Website Checklist

The page title is the text that appears on the browser tab and in search engine results, and it tells both users and search engines what the page is about. It’s important because it’s one of the first things people see in search listings and can influence whether they click.

For best SEO results, keep titles under 60 characters, include relevant keywords near the beginning, and make sure each title is unique and clearly reflects the page content. Avoid keyword stuffing—clarity and relevance are key.

A meta description is important because it provides a concise summary of a webpage’s content, helping search engines understand the page and encouraging users to click through from search results. It directly influences click-through rates by attracting and informing potential visitors.

If a page declares a canonical tag pointing elsewhere, confirms that target actually exists.

An H1 tag is important for both accessibility and search engine optimization. It helps screen readers and other assistive technologies quickly identify the page’s primary content, improving the experience for users with disabilities. For search engines, the tag provides context about the content’s subject matter, making it easier to index and rank the page appropriately. Structurally, it also helps organize content in a logical hierarchy, ensuring that both users and search engines can understand the page’s focus at a glance.

Using multiple H1 tags can confuse both search engines and users, potentially weakening the page’s clarity and relevance. Keeping a single, well-written H1 ensures a clear and organized structure that benefits usability and ranking.

Beyond images, this check also catches broken CSS, JS, and favicon references.

Flags same-domain links that hit a permanent redirect instead of pointing straight at the final URL.

Ensure no pages have fatal errors, which can keep a page from rendering, or not at all. More information about this functionality in Opti can be found here: Scanning a website for fatal errors

Confirms the server doesn’t allow anonymous FTP logins.

Confirms the Referrer-Policy response header is set, controlling how much referrer information is shared when users navigate away from the site.

Ensuring anything served to HTTP redirects to HTTPS

Flags a publicly-accessible .git/config file at the site root, or within a theme or plugin folder, which can expose source history and configuration.

Checks that the WordPress version isn’t exposed via readme.html, license.txt, or wp-activate.php.

Confirms wp-config.php can’t be requested directly.

Confirms /wp-json/wp/v2/users doesn’t leak registered usernames.

Confirms xmlrpc.php isn’t reachable, closing off a common brute-force and DDoS vector.

Flags known tracking/analytics cookies (Google Analytics, Meta Pixel, Hotjar, etc.) found on a fresh page load, before consent has been given.