How do I check a website before taking on a new client?

Updated 2026-10-17

Short answer: before you take on a site, find out what you're inheriting, so problems that were already there don't become yours. The usual surprises are an expiring domain or certificate, missing email records (SPF, DKIM, DMARC), out-of-date plugins, exposed files and broken pages.

How to check it yourself

  1. Check the domain's expiry date and who it's registered to.
  2. Check HTTPS works and when the certificate expires.
  3. Look up the domain's SPF, DKIM and DMARC records, so you know whether the client's email is set up properly.
  4. On WordPress, ask for a login and check Dashboard, then Updates.
  5. Click through the main pages and the contact form, and write down anything already broken, so you can show the client what was there before you started.

What Preventionlabs shows

Add the client's domain, prove you look after it with one DNS TXT record or the client's Cloudflare account, and click once. The report covers uptime, HTTPS, the domain, DNS, email records (SPF, DKIM, DMARC), files that should never be public, script errors in a real browser and much more, in plain words you can send to the client. Your first full report is free, on a domain that hasn't had a Preventionlabs report before. See everything a report checks.

The client has to add the TXT record or connect Cloudflare first, because Preventionlabs only checks sites whose owner has agreed to it.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers