Most important first.
Always-secure instruction (HSTS)
Domain & Security
Technical
Your site does not tell browsers to always use the secure connection.
Why it matters: Without this instruction, a browser may still try the insecure address first, which leaves room for the connection to be tampered with.
How to fix it: Ask your developer or host to add the Strict-Transport-Security header once HTTPS works on every page.
Email sender record (SPF)
Domain & Security
Moderate
Your domain does not publish an SPF record, so mail servers cannot tell which senders are genuinely yours.
Why it matters: Without it, your own emails are more likely to land in spam, and others find it easier to send mail that claims to come from you.
How to fix it: Add an SPF record in your domain's DNS settings; your email provider publishes the exact line to use.
One main heading
AI Readiness
Quick
Your homepage has no main heading, or more than one.
Why it matters: One clear main heading tells readers and machines what the page is about at a glance.
How to fix it: Make sure exactly one heading on the page is marked as the main (H1) heading.
Contact form findable
AI Readiness
Quick
We found no contact form on your homepage.
Why it matters: A form lets a customer reach you at any hour without picking up the phone.
How to fix it: Add a simple contact form, or a clear link to one, on your homepage.