Library · Site health and security
Site health and security
In one sentence
Findings are short case studies written from real measurements — a robots.txt that answered 200 with a challenge page, a site whose GPTBot traffic came from one address wearing seven crawler names, a homepage that was two percent readable text, a contact email that bounced for one published character — each with the bytes that showed it; a business found with a defect is named only after its owner has been contacted.
Links, contrast, security headers and email: checks that break quietly.
2026-11-0211 min
How to test text color contrast on hover and keyboard focus
Static contrast checkers measure a page at rest. On our own site, hover and focus found 65 more failure patterns than the at-rest check did. Six steps to test them, and the usual causes.
Read the measurements →
2026-11-029 min
How to move DMARC from p=none to p=quarantine without losing email
The sequence for tightening DMARC safely: inventory every sender, prove alignment from received headers, create the report mailbox first, then raise the policy in stages.
Read the measurements →
2026-11-0210 min
How to find broken internal links and dead anchor links
A link audit is an inventory, a fetch, a classification and a second pass over in-page anchors. On our own site, 2,260 link targets came down to four real defects, all from shared templates.
Read the measurements →
2026-11-028 min
How to find websites using your brand name, and prove you were first
A six-step routine: sweep the domains, pull registration dates from the registry, read what the other site does, publish a factual notice, tell answer engines, and keep watching.
NAP_NAME_DRIFT0.7%
Read the measurements →
2026-11-026 min
CSP report-only: how to roll out a Content-Security-Policy without breaking your site
How to introduce a Content-Security-Policy without breaking the page: write it from what loads, ship it report-only with a sink that works, read the reports, then enforce.
CSP_REPORTING_BROKEN0.2%
Read the measurements →
2026-11-025 min
Staging site leak: how to find a staging URL in your live pages and close it
How a managed host's staging hostname gets into production page source, what a leaked staging copy costs, how to find it from outside and how to close it without breaking the workflow.
STAGING_LEAK0.1%HOST_DUPLICATE_2006.2%
Read the measurements →
2026-11-02 · Case studies4 min
Email bounce case study: one typo, every address dead
A contractor site linked the same misspelled address on every page. Two DNS lookups proved which spelling could receive mail, and the fix took one line.
Read the measurements →
2026-11-02 · Releases3 min
Page builders drop the main landmark: nine HTML checks
Two of our own sites had no main landmark on any page built with their page builder. The nine structural checks a screen reader needs, and how to run them from the delivered HTML.
Read the measurements →
2026-11-026 min
HSTS check: missing header, bad preload, removed entries
Three HSTS problems you can read from one homepage response, how common each is across scanned sites, and why preloading is a separate decision from sending the header.
HSTS_MISSING14%HSTS_PRELOAD_INELIGIBLE4.5%HSTS_PRELOAD_REMOVED0.6%
Read the measurements →