How the scorecard works

Pages load slowly for real mobile visitors

For a quarter of real visitors, the main content takes more than 4 seconds to appear (Google's 'poor' threshold for Largest Contentful Paint).

Slow pages lose visitors before they see the offer. Google also uses these measurements in search ranking.

Mobile load time is middling

Real mobile visitors wait 2.5-4 seconds for the main content (Google's 'needs improvement' band).

Each extra second measurably reduces engagement, and competitors who are faster win the comparison.

Site feels laggy when visitors click or type

Clicks, taps and form inputs take over half a second to respond for many real visitors (Interaction to Next Paint).

Laggy forms and menus cause abandoned quote requests and checkouts.

Page content jumps around while loading

Elements move as the page loads, so visitors mis-tap or lose their place (Cumulative Layout Shift).

It looks unpolished and causes accidental clicks.

Site scores poorly on Google's mobile speed test

Google's PageSpeed test scores the home page below 50/100 on mobile. (Used when the site has too little traffic for real-visitor data.)

A low lab score usually means a slow real experience, too.

Accessibility basics are missing

Automated checks find common accessibility problems: missing image descriptions, low-contrast text, unlabeled form fields.

Customers using screen readers or with low vision struggle to use the site. US companies regularly receive ADA website demand letters.

Search-engine basics are incomplete

Google's check finds missing basics such as page titles, meta descriptions, crawlable links or a mobile viewport.

These basics affect how the company appears in Google results.

Web traffic has dropped a tier

The site fell into a lower popularity tier since the last scoring run.

A sustained traffic drop often comes before a drop in leads or sales. Common causes: a site migration, lost search rankings, or a tracking change.

Website runs on a platform version past end of support

The content management system version no longer receives security patches from its vendor (e.g. Drupal 7, Magento 1, very old WordPress).

Unsupported platforms accumulate unpatched vulnerabilities and get harder and costlier to change.

Site loads outdated JavaScript libraries

The site uses old versions of common libraries (such as jQuery before 3.5) that have publicly known security issues.

Known issues in old libraries are easy for attackers to look for.

No website analytics detected

No analytics tool (such as Google Analytics) was found on the site.

The company can't measure traffic, leads or what marketing works, and the board can't see digital performance.

Server software versions are publicly visible

The web server announces its software and version in responses (for example, an old PHP version).

It tells attackers exactly which known issues to try, and often signals old server software.

No protection against email impersonation (DMARC missing)

The domain has no DMARC record, so receiving mail servers have no instruction to reject email that fakes the company's address.

Impersonation of executives and vendors is a leading cause of invoice and wire fraud. Google and Yahoo also now require DMARC for bulk senders.

Email impersonation protection is set up but not enforced

DMARC exists but is set to monitor only (p=none), so spoofed email is still delivered.

Monitoring alone doesn't stop impersonation. Many companies set it up and never finish.

Sender rules for the domain are missing or wide open

The domain's SPF record is missing or allows anyone to send (e.g. +all).

Makes impersonation easier and hurts the company's own email deliverability.

Sender rules are too complex to work reliably

The SPF record needs more than 10 DNS lookups, so many mail servers treat it as broken.

Legitimate company email can fail checks and land in spam.

Confirm the company domain is set to auto-renew

The company's main domain comes up for renewal within 30 days, according to public registration data. That's normal if auto-renew is on.

If renewal fails, the website and all company email stop working, and the domain can be taken by someone else.

Site doesn't force a secure connection

The site can be loaded over plain HTTP without redirecting to HTTPS.

Browsers label it 'Not secure', and form data can be intercepted.

Website security certificate expires soon

The site's TLS certificate expires within 3 weeks.

When it expires, browsers show a full-page security warning and most visitors leave.

Site still accepts outdated encryption

The server still accepts TLS 1.0 or 1.1, which are deprecated.

Old protocols have known weaknesses and fail many compliance checks (e.g. PCI DSS for card payments).

Standard browser security settings are missing

The site sends few of the standard security headers browsers use to block common attacks (HSTS, content security policy, framing protection).

Cheap protections against clickjacking and some script injection.

Website hasn't meaningfully changed in over 18 months

Public web archives show no meaningful change to the home page in over 18 months.

Customers, recruits and buyers notice dated content, old offers and missing news.

Copyright year in the footer is out of date

The site footer shows an old copyright year.

A small, highly visible sign that nobody is maintaining the site.

No careers page found

The site has no visible careers or jobs page.

Hiring is often the bottleneck in a growth plan, and candidates check the website first.