which helps search engines discover every page on a larger site faster.

One or more links on the page point to a page that returns an error — bad for visitors and for search rankings.

axe-core checks close to 100 specific WCAG rules (missing alt text, poor color contrast, unlabeled form fields, and more) — each distinct rule that fails becomes its own finding, so you can fix and dismiss them one at a time. Automated checks catch real issues but can’t certify full WCAG conformance — a human review is still the final word.

The page took more than 5 seconds (or 10, for the more severe version) to finish loading — most visitors won’t wait that long.

The page pulls down more than 5MB (or 10MB) of data just to display — a real cost on mobile connections.

One or more images are 1MB or larger — almost always safe to compress with no visible quality loss.

A monitoring check couldn’t get a successful response from your site at all — this is the one finding that pages you immediately.

Your HTTPS certificate either failed to validate outright, or is within 60 days of expiring — severity increases the closer it gets to actually expiring.

Your domain name itself is within 60 days of expiring — if it lapses, everything (site, email, everything) goes down until it’s renewed.