ShipworkSite inspection
Checks

Crawlability

PaginationAre paginated pages set up right?Internal searchIs site search eating crawl budget?URL parametersAre parameters creating duplicates?Log analyserWhat does Googlebot actually crawl?Robots builderNeed a robots.txt file?Soft 404sAre pages “not found” but returning 200?JavaScriptCan crawlers see it without running JS?FreshnessIs my site quietly going stale?Robots.txtDoes robots.txt say what I think?

Indexing

Sitemap lastmodAre my sitemap dates valid?SitemapIs my sitemap actually fetchable?IndexingIs Google allowed to index my pages?CanonicalsIs Google indexing the wrong URL?Index signalsDo sitemap and index signals agree?Sitemap generatorNeed a sitemap.xml for my site?Bulk URL statusWhere does each of these URLs really land?Redirect builderNeed the redirect rules?RedirectsAre my URLs answering directly, over HTTPS?

On-page

Keyword ideasWhat are people searching for?SERP previewHow does my page look in Google?Content qualityAre your pages too thin or too alike?Image weightAre images slowing the page?CannibalizationAre pages competing with each other?On-page checkDoes the page use its target phrase?ImagesAre my images accessible and loading?Meta tag builderWhat should my title and share tags say?DuplicatesDo my pages compete for one query?

Links

Orphan pagesWhich pages can no link reach?Link graphHow deep do your pages sit?Anchor textDo links say what they point at?Outbound linksAre external links still alive?Broken linksAre internal links sending visitors nowhere?

Structured data

Rich resultsIs my markup eligible for a rich result?Structured dataIs my product schema valid?Schema coverageDo my key pages carry structured data?Social previewHow does my page look when shared?Schema vs pageDoes markup match the page price?Schema builderNeed valid JSON-LD?

International

Hreflang sitemapDo page and sitemap hreflang agree?HreflangDo my language versions link back?Hreflang builderNeed the hreflang tags?Page DoctorWhy is this page not doing well?Redirect planMy site has dead links — what redirects do I write?Sitemap diffIs anything missing from my sitemap?Robots simulatorWhat does my robots.txt actually block?Can Googlebot?Can Googlebot fetch this URL?
Every error, explainedGuides
Pricing Learn Error guides Run free audit
Pricing Learn Error guides All checks Run a free audit

+1 free check

Welcome to Shipwork

Sign in free and your next check this month is on us.

Continue with GoogleContinue with email

We email you a 6-digit code. No password.

No card needed. Reports and watches follow you to any device.

Is the connection itself as strong as it should be?

These are the signals set once and never revisited. HSTS stops a first visit being downgraded. Preload closes the very first window. DNSSEC stops DNS spoofing. HTTP/3 is the fastest transport generally available.

Runs the Transport and HTTPS check on the address you enter, from outside your network. Nothing is stored.

What this check inspects

Shipwork reads the Strict-Transport-Security header and its directives, checks the domain against the HSTS preload status service, looks for an alt-svc header advertising HTTP/3, and queries a public DNS-over-HTTPS resolver for a DS record to determine whether DNSSEC is enabled.

What a failure means

No HSTS is a warning: a first visit can be downgraded to http. HSTS without preload or without includeSubDomains is informational, since there is still a gap. HTTP/3 not advertised and DNSSEC not enabled are informational. None of these are page-level errors, but each is a real protection left off.

How to fix it

  1. Enable HSTS with a long max-age, then add includeSubDomains once every subdomain is https.
  2. Submit the domain to the HSTS preload list once HSTS is stable.
  3. Enable DNSSEC at your registrar and at your DNS provider, and publish the DS record.
  4. Check whether your CDN or host supports HTTP/3 and turn it on where available.

A typical failure, worked through

The setupA store enables HSTS but not includeSubDomains, and a shop subdomain that only serves http is added six months later.

What the check reportsThe check reports HSTS present without includeSubDomains, and no preload. The main host is protected, but the subdomain remains a downgrade path.

The pointHSTS without includeSubDomains protects the host and nothing below it. Decide subdomain coverage deliberately rather than by omission.

Questions

What does HSTS actually prevent?
It tells the browser to use https for the domain for a set period, which closes the window where an attacker could downgrade the first request to http.
What is the HSTS preload list?
A list of domains hard-coded into browsers, so even the very first visit uses https without contacting the site over http. Inclusion is deliberately hard to reverse.
Does DNSSEC speed anything up?
No. It prevents a class of attack where a forged DNS response sends a visitor somewhere else. It is a trust measure, not a performance one.

Related checks and guides