More than 40 points, in plain words: what it looks at, why it matters, and what it means if it fails.
The check is split into three groups — content, technical and social sharing & data — and alongside them speed is measured separately with Google’s Core Web Vitals, on mobile and on desktop. Two more trust checks are shown without counting towards the score.
What Google, and the visitor, understand from your page.
| Check | What it looks at, and why |
|---|---|
| Page title | Is there a title? It is the one line people see in Google’s results before they decide whether to click. |
| Title length | Too short says nothing; too long gets cut off in the middle. |
| Description (meta description) | The short text under the title. If it is missing, Google writes whatever it finds. |
| Description length | Same reason: it should fit, and say something. |
| One H1 heading | The main title inside the page. None, or several, blur what the page is about. |
| Heading order | Headings should go in order (H1 → H2 → H3), like the chapters of a book. |
| Amount of text | An almost empty page rarely ranks for anything. |
| Image descriptions (alt) | Without them Google does not know what a photo shows — and neither does a blind visitor’s screen reader. |
| Internal links | Pages that are not linked to each other are pages nobody finds. |
The foundations. When something breaks here, it does not matter how good the text is.
| Check | What it looks at, and why |
|---|---|
| Viewport | If it is missing, the page shows on a phone like a shrunken desktop page. |
| HTTPS | Without it the browser writes “not secure” next to your name. |
| Noindex | A tag that tells Google “do not show me”. It is left in by mistake more often than you would think — and makes a whole site disappear. |
| Page language | Tells Google and translation tools which language the page is written in. |
| Canonical | Declares which address is the “official” one when a page has variants. |
| robots.txt | The instructions for search engines. If it is missing or wrong, it can shut doors by mistake. |
| Sitemap | The list of your pages. Without it Google has to search on its own. |
| Favicon | The little icon on the browser tab. Small, but it is your identity among twenty open tabs. |
| Redirect chain | Every extra “hop” before the page loads costs time and loses visitors. |
| Empty links | Links that go nowhere — a broken experience, and “weight” lost for Google. |
And one more that does not count towards the score: the page on a phone. Google reads the mobile version, and some sites give phones a separate copy (a mobile cache, for example). We open the page as a phone too, and tell you if something is missing there — title, description, text — or if the icons will show up as little boxes.
And the server settings, which do not count towards the score either: HTTP/2 (faster loading), compression of the pages, “keeping” files in the browser for the next visits, a real “404” when a page does not exist (otherwise Google may list error pages) and one main address — with or without www, the other sending there permanently. For information we also show HTTP/3 and IPv6.
And the page’s HTML code, which does not count towards the score either: each id used once, tags closed in the right order, elements only where HTML allows them, attributes written correctly and no obsolete markup. Browsers usually cope, but such a mistake can break a form or a screen reader. We read only the code the check has already downloaded.
What people see when someone shares your page.
| Check | What it looks at, and why |
|---|---|
| og:title | The title shown when your link is posted on Facebook, Viber or WhatsApp. |
| og:image | The preview image. Without it, your link is a grey line of text. |
| Structured data (JSON-LD) | Information in a language machines read: what kind of business you are, where, and your opening hours. |
Measured separately, with Google’s data, on mobile and on desktop:
The weight of the images is checked too — the most common cause of a slow page.
They do not count towards the score — but they are among the things an owner never sees on their own.
| Check | What it looks at, and why |
|---|---|
| Tracking before consent | Do the Facebook Pixel, Google Analytics or TikTok start before the visitor answers the cookie banner? Then the banner is decoration and the GDPR fine is real. We check it on the page and with Google’s own measurement — a real browser that never presses “Accept”. |
| Payment buttons | Stripe and PayPal accept their script only from their own servers. If a speed plugin makes a copy, Apple Pay and Google Pay disappear from the shop without any message. We also look at a product page, where they load. |
They do not count towards the score. We look only at what every visitor sees and at public DNS — we do not hunt for hidden files, login pages or holes, since anyone can add someone else’s site to BeOnTop.
| Check | What it looks at, and why |
|---|---|
| Google’s list of dangerous sites | Whether Google has put the site on its list for viruses or scams (Safe Browsing). Then Chrome shows visitors a red “Dangerous site” page instead of the site. |
| Security certificate (SSL) | Whether it is valid, issued for the right address, and how many days are left before it expires. If it expires, browsers show a warning page instead of the site. |
| Certificate details | Whether its key is large enough to be safe, whether the certificate also works on the address someone might type instead (with or without www.), and whether a CAA record names the only authority allowed to issue certificates for the domain (optional). |
| Secure connection settings (TLS) | Which TLS versions the server accepts: the modern TLS 1.3 and 1.2, and whether it still accepts the old TLS 1.0/1.1 (retired in 2021). Four short connections, like a browser’s — nothing else is sent. |
| http:// sends to https:// | Does someone who types the address without “https” end up on the secure site? |
| Domain expiry | When the domain itself expires, as its registry publishes it. A domain that expires takes the site and the email with it — so a few days before, we also send an urgent email. .gr, .eu and .cy do not publish the date. |
| DNSSEC (signed DNS) | Whether the domain is signed, so that nobody can forge its DNS answers — and, above all, that the signature is not broken: then many internet providers refuse to find the site. A domain without DNSSEC is the norm and loses no points. |
| Insecure files on a secure page | Scripts, styles or images from http:// addresses — browsers block them or show “not secure”. |
| Plugins with known holes | For WordPress sites: the versions of the plugins and the theme, as they appear in the addresses of the page’s files, compared with publicly known security holes (data: Wordfence Intelligence, © Defiant Inc.). Not shown for competitors’ sites. |
| Software versions | PHP that no longer gets security fixes, WordPress that WordPress.org itself calls “insecure”, and software that is not supported at all any more (Windows/IIS older than 10, Apache 2.2, Drupal before 10, Joomla before 5). |
| JavaScript libraries | jQuery, jQuery UI, Bootstrap, AngularJS and Lodash in versions with known holes or without support — as they appear in the addresses of the page’s files. No file is opened separately. |
| Email pretending to be you | The domain’s SPF and DMARC records: without them, anyone can send email that seems to come from the business. |
| Signing your email (DKIM) | Whether the domain’s email leaves signed by a known provider (Google, Microsoft 365, SendGrid, Mailchimp and others). Gmail and Outlook trust signed email more. |
| Spam lists (blacklists) | Whether your mail server or the site’s server is on a spam list (SpamCop, PSBL, Mailspike) — then much of your email goes to junk or bounces. Only one DNS question to each list; nothing is sent to the site. |
| HSTS, protection headers, cookies | Small server settings that make the browser more careful — from cookies we read only names and flags, never their contents. |
Every finding comes with an explanation and a suggested fix. You can pass them on as they are to whoever looks after your website, or — if it runs WordPress — let BeOnTop write the missing image descriptions itself. See the guide.