23
Security
Certificate and TLS protocols, security headers, reachable backups and configuration files, cookies, CORS, integrity protection, CAA and email protection.
What we check
478 individual checks: 218 own rules with a plain-language fix instruction, 105 accessibility rules (axe-core, WCAG 2.2 and best practice, each light and dark on desktop and phone), 155 Lighthouse audits and the W3C HTML checker. Every rule has a source, a severity, a target state and an effort class for the fix.
68
Technology and structure
Reachability, redirects, HTTP/2 and HTTP/3, caching, rendering, broken links, page weight, CMS leaks, IPv6, name servers, load time with Lighthouse.
73
Findability (SEO)
robots.txt, sitemap, indexing, canonical, titles, descriptions, headings, text volume, internal linking, images, structured data, hreflang.
23
AI findability (GEO)
24 AI crawlers individually, content without JavaScript, llms.txt, answer paragraph, quotable paragraphs, Organization, author and FAQ data.
6
Accessibility and speed
WCAG 2.2 A/AA with 105 axe rules, 155 Lighthouse audits, HTML validity with the Nu checker, display at 320 pixels.
9
German legal requirements
Legal notice, consent before third-party services, fonts from third-party servers, accessibility statement, price details, form notices.
16
Historical signals (note only)
Signals that used to count or stem from old technology; fully checked, but reported only as a note without urgency.
Sources
Rules and thresholds follow Google Search Central, W3C WCAG 2.2 and HTML, the OWASP Web Security Testing Guide, Mozilla Observatory, Qualys SSL Labs, the RFCs on HTTP, robots.txt and security.txt, the sitemap protocol and the German DDG, TDDDG, PAngV and BFSG. In the report every rule names its source, the target state and the fix instruction, so your developer, agency or lawyer has the facts for the next step.