Your result
Eight verdicts in ten seconds: HTTPS, PHP, WordPress, e-mails, phone display, title and description, legal notice, signs of an ageing website.
Would you rather I look myself, for free, within 24 hours?
Get my written opinion Also check the cookies and trackers: is my website GDPR compliant?Website looking dated? Showcase website redesign from €1,500. A clear, fast website, well ranked on Google, built on up-to-date tools and easy to edit yourself. Free fixed-price quote, reply within 24 hours.
Talk about my website redesignNo legal notice on your website yet? The generator writes the legal notice and the privacy policy of a website run in France from your answers, for your status (sole trader, company, association, regulated profession), with your hosting provider’s address already filled in.
Generate my legal notice: free, no e-mailA free online website test: enter the address of your website and the tool runs eight checks in ten seconds. A showcase website ages without warning: a missing certificate, a PHP version without its fix, a closed WordPress extension, e-mails landing in spam, a page that displays badly on a phone, a footer still saying 2019. This tool reads the home page of your website as a visitor would and answers eight questions, each with a verdict, what it means and what to do. The three most technical points (PHP, WordPress, e-mails) link to a detailed checker. Built for French businesses, it works on any public website.
Tool built by Léo Guillaume, freelance developer near Rennes, France. I update, secure and rebuild showcase websites for small businesses, remotely, and I reply within 24 hours.
Updated on
What the tool checks
Nothing is scanned: one page, a few public files for WordPress and the DNS records of the domain. Here is what each point looks at, and why it matters.
Is the website served over HTTPS, and does the http address redirect to the secure version? Without that, browsers show "not secure" and Google ranks the page lower.
Did the PHP version announced by the server receive the fix for the vulnerabilities of 21 October 2026? Same verdict as the PHP checker, with a link to it.
If the website is a WordPress: core up to date, closed or vulnerable extensions, signs of injection. Otherwise, the point does not apply.
SPF record, DKIM key and DMARC policy of the domain, read in the DNS. Without the three, e-mails sent in your name land in spam at Orange, Gmail and Outlook.
Is the viewport tag declared? Without it, a phone displays the page like a shrunken desktop screen.
Does the home page have a title and a description, of reasonable length? They are the two lines of your Google result.
Is a link to a legal notice page present? The French law on confidence in the digital economy requires one on every business website.
Copyright year before 2024, jQuery 1 or 2, Flash, abandoned generator: the signs a visitor and Google read as "nobody looks after this any more".
Method
The same gesture as a visitor, plus three checkers I had already written for the PHP vulnerabilities, hacked WordPress sites and e-mails in spam.
The server reads the home page over HTTPS then http, follows redirections to public addresses and stops at the first 400 KB. Internal and private addresses are refused.
Viewport, title, description, footer links, copyright year, loaded libraries, generator tag: everything comes from the code of the page, nothing is guessed.
The three existing checkers run with their own rules; their verdict is brought back to four levels. The WordPress point only runs when the page shows WordPress markers.
A critical point puts the website "at risk", a point to watch puts it "to review", otherwise "nothing urgent". Each line says what it means and what to do. The result is cached for ten minutes, nothing else is stored.
Your website has aged and you wonder what a new one costs? The barometer compiles the prices displayed by twenty French freelancers, agencies, website builders and price guides, recorded the same day, with the medians by website size.
See website prices in France in 2026Frequently asked questions
Three signs can be read from outside: the PHP version announced by the server, the version of WordPress and its extensions, and the libraries loaded by the page (jQuery, for instance). The tool reads them in ten seconds. For the rest (theme, extensions not visible), log in to the dashboard of your site: pending updates are listed there.
Enter the address of your website in the field at the top of this page: the test reads the home page in ten seconds and answers eight questions (HTTPS, PHP, WordPress, e-mails, phone display, title, legal notice, signs of age), each with a verdict and what to do. Nothing to install, no sign-up, and the result can be e-mailed to you.
From outside, one can check HTTPS, the PHP fix, the WordPress extensions known for a vulnerability and the signs of hacking on the home page. That is what the tool does. It does not replace an audit: it says whether your website shows the vulnerabilities most exploited in 2026, the ones that took French government websites offline in October.
The most frequent causes are in the test: no HTTPS, no title or a title that says neither the trade nor the town, no description, a page unreadable on a phone, a website Google reads as abandoned. If everything is green, the cause is elsewhere: too few pages, no Google Business listing, or a website too recent.
Eight points: HTTPS and redirection, PHP version and the October 2026 fix, WordPress up to date and closed extensions, SPF, DKIM and DMARC of the domain, viewport tag, title and description of the home page, link to the legal notice, and signs of an ageing website (copyright before 2024, jQuery 1 or 2, Flash, abandoned generator).
Yes, and it is the simplest point to fix. Without HTTPS, Chrome and Safari show "not secure" next to your address, which your visitors read as "dubious site", and Google has favoured secure sites since 2014. The certificate is free at almost every host (Let's Encrypt) and takes a few clicks to enable.
Yes. The French law on confidence in the digital economy (2004) requires every business website to show the identity of the publisher, its address, its registration number and the name of the host. The fine can reach €75,000 for an individual. One page and a link in the footer are enough.
Yes, for statistics only: the address of the website tested and its verdicts are kept for twelve months, to measure for example the share of websites without HTTPS. They are never used to prospect and never published website by website. The address is not sent to PostHog, the analytics tool of the site. Your e-mail is only asked if you want to receive the result; it is only kept if you agree to be contacted.
One or two red points are fixed in an hour at the host. When the website piles up several signs of age (no viewport, jQuery 1, 2018 copyright, PHP without its fix), rebuilding it often costs less than patching it: a custom showcase website starts at €1,500 with me, and this page's barometer gives the market prices in France.
Blog
The guides that detail the PHP update, the checks of a WordPress site and what a website must do for a tradesperson.
After December 31, 2026, PHP 8.2 will no longer receive security patches. Verified dates from php.net, recommended versions from 8 hosting providers, and 4 steps to migrate.
Since October 18, 2026, stolen UpdraftCentral keys have been used to install fake plugins and hidden accounts on WordPress sites—even those kept up to date. Here are the seven checks to perform today, in the exact order I follow them on a client’s site.
OVHcloud web hosting: Where to find your PHP version, how to switch to 8.3 or 8.4 from the customer portal or the .ovhconfig file, which version to select, and what OVH announced on October 21st.
At o2switch, the default cPanel PHP version is 8.1, which no longer receives official patches. Where to navigate to switch to 8.3 or 8.4, which version to choose, and what o2switch did on October 21st.
Discover how to optimize your website to attract more local customers and grow your artisan business in Rennes.
Send me the address. I reply within 24 hours with a written, free opinion: what is urgent, what can wait, and a firm price if you want me to take care of it.