Skip to main content

Is your website working for everyone? Get a free wellness check.

A free health scan for your nonprofit's website: uptime, SSL, and Google PageSpeed for mobile and desktop. Results by email, usually within a few minutes. Claim a free TappHQ account to add seven deeper checks.

4
Instant checks
11
Scan dimensions
1
Email with your results
$0
Cost to run

What we check instantly

Four scans run automatically against the URL you submit. No account, no setup, results by email, usually within a few minutes. Want the full picture? A free account adds seven more checks.

Uptime

We request your URL and record status, response time, and DNS, TCP, and TLS timings. Anything other than a 2xx flags your site as down.

SSL validity

Your certificate issuer and the days remaining before it expires. We flag anything under 30 days so you can renew on time.

Mobile PageSpeed

Google PageSpeed Insights scores Core Web Vitals on a real mobile browser, with real-user field data when available, plus Google Lighthouse's accessibility score.

Desktop PageSpeed

The same PageSpeed run for desktop, where your board and funders usually view the site. The two scores often diverge.

Go deeper, free with a TappHQ account

Claim a free account and your site runs a deeper health scan across seven more dimensions. Each runs once on the free tier. No credit card, no paid upgrade required to see your full report.

Accessibility (WCAG 2.2) Free account

The full automated scan against WCAG 2.2 criteria, queued automatically when you claim your free account. Violations graded by severity and mapped to the criteria they break. Increasingly required for grants and by law.

SEO & discoverability Free account

Titles, meta descriptions, headings, broken links, image alt text, sitemap, structured data, and social preview tags. What decides whether supporters find you.

Security headers & TLS Free account

Full SSL chain, TLS versions, HSTS, and the six browser security headers that block common attacks.

DNS & email auth Free account

SPF, DMARC, MX, DNSSEC, CAA, and domain expiration. Misconfigured email auth is the silent reason appeals land in spam.

Technology stack Free account

Detects the CMS, frameworks, analytics, and plugins on your site, so outdated or risky dependencies surface.

Homepage screenshot Free account

A captured render of your homepage attached to the report, giving every finding visual context for your board.

Composite health score Free account

One 0 to 100 grade rolling every category into a single number to track over time and share with funders.

Recurring re-scans, historical trends, and AI-generated remediation steps come with continued monitoring on paid tiers. The deeper one-time scan above is free.

Run your free wellness check

No credit card required. Submit your URL and we will email your wellness report as soon as the scans finish, usually within a few minutes. One email, no password needed to view it.

Prefer to skip the form? Create a free account to run your check from the dashboard.

Public check vs. deeper scan

What the free public scan produces, and what claiming a free account adds.

Public Check (no account)

  • Single scan run on submission
  • Uptime + SSL validity
  • Mobile + desktop PageSpeed
  • Lighthouse accessibility score
  • One email with your results; view the report with no password
  • Plain-language summary for board + staff

Deeper Scan (free account)

  • Everything in the public check, plus:
  • Full WCAG 2.2 accessibility scan, queued when you claim
  • SEO & discoverability audit
  • Security headers & TLS
  • DNS & email authentication (SPF / DMARC)
  • Technology stack + homepage screenshot
  • Composite 0 to 100 health score

The deeper scan runs once, free, on a claimed account. Paid tiers add automated recurring scans, historical trends, AI remediation steps, downtime alerts, and multi-site coverage. See SiteHQ for the full platform.

Why website health matters for nonprofits

Your website is where donors give, where participants find services, and where funders read your story before a decision. When it is slow, broken, or down, the cost is measured in lost gifts and lost trust. Website health also decays quietly: a new plugin, an expired certificate, or a stray redirect rarely announces itself.

Is the site even up?

Most small nonprofits learn their site is down only when someone phones in. An uptime baseline tells you in real time.

Fast enough to hold a donor?

Mobile visitors leave sites that take more than three seconds to load. A PageSpeed score shows if your donate page is in the running.

Is the certificate current?

An expired SSL cert shows visitors a full-page browser warning, and most leave at once. We flag it 30 days early so you renew calmly.

Does mobile match desktop?

Staff test on desktop; donors and event-goers arrive on mobile. When the scores diverge, desk testing has been misleading you.

What to check on a nonprofit website

A nonprofit website has three jobs: take a gift, point someone at a service, and convince a funder who reads it before a meeting. Every check below is a way one of those jobs quietly fails. None of them requires a developer to read the result.

Start with the four that fail loudest

  • Is it up? Request the homepage and read the status code and response time. Anything other than a 2xx response is a down site, whatever the page looks like on your own machine.
  • Is the certificate valid? An expired SSL certificate replaces your site with a browser warning. Check the issuer and the days remaining, and renew when it drops under 30.
  • How fast is it on a phone? Run Google PageSpeed for mobile. Donors and event-goers arrive from a phone, and the score there is usually lower than on desktop.
  • How fast is it on desktop? Run the same test for desktop, where staff and funders read it. When the two diverge, desk testing has been hiding the mobile problem.

Then the seven that fail quietly

  • Accessibility. An automated WCAG 2.2 scan finds missing alt text, low contrast, and unlabeled form fields that keep some visitors from donating at all.
  • Search basics. Titles, meta descriptions, headings, broken links, sitemap, structured data, and social preview tags decide whether a supporter finds you.
  • Security headers and TLS. The handful of browser headers that block common attacks, plus which TLS versions the server still accepts.
  • DNS and email authentication. SPF, DMARC, MX, DNSSEC, CAA, and domain expiration. Misconfigured email authentication is the silent reason appeals land in spam.
  • Technology stack. Which CMS, plugins, frameworks, and analytics are running, so an outdated dependency is visible before it is exploited.
  • A homepage screenshot. So a board member can see what each finding refers to.
  • A single 0 to 100 score. One number that rolls the categories together and can be tracked over time.

How often

Uptime is worth checking continuously. The others change when the site changes, so re-run them after a redesign, a plugin update, or a new donate form, and on a schedule if nobody is watching.

Frequently asked questions

Already have a TappHQ account?

Sign in and open SiteHQ to add your site to ongoing monitoring. You get 5-minute uptime checks, the full deeper scan, and a composite health score to track over time.