What the Website Checker does

Security

• Connection security — Whether the site opens over HTTPS, whether the certificate is valid and trusted, how soon it expires, which encryption protocol is used, whether four basic security headers are present, and whether pages load scripts, styles or images over insecure http:// (mixed content).
• Email protection — Two public DNS records that tell mail services who is allowed to send email in the name of your domain, and what to do with fakes.
• Blacklists — Whether Google lists the address as dangerous (malware, phishing or unwanted software). This is the same list Chrome and other browsers use to show red warning pages. We also look for hidden links to casino, betting and similar sites in the page code — a typical sign of a hacked site.
• Known vulnerabilities — Whether the versions we could see appear in public vulnerability databases (OSV, which includes CVE entries) or in the WordPress.org list of insecure versions.
• Forgotten files — Whether service files that are often forgotten after updates and moves are open to anyone: the settings file with passwords (.env), the source code repository (.git), database dumps and site archives, copies of WordPress settings, phpinfo and server status pages, open file listings. We check up to 10 well-known addresses.
• What the site gives away — We read hidden data in JPEG photos (GPS coordinates and device model) and in PDF document properties (author name and software) on the home page and other checked pages. Only files on your own domain: up to 12 photos and 4 documents.
• Look-alike domains — We build up to 60 addresses similar to yours — a missing, doubled or swapped letter, a neighbouring key, “0” instead of “o”, your name in other domain zones — and check in DNS which ones are registered. For registered ones we check whether they lead to your site and whether they can receive email.

Up to date

• Platform — Which system the site is built on (WordPress, Joomla, Drupal, Shopify, a site builder…), which version, and whether that version still receives security fixes.
• Outdated components — Software the site shows to the outside world: the server (Apache, nginx), the programming language (PHP) and scripts such as jQuery or Bootstrap — and whether their support has ended.
• Site age — When the domain was registered, when the site first appeared in the public web archive, and the latest year in the copyright line — the signs visitors use to judge whether a site is cared for. The year is always approximate. We also look at the date the domain is paid until and warn you if it is less than 30 days away, and whether the domain is protected from theft.

Speed

• Hosting — Who owns the network your website lives on, in which country it is registered, whether the site sits behind a CDN, and how fast the server starts answering.
• Speed — Google PageSpeed loads your home page on a simulated mid-range phone with a mobile connection and gives a score from 0 to 100. We divide it by 10. For reference we also show the page weight and an estimated carbon footprint of one view; it does not affect the score.

Search & AI

• Google search — Google's automated SEO audit of the home page, plus whether the site can be indexed, has robots.txt and sitemap.xml, and a meta description. We also open up to 9 other pages and check titles, descriptions and duplicates. Broken links are a separate indicator.
• Broken links — We collect links from the home page and up to 9 other pages — up to 40 internal and 10 external — and check whether they open: 404 and 410 errors, server errors, domains that no longer exist.
• AI readiness — Whether robots.txt lets the main AI assistants read the site, whether a page gives away full paid text, whether the text is readable without JavaScript, whether the page has structured data (schema.org) and link-preview tags, and whether there is an llms.txt guide for AI.

Accessibility

• Accessibility — Six basic automatic checks of the home page: page language, page title, whether zoom is allowed on phones, text alternatives for images, labels on form fields and a main heading. On up to 9 other pages we also check the language, the main heading and image descriptions. This is not a full WCAG audit — many problems can only be found by a person.
• Mobile usability — Whether the page is adapted to phone screens (viewport), whether people can zoom in, whether buttons and links are big enough to tap, whether text is large and contrasty enough, whether the content fits the screen width, and whether the phone number can be tapped to call. Part of the data comes from Google Lighthouse on a simulated phone.

Trust

• Trust signals — Whether the site has About and Contacts pages, a phone number or email, a physical address, a privacy policy, company details for Google (Organization or LocalBusiness markup) and social media links. We look at the home page and up to 9 other pages.
• Privacy (GDPR) — Whether the home page loads fonts from Google's servers (which sends every visitor's IP address to Google) and whether tracking scripts appear in the code without a known consent tool. This is a quick automated look, not legal advice.
• Russian services — Whether the site uses services of companies under Ukrainian sanctions (Yandex, Mail.ru, VKontakte, Odnoklassniki) or other Russian counters, whether it loads files from .ru, .su and .рф domains, whether email and DNS run through Russian servers, whether the server network is in Russia, and whether the domain is in a Russian zone.

A free score in about a minute

Enter an address and watch every step live. You get a score out of 100 with a letter from A to F, and for each of the 20 indicators a traffic-light colour and a one-line result. No sign-up. Check a website →

Full report — €25

What exactly was found for each indicator, why it matters for your business, how to fix it — ready tasks for your developer, one list of fixes by priority and a PDF with your company name. “The main points in one minute” is written for owners who are not technical. Ordered right after a check →

Weekly monitoring — from €15/month

An automatic weekly check: whether the site opens, the certificate, the domain, Google blacklists, email protection and security headers. If something breaks, you get an email. Website Monitoring →

A gold badge for 100 out of 100

A site that scores 100 out of 100 with every indicator checked gets the OLBO gold badge: a seal, a shield or a footer plate. Sites scoring 75 or more get a small badge. The badge shows the month of the check and its data is signed, so the score cannot be faked.

Check it yourself

Next to the first indicators there are links to independent public tools (SSL Labs, MXToolbox, BuiltWith and others), already filled in with your address — so you can see the data is real.

Results by email and a link for colleagues

Send the score and all 20 indicators to your email, or share a link that opens the checker with your site’s address filled in.

Telegram bot

Run the same free check in Telegram: send the address to @olbo_tekhohliad_bot. Open the bot →

Honest limits

Public data only: the program does not guess passwords, log in or scan ports. It is an automatic check on a given date, not a security, SEO or accessibility audit. Indicators that could not be checked are grey and do not count towards the score. Terms of use →