Website Health: The Technical Foundation of Online Visibility

The certificate that expired on a Friday

A professional services firm's SSL certificate lapsed on a Friday evening. By Saturday morning, every visitor to the site saw a full-page browser warning in red: your connection is not private.

Nobody noticed until Monday, when a client emailed to ask whether the firm had been hacked.

That's website health in one story. Not a dramatic failure, not a hack, just an expiring thing that nobody was watching, costing a weekend of enquiries and a small amount of credibility that never gets measured.

Most website health problems are like this: quiet, cumulative, and invisible from the front page. This article covers the checks that catch them.

What website health actually means

Four layers, each of which can fail independently:

Reachability. The site resolves, serves, and doesn't fall over. Certificates, DNS, hosting, uptime.

Crawlability and indexability. Google can reach the pages you want indexed and isn't indexing the ones you don't.

Performance. Fast enough to be usable and to satisfy Core Web Vitals, particularly on mobile.

Trust and safety. HTTPS, current software, no mixed content, no visible "not secure" warnings, no malware.

A site can look perfect and fail at any of these. Which is why the audit is a checklist rather than an impression.

1. Uptime and certificates

Cheap to fix, embarrassing to miss.

• Uptime monitoring on the homepage and one key page. A free service pinging every few minutes and emailing you if it fails. This catches hosting incidents before customers report them.
• Certificate expiry alerts, and ideally automatic renewal. Most hosts offer it; confirm it's on rather than assuming. Expiry is the single most avoidable outage in this list.
• Domain and hosting renewals on a calendar, with the payment card current. Businesses lose their domain every year to a lapsed card on a renewal nobody owned.

2. HTTPS and mixed content

The padlock is table stakes. What breaks it is subtler: a page served over HTTPS that loads an image, script, or font over plain HTTP. Browsers call this mixed content, and depending on the type they may block it silently, leaving a missing image or a broken widget.

Check the browser console on your main pages for mixed content warnings. The fix is usually a URL in a template or a hardcoded asset path, and it takes minutes once found.

Also confirm that HTTP redirects to HTTPS in a single hop, and that www and non-www resolve to one canonical version. Two live versions of every page is a duplicate content problem you didn't ask for.

3. The staging site in the index

This one deserves its own section because it happens constantly.

Someone creates a copy of the site on a subdomain for a redesign. The copy isn't protected, robots.txt doesn't block it, and it sits there for three months while Google indexes all of it. Now the search results contain two versions of every page, and the one Google might prefer is the one with placeholder content.

The same failure appears as: a "coming soon" page left with a 200 status instead of a redirect, a noindex tag shipped to production by accident during a plugin update, or a robots.txt file blocking a folder that the redesign then made the whole site.

The monthly check: search your own site in Google with site:yourdomain.com, and see what's actually there. If you find pages you don't recognise, investigate that day.

4. Crawlability and indexation

• robots.txt should block what you intend and nothing else. A stray "Disallow: /" during a maintenance window, deployed to production, removes the entire site from search within weeks.
• Sitemap submitted once, and error-free. Check the last-read date in Search Console; stale means something broke.
• Index coverage. Confirm the pages that matter are indexed, and understand why any aren't. "Excluded by noindex" on a page you want ranking is an emergency; "discovered, currently not indexed" on a page live for a month is worth investigating.
• Canonical tags on any page reachable by more than one URL. Products with filters, blog posts with tags, pages with tracking parameters.
• Redirect chains from old URLs. Each hop loses a little equity and adds latency. Collapse chains to a single redirect, and make sure old URLs return 301s rather than soft 404s.

5. Performance, in the order that pays

Covered in more depth elsewhere, so briefly:

• Images. Compressed, correctly dimensioned, modern format. This is usually the largest single win.
• Third-party scripts. Audit and remove. Sites accumulate chat widgets, heatmaps, and pixels that nobody uses and everybody loads.
• Caching and a CDN if traffic or geography justifies it.
• Server response time under about 600 milliseconds.

Check the field data in Search Console monthly rather than chasing a Lighthouse score. Real users on real phones are the measurement that matters.

6. Software, plugins, and security

If your site runs on a CMS, this is where the real risk sits.

• Update the core, theme, and plugins monthly. Most compromises come through an outdated plugin, not a sophisticated attack.
• Delete what you're not using. An abandoned plugin is an unpatched plugin, and an inactive one is still a file on the server.
• Multi-factor authentication on every admin account, and no shared logins. If a freelancer needs access, give them their own account and remove it when the work ends. The forgotten contractor login is a classic entry point.
• Security headers. A handful of lines in the server config that prevent a range of common attacks. Worth asking your host about if you don't know.
• Backups, with a restore test. A backup nobody has restored is a hypothesis. Once a year, restore to a staging copy and confirm the site actually comes back.

7. The content-level basics that quietly cost you

• 404 pages. Links from your own site to pages that no longer exist. Crawl the site and fix internal broken links; redirect external ones where the page had value.
• Duplicate titles and descriptions across pages, which happen on category and tag pages.
• A single H1 per page that says something meaningful.
• Contact information on the site, not only in a footer image or a contact page three clicks deep.
• Forms that work. Submit your own form monthly, from a phone, and confirm the email arrives. Forms break silently when an email provider changes a setting, and enquiries disappear without trace.

How often to do this

• Weekly, automatically: uptime, form submissions, certificate alerts.
• Monthly, half an hour: updates, index coverage spot check, field data, one form test.
• Quarterly, a couple of hours: broken links, redirects, security headers, plugin audit, backup restore check.
• Annually: domain and hosting renewals, a full crawl, a look at whether the platform itself is still the right one.

Where to start

Set up uptime monitoring and certificate alerts today; they take ten minutes and prevent the two failures that are visible to every customer. Then run a site search to see what Google has actually indexed, and confirm your own contact form works from a phone.

A free digital presence audit on Webcheckhub checks website health, mobile readiness, SEO basics, and conversion readiness in one pass, which is a faster way to find the quiet problems than reading a list of possibilities. When you want the technical foundation rebuilt and monitored, Solutions Elites handles website health and technical SEO for small businesses.