What each category checks

Whether search engines can reach your content at all, and whether what they find is described well enough to rank.

• Search engine visibility - whether Discourage search engines is switched on, which blocks indexing site-wide.
• Permalink structure - plain ?p=123 URLs carry no keywords and read poorly.
• Titles and meta descriptions - presence and length, so they are not truncated in results.
• Heading structure - H1 usage and subheading depth.
• Canonical URLs - and whether the canonical host matches the site address.
• Open Graph tags - so shared links render a rich preview instead of a bare URL.
• Structured data - JSON-LD presence.
• XML sitemap and robots.txt - whether the sitemap exists, is discoverable, and whether robots.txt disallows anything important.
• Site tagline - still set to the WordPress default.
• Content volume - whether there is enough published content to rank.

Server-side cost and page weight - the things that decide how long a visitor waits before anything appears.

• PHP version - older versions are slower and unsupported.
• Page and object caching - whether either is in play.
• Server response time - measured against your own front end.
• Document weight and asset counts - how much HTML, and how many scripts and stylesheets.
• Render-blocking scripts - assets in the head that delay first paint.
• Compression - whether gzip or Brotli is active.
• Autoloaded options - the row of data loaded on every single request.
• Revision and transient build-up - rows that accumulate silently and never get cleaned.
• Spam and trash volume, database overhead, plugin count and debug flags.

The three metrics Google measures from real visitors, plus the markup patterns that cause them to fail.

• LCP image prioritisation - whether the likely largest image is lazy-loaded or deprioritised, which delays the main paint.
• Layout-shift sources - images and iframes shipping without dimensions, the most common cause of CLS.
• Font-display strategy - whether text stays invisible while a webfont loads.
• Third-party script load - used as a proxy for Interaction to Next Paint.
• Connection hints - preconnect and dns-prefetch for external hosts.

With the optional Google lookup enabled, this category also reports your real-user LCP, INP, CLS and FCP from the Chrome UX Report. It is off by default. See Privacy.

Automated checks catch the mechanical WCAG failures. They cannot judge whether your alt text is good - only whether it exists.

• Image alt attributes - both in the rendered page and across the media library.
• Document language - so screen readers choose the right pronunciation.
• Heading order - levels skipped, which breaks navigation by heading.
• Landmark regions and skip links - so keyboard users can jump past navigation.
• Accessible names - links and buttons with no discernible text.
• Form label associations and iframe titles.
• Duplicate IDs and positive tabindex values.
• Zoom restrictions - user-scalable=no is a WCAG 1.4.4 failure.

Configuration hardening and exposure. This is not a malware scanner - it reports how much surface you are leaving open.

• HTTPS and mixed content - and HSTS.
• Pending updates - core, plugins and themes.
• The admin username and administrator count.
• Dashboard file editing - which lets a compromised admin account execute PHP.
• Debug output exposure - WP_DEBUG_DISPLAY leaking paths and queries.
• Table prefix, XML-RPC and automatic updates.
• Response hardening headers - X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
• Version disclosure - the generator tag and publicly readable core files.
• Directory browsing and username enumeration.

• Viewport meta tag - present and correct, so browsers stop rendering at desktop width.
• Responsive styling - whether the active theme declares media queries.
• srcset coverage - so phones are not downloading desktop-sized images.
• Fixed-width elements - inline widths that exceed a phone screen and force sideways scrolling.
• Site and touch icons.
• Tappable phone numbers - plain-text numbers that should be tel: links.
• Legacy plugin embeds - Flash-era markup that will never render.

• 404 handling - whether a missing URL returns a genuine 404 status, not a 200 with an error page.
• Site search availability.
• Privacy policy assignment and timezone configuration.
• Comment spam exposure - open comments with no moderation threshold.
• Contact and about pages - heuristic; verify before acting.
• Navigation size and footer presence.
• Broken internal links - a sample of up to twelve.
• New-tab link safety - target="_blank" without rel="noopener".

• Pending database updates and store and terms pages.
• High-Performance Order Storage - whether HPOS is in use.
• Forced secure checkout and the demo store notice.
• The legacy API - deprecated /wc-api/ endpoints.
• Product data completeness - images, descriptions, SKUs.
• Shop pagination and expired session build-up.
• Template overrides - outdated copies in your theme.
• Cart fragments on non-store pages and WooCommerce assets loading site-wide - two of the heaviest costs in a default install.
• Product structured data.

This category only appears when WooCommerce is active - it is not registered at all otherwise.