The tests
Don't take our word. Test us.
Every site we deliver is held to four independent, public tools. Not our word.
Independent tools, not our word.
| Tool | What it checks | Our standard |
|---|---|---|
| Security Headerssecurityheaders.com | The security headers that block script injection and framing. | A or better |
| HTTP ObservatoryMDN (Mozilla) | Security set-up against Mozilla's guidelines, including the CSP. | A or better |
| SSL Server TestQualys SSL Labs | The HTTPS certificate and the strength of its encryption. | A+ |
| PageSpeed InsightsGoogle | Speed and the mobile experience, by Google's own measure. | 90+ on mobile |
What we check before handover.
- A static site: no server, no database
- Zero high-severity vulnerabilities, no secret keys
- WhatsApp, call and map buttons tested on the real domain
- Domain and Google in your name, locked and auto-renewing
- Sitemap submitted to Search Console
- Licensed fonts and images, sources recorded
- A copy of the code, handed to you
They measure protection, encryption and speed. They are not a penetration test.