Demo mode — Stripe is running on test keys, no card is ever charged.
Nightjar

The checks

Every test,
and what it costs you.

Nightjar reads what a search engine reads: the HTML your server sends, the certificate it presents, and the DNS behind it. No JavaScript is executed, nothing is installed on the site, and nothing is ever written.

Severity is blunt on purpose. critical means something is being lost right now. serious means it will cost something soon. minor means fix it when you are in there.

Between scans

These only exist because yesterday's crawl is compared with today's. They are the reason the product exists.

  • △

    critical  A measurement tag has disappeared

    GA4, Google Tag Manager, Meta Pixel, Plausible, Fathom, Matomo, Hotjar, Microsoft Clarity, LinkedIn Insight, Intercom or HubSpot was present last time and is gone now. The site looks identical. The data simply stops.

  • △

    critical  A page has just been set to noindex

    It was indexable yesterday. Within days it drops out of search results, and no tool that only checks whether the site is up will say a word.

  • △

    critical  A page now returns an error

    It answered normally on the previous scan and now gives a 4xx or 5xx.

  • △

    serious  Most of a page's text has vanished

    Word count collapsed by more than sixty per cent. Either the content was deleted or a template broke and is rendering an empty shell.

  • △

    serious  A page is no longer linked from the site

    It was reachable through the site's own navigation and now is not — a menu edit that orphaned a page nobody meant to hide.

  • △

    note  A page title changed

    Not a problem in itself. Useful when a client swears nothing was touched.

Expiry

  • ◷

    critical  TLS certificate expired or expiring

    Warned at thirty days, escalated at fourteen. An expired certificate puts a full-page browser warning in front of every visitor. Automatic renewal usually failed weeks earlier and mailed somebody who has left.

  • ◷

    critical  Domain registration expiring

    Checked against the registry over RDAP, warned at sixty and thirty days. A lapsed domain takes the site and every email address with it, and getting it back can be expensive.

  • ◷

    critical  Certificate not valid for this host

    Wrong name, broken chain, or a self-signed certificate that escaped from staging.

Search visibility

  • ⌕

    critical  robots.txt blocks the whole site

    User-agent: * with Disallow: /. The most common way a redesign removes a site from Google: the staging file shipped to production.

  • ⌕

    critical  noindex on a live page

    Checked on every page crawled, not just the home page.

  • ⌕

    serious  Canonical tag points at another domain

    Tells Google the real page lives elsewhere and hands the ranking over. Almost always a template copied from another project.

  • ⌕

    serious  Missing pages return 200 instead of 404

    Every typo looks like a real page, the index fills with duplicates, and genuinely broken links become invisible.

  • ⌕

    serious  The site answers on both www and non-www

    Two addresses serving the same pages split the ranking between them.

  • ⌕

    serious  Plain HTTP serves the site

    No redirect to HTTPS: duplicate content, and anything typed into a form travels in the clear.

  • ⌕

    serious  Sitemap missing, broken, or not valid XML

    Also checks the Sitemap: line in robots.txt.

  • ⌕

    serious  A page has almost no text

    Under forty words. Either the content is rendered by JavaScript — in which case crawlers may see nothing either — or the page is empty by accident.

  • ⌕

    minor  Titles and descriptions

    Missing title, missing meta description, titles duplicated across pages, titles long enough to be truncated in results.

Email deliverability

  • ✉

    serious  No SPF record

    Only flagged when the domain actually has MX records. Without SPF, Gmail and Outlook increasingly file the client's mail as spam, and nothing warns anybody.

  • ✉

    serious  More than one SPF record

    Two records make SPF fail outright — worse than having none. Usually the result of two different tools each adding their own.

  • ✉

    serious  No DMARC record

    Anyone can forge mail from the domain, and bulk senders now require it. A monitoring-only policy costs nothing to publish.

Breakage and hygiene

  • ✕

    critical  The site cannot be reached

    DNS failure, connection refused, timeout, or a home page returning an error.

  • ✕

    serious  Mixed content on a secure page

    Scripts or stylesheets loaded over http:// are blocked by browsers, which breaks layout or behaviour with no visible error.

  • ✕

    serious  Dead internal links

    Links on the site pointing at pages that return 4xx or 5xx.

  • ✕

    serious  Missing security headers

    HSTS, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy. Free to add, and the first thing a client's security questionnaire asks about.

  • ✕

    serious  Images with no alt text

    The most frequently cited failure in accessibility complaints. Escalates when every image on a page is missing it.

  • ✕

    minor  The small stuff

    No <h1> or several, no lang attribute, no favicon, no Open Graph tags so shared links appear bare in Slack and LinkedIn, pages over 2.5 MB of HTML, and no analytics detected anywhere at all.

Run all of it on one site, now.

No account, about ten seconds.