What we check

Built from the code on 2026-10-11

This is the full list of what a Preventionlabs report checks, built from the code that runs the checks, so it changes when a check changes. There are 25 sections: 16 need only your domain, and 9 need a connected Cloudflare account.

Each check looks only for the things listed here. A check can pass while a problem in the same area goes unnoticed, because it wasn't one of the things that check looks for. If you find something we missed, tell us at contact@preventionlabs.com.au; we add and improve checks over time.

With only your domain

  • Reachability, HTTPS and DNS: Whether the site loads, HTTPS, redirects, speed and DNS, in every report.
  • Uptime: Whether each of your sites responds, checked every 5 minutes, with 30 days of history.
  • Links, content and headers: Broken internal links, insecure http:// resources on https pages, missing security headers, robots.txt and sitemap.xml, as visitors and search engines see them, and spam words shown to Google but not to visitors (cloaking, a sign of a hacked site).
  • Errors in the browser: Your homepage and up to 3 more pages from your sitemap opened in a real Chrome browser, as a visitor would: uncaught JavaScript errors and requests the browser blocks under CORS. Nothing is clicked, typed or submitted.
  • Pages from your sitemap: Pages from your sitemap (up to 50): pages that fail, redirect, are set to noindex, are slow, or have no title, duplicate titles, no description or images without alt text.
  • Page basics, cookies and upkeep: Missing pages that wrongly answer 200 OK, whether the favicon and the homepage images actually load, placeholder text (lorem ipsum) and links to development addresses (localhost), page language, link previews (Open Graph), structured data, cookie security flags and a stale copyright year.
  • DNS health: DNSSEC (on, off or broken), number of nameservers, CAA certificate limits, IPv6, records pointing at services that no longer exist (takeover risk), mail servers with no address, the registry record (when the domain expires and whether transfers are locked), and whether the site accepts connections over both IPv4 and IPv6.
  • Outdated scripts: Script libraries on your homepage (jQuery, jQuery UI, Bootstrap, Lodash, Moment, Handlebars, AngularJS, Vue) against versions with published security holes or no support.
  • Addresses and redirects: Every version of your address (http, https, www, no www) ends on one secure address, without loops or long redirect chains, and how long browsers are told to insist on HTTPS.
  • Security policy, tracking and outside services: How strict your Content Security Policy is, every outside service your homepage loads files from and whether those files actually load, and addresses your homepage code calls (fetch, axios, WebSocket) whose host has no address in DNS, so the call fails for every visitor.
  • Site files (security.txt, ads.txt, AI crawlers): security.txt (present and not expired), ads.txt when the site shows ads, which AI crawlers robots.txt blocks, and llms.txt.
  • Search visibility: Whether search engines are allowed to list your homepage: noindex left on, robots.txt blocks and canonical links pointing elsewhere. Not search ranking.
  • Speed and page weight: What makes your homepage slow: total size, the largest images and scripts, scripts that block the page, caching lifetimes and files from other services. Plus what real visitors on phones got over the last 28 days, from Google’s Chrome UX Report (Google publishes it only for sites with enough Chrome visitors).
  • Email authentication: Whether your email is protected from being faked and likely to land in inboxes: SPF (and its 10-lookup limit), DMARC and whether it is actually enforced, DKIM signing keys, and whether the sending addresses your SPF record names are on the SpamCop blocklist.
  • Leaked files: Files that should never be public: .env files, git repositories, config backups, server status pages and similar; secret keys (Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, Supabase service_role) written into code every visitor downloads; and database or debug tools open to anyone (phpMyAdmin, Adminer, Spring Boot Actuator, Laravel Telescope, Symfony profiler). Only checked on domains you have proven are yours.
  • Your platform: Checks for the platform your site runs on. Shopify: store password page, products in stock, and whether the cart address (/cart.js) answers. WordPress: version against the latest release, out-of-date plugins, xmlrpc, and user accounts listed publicly (display names, not login names).

With Cloudflare connected

  • Errors visitors get: Server errors (5xx) and not-found (404) responses, by address, as Cloudflare counted them. Cloudflare's own background requests (Early Hints) and our own checks are left out.
  • Code errors (Workers): Errors thrown by your Workers over time: how many requests failed and why (uncaught exception, out of CPU or memory), and the slowest run times. Pages Functions are not included in this data.
  • Deploys: Whether the latest production deploy of each site succeeded, whether the live homepage is the one that deploy serves, and Worker updates, so a problem can be matched to the change before it.
  • Recent changes: Changes made in your Cloudflare account in the last 72 hours, read from its change log: what changed, and when.
  • DNS changes: Your DNS records, compared with a snapshot every hour, so any added, removed or changed record is caught.
  • Blocked traffic: What Cloudflare blocked, in its own words: the security product and rule that made each block, and the addresses blocked most. Visitor IP addresses are not read.
  • Cloudflare settings: Zone paused or inactive, SSL mode (Off, Flexible, Full or Full strict), Always Use HTTPS, development mode left on, minimum TLS version, automatic HTTPS rewrites and security level.
  • HTTPS certificate: The HTTPS certificate Cloudflare serves for your site: active, and days until it expires.
  • Visitors, last 2 weeks: Visitors and page views: the last 7 days against the week before, yesterday against the median day of the two weeks before, and countries whose requests fell to a tenth or less while the total held. Cloudflare's counts, bots included.

Every check is read-only: ordinary requests a visitor or search engine could make, plus the read-only Cloudflare token you provide. See section 2 of the Terms for how checks are made.