Every guide is mapped 1:1 to an active check key so you can move from warning to fix without guesswork.
The FTC fined Avast $16.5M in 2024 for collecting and selling browsing data that contradicted their privacy policy promises (FTC enforcement action). Privacy policies and terms must be easily discoverable — not just present, but findable. Most legal frameworks (GDPR, CCPA, FTC Act) require clear, accessible disclosure. A footer link is the minimum standard.
Open guideWithout a declared charset, browsers use heuristics to guess the encoding. This frequently garbles accented characters (é becomes é), em dashes, curly quotes, and any non-ASCII text. For multilingual sites, this is catastrophic. The fix is one meta tag: <meta charset="UTF-8"> before any other content in the head.
Open guideDNS A record changes redirect your traffic to a different server. This is expected during hosting migrations, but an unexpected change could mean your domain has been compromised or your hosting provider changed infrastructure without notice. Monitor A record changes to catch problems before users experience downtime or are redirected to malicious servers.
Open guideA lapsed domain takes your entire site offline instantly, and recovery can take days even after renewal due to DNS propagation. Worse, expired domains are actively targeted by squatters and spammers who register them within hours. Your search rankings, email delivery, and brand reputation all depend on keeping your domain active. Set auto-renewal and monitor expiry dates.
Open guideOnly 18% of the top 10 million domains publish a valid DMARC record, and just 4% enforce a reject policy (Valimail, 2024). Fully authenticated senders are 2.7x more likely to reach the inbox than unauthenticated ones. Meanwhile, an estimated 3.4 billion phishing emails are sent daily, with domain spoofing as the primary vector. Without SPF, DKIM, and DMARC, anyone can send emails that appear to come from your domain.
Open guideA favicon appears in browser tabs, bookmarks, browser history, and Google's search results. Without one, your site looks unfinished and is harder for users to find among open tabs. It's also a trust signal — professional sites have favicons, and their absence can make visitors question legitimacy.
Open guideWithout <!DOCTYPE html> at the top of your HTML, browsers enter "quirks mode" — applying legacy rendering rules from the IE5 era that break modern CSS features like box-sizing, flexbox behaviour, and font rendering. This causes layouts to look different across browsers and makes debugging CSS issues significantly harder.
Open guidehumans.txt is an optional file that lists who built the site, what technologies were used, and contact information. It's not critical for SEO or functionality, but it's a small transparency signal that helps security researchers reach you, gives credit to your team, and shows you care about web standards.
Open guideScreen readers use the lang attribute to select the correct pronunciation engine — without it, they apply default language rules that mispronounce words and ignore language-specific grammar. Browser translation tools also rely on lang to detect when to offer translation. It's a single attribute on the html element that takes 5 seconds to add.
Open guideWithout a viewport meta tag, mobile browsers assume your page is designed for desktop and zoom out to fit the full width on a small screen. Everything becomes unreadably small. This is a single line of HTML (meta name="viewport" content="width=device-width, initial-scale=1") that every mobile-friendly site needs.
Open guideHorizontal scrolling on mobile is one of the strongest negative UX signals. Users expect vertical-only scrolling, and content that overflows the viewport looks broken. Common causes: fixed-width elements, unresponsive images, tables without scroll wrappers, or absolute-positioned elements that extend beyond the screen edge.
Open guideNameserver changes control where your domain's traffic is routed. An unauthorized change means someone can intercept all your traffic, email, and subdomains. If you didn't initiate this change, investigate immediately — check your domain registrar account for unauthorized access. Legitimate causes include hosting migrations or CDN changes.
Open guide