What Gus checks, in plain English
Every problem Gus can find, explained the way he'd explain it to you — what it actually means, whether it's worth worrying about, how to check it yourself, and the exact question to ask whoever looks after your site.
13 of them are in the free check-up, and 5 come with the in-depth assessment. Or skip the reading and run a free check-up — Gus will tell you which of the free ones apply to your site in about a minute.
Is anything dangerous exposed or out of date?
The basics — making sure nothing's been left lying around that shouldn't be.
- Why does my website say “not secure”?If your site loads over http as well as https, some visitors browse an unprotected copy. What that means, how to check it yourself, and what to ask your web person.Worth a look
- My security certificate has expired — what now?An expired SSL certificate shows every visitor a full-page browser warning. Why it happens, how to check your expiry date yourself, and how to stop it recurring.Worth sorting promptly
- What are security headers, and does my site need them?HSTS, CSP, X-Frame-Options and the rest — what the six common browser-protection settings actually do, whether yours are switched on, and how to ask for them.Worth a look
- Is my test or staging site visible to the public?Staging, dev and admin subdomains are often left reachable by anyone. Why that's a soft spot, how to find out whether yours are public, and how to close them.Worth a look
- Is my WordPress site out of date or at risk?WordPress runs a huge share of small-business websites, and most break-ins come through outdated plugins rather than WordPress itself. What to check and what to ask.Worth knowing
- Is my website running an out-of-date version?Most websites publish the version of WordPress, Drupal or Joomla they run on. How to read it, how to tell whether it still gets security fixes, and what to ask for.Worth sorting promptly
- Are my website's plugins out of date?Most break-ins to small-business websites arrive through a plugin nobody updated. How to spot an out-of-date or abandoned add-on, and what to ask your web person.Worth a look
- My site uses a library with a known security weaknessSites often ship an old copy of jQuery or similar with a publicly listed weakness. What that means in practice, how serious it is, and how to get it updated.Worth a look
- Why does my secure site still show a warning?Your page loads over https but some images or scripts still load insecurely. What mixed content is, why browsers block it, and how to find the offending items.Worth a lookIn-depth assessment
Can customers find and use your site easily?
Speed, search visibility, and usability — the things that help visitors get through.
- Why isn't my website showing up on Google at all?If your site can't be found even by name, it's often blocking search engines by accident — a leftover launch setting. How to check in two minutes and how to fix it.Worth sorting promptly
- What is a meta description, and does mine matter?The short summary under your link in Google results. What it does, what it doesn't do, and whether writing them is worth your time.Worth a lookIn-depth assessment
- Why does my site look tiny on a phone?If visitors have to pinch and zoom to read your site, it's usually one missing line of code. What the viewport setting does and why Google cares.Worth sorting promptlyIn-depth assessment
- Is my website too slow, and does it cost me customers?What a slow site actually costs, which speed numbers are worth caring about, and the handful of fixes that account for most real-world improvement.Worth a lookIn-depth assessment
- What are sitemap.xml and robots.txt, and are mine right?The two files that tell search engines how to read your site. What each does, the mistakes that quietly cost traffic, and how to check yours.Worth a look
- Is my site live on more than one web address?www and non-www, http and https, an old domain still answering — when the same site lives at several addresses, search engines split the credit. How to check.Worth a look
- Do my old links still work after a redesign?A redesign that changes page addresses without redirects throws away years of search credit. How to check for dead ends and what to ask for.Worth a look
- Does my website need to be accessible, legally?UK businesses have duties under the Equality Act to make services accessible, and that includes your website. What that means in practice, without the alarm.Worth a lookIn-depth assessment
Is your website being well looked after?
Useful checks that show what's set up well and where a little attention may help.
£12 a month
And what the in-depth assessment looks at
The free check-up reads what your site publishes and tells you if anything's wrong. The in-depth assessment goes further: for a site you've proved is yours, Gus connects to it, follows it page by page, and picks the configuration apart. Here's what that adds.
Your encryption, not just your certificate
The free check-up reads your certificate: who issued it, when it expires, whether browsers trust it. The in-depth assessment then offers your site every protocol version from the oldest to the newest and writes down which ones it still agrees to, along with the cipher suites it accepts. That is how a site with a perfectly valid certificate turns out to be still speaking a version of the language that was retired years ago.
Your security settings, read line by line
The free check-up tells you whether your browser-protection settings are there. The in-depth assessment reads them: your Content-Security-Policy taken one directive at a time, how long browsers are told to insist on a secure connection, whether other sites can frame yours, and the flags on every cookie your site sets. A policy that exists and a policy that protects you are not the same thing.
What your site gives away about itself
Software names and version numbers your site publishes in its responses and pages, and error text left visible on the pages Gus reads. None of it is dangerous on its own. All of it shortens the work for somebody deciding whether your site is worth their time.
Every page Gus can reach, not just the front one
The free check-up looks at your home page and your public records. The in-depth assessment follows the links from page to page and reads what comes back, up to the page limit for the run — so a problem on the one page you had forgotten about is found the way a visitor would find it. The report says how many pages were read.
What your site tells AI assistants
More and more people ask an assistant rather than a search engine, and the answer comes from what your site publishes to its crawlers. Gus reads your robots file for each named AI crawler in turn, checks whether your business is described in a form a machine can read, and measures how much of the page actually arrives before any scripts run.
How fast, findable and usable it really is
Google's own Lighthouse, run over your home page: how fast it loads, how well it reads on a phone, how it does on accessibility, and the search-result basics. This is the measurement that moved out of the free check-up because it takes minutes rather than seconds — it is the same tool Google itself judges you with.
And what you get at the end of it
- Every finding graded for risk — how likely it is and what it would cost you — with a CVSS score where the finding is one that can honestly carry a number, and “not scored” where it isn't.
- The evidence behind each finding, so your developer can see what Gus actually saw rather than take a verdict on trust.
- A coverage table naming every area, assessed or not, and a list of the parts that did not run this time — so a short report is never mistaken for a clean one.
- The lot as a written report you can hand to a customer, an insurer, or whoever looks after your site.
The pages above that need an in-depth run
These 5 are measured by Google's Lighthouse, which takes minutes rather than seconds — so the free check-up doesn't wait for it. Everything on them is still worth reading, and you can check most of it yourself with the steps on each page.
What it isn't — and Gus would rather you knew now
It's a thorough automated assessment, not a manual penetration test, and it isn't CREST-accredited. If a contract specifically asks for one of those, this is the thing to hand the tester on day one.
Concretely, these are the things no automated check can do. Each needs a person, a payload, or a password:
- Authentication and session handling. Testing a login means holding accounts on your site and trying to misuse them. That needs credentials and a person.
- Access control and privilege escalation. Proving one customer can't read another's data needs two accounts and somebody deliberately trying.
- Injection testing (SQL, XSS, command injection). These are proved by sending your site crafted input and watching what it does. Gus never sends crafted input.
- Business logic flaws. Buying something at the wrong price, or skipping a step in a booking, is found by a person who understands what your site is for.
- Server-side request forgery and file inclusion. Both are proved by making your site fetch or include something it shouldn't — which is an attack, not an observation.
- Infrastructure and open ports. Gus talks to the web addresses your site publishes. He doesn't go looking for other services on your servers.
- Uploaded files and stored content. Anything reachable only after signing in, or by uploading a file, is outside a check that never signs in.
A proper look is part of Gus's £12 a month, alongside the daily check-ups — and you can ask for one for any site you've proved is yours.
What Gus costs18 checks and counting. Gus only writes about things he genuinely tests — if it's on this list, it's in the report.