What Is a Website Health Check (And Why Does It Matter)?

A website can pass every visual check — it loads, the layout is right, the copy reads well — and still be broken in ways nobody notices until the worst possible moment. A certificate that expires the morning of a launch. A DNS change that only half the internet has picked up. Security headers nobody ever configured. A sitemap quietly pointing search engines at pages that no longer exist. None of that shows up by loading the homepage in a browser tab — you have to check the protocol-level details directly.

A website health check is exactly that: a set of automated diagnostics that look past how a site renders and check whether the infrastructure underneath it is actually configured correctly. The four checks that matter most are TLS/SSL, DNS, HTTP security headers, and robots.txt/sitemap validity — and each one fails silently in its own particular way.

1. TLS/SSL — the certificate browsers trust

Browsers only tell you a certificate is a problem once it's already expired — there's no built-in warning three weeks out. A real check opens an actual TLS handshake and reads the certificate chain: issuer, expiry date, whether the chain is complete, which protocol version was negotiated, and which cipher suite is in use. TLS 1.0 and 1.1 are being actively deprecated by modern browsers, and a handful of cipher suites (RC4, 3DES, anything using plain MD5) are considered broken outright.

2. DNS — propagation isn't instant

When you change a DNS record, it doesn't take effect everywhere at once — different resolvers around the internet cache the old answer for different lengths of time. Querying a single resolver only tells you what that one resolver currently believes. Querying three independent resolvers at the same moment — and comparing the answers — tells you whether a change has actually finished propagating, or whether some fraction of visitors are still being routed to the old server.

3. HTTP security headers — the browser's second line of defense

Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy don't change how a site looks. They change what a browser will and won't allow if something else goes wrong — an injected script, an embedded iframe, a MIME-type confusion attack. Most sites never explicitly set any of them, which means that protection is simply off by default, not by choice.

• Strict-Transport-Security — forces HTTPS on every future visit, closing the window for downgrade attacks.
• Content-Security-Policy — restricts which scripts a page can load, limiting the blast radius of an XSS bug.
• X-Frame-Options — stops your site from being embedded in an invisible iframe for clickjacking.
• X-Content-Type-Options — stops browsers from guessing a file's type in a way that can turn an upload into executable script.
• Referrer-Policy — controls how much of your URL leaks to third-party sites via the Referer header.
• Permissions-Policy — restricts which browser features (camera, mic, location) embedded content can request.

4. robots.txt & sitemap — the crawler's-eye view

A typo in robots.txt — an accidental Disallow: / with no matching Allow rule — doesn't break the site for a human visitor. It breaks it for search engines, silently, for weeks before anyone notices organic traffic dropping. The same goes for a sitemap that still points at pages that were deleted months ago: search engines keep re-crawling dead ends instead of finding what's actually new.

A real check parses the actual rules rather than just displaying the file's text, follows every declared sitemap, and spot-checks a sample of the URLs inside for a working response — enough to catch a stale sitemap without needing to crawl the entire site.

Running all four together

Checked individually, these four things live in four different tools with four different interfaces. ForgePlug's Site Health Check runs all four in parallel against one domain and returns a single, plain-English report: a pass/warn/fail badge per panel, one combined score, and a technical-details toggle for anyone who wants the raw values. It's free, unlimited, and doesn't require an account — built for the moment a freelancer or agency needs to hand a client a clear, screenshot-ready report in under a minute.

Prefer to check just one thing?

The full report is the fastest way to get the complete picture, but each check also has its own focused page if you only need one answer right now.