Questions

Automated tools find a minority of accessibility issues. Which ones they catch reliably, which they cannot, and what a clean report means.

Overlays are a script that adjusts a page at runtime. What they can and cannot change, and why the accessibility community opposes them.

The checks that are cheap before launch and expensive afterwards, in the order that matters: reachability, indexing, HTTPS, then everything else.

A launch, a sale or a press mention sends many times the usual traffic. What to verify beforehand so the peak is served from cache rather than from your origin.

No search engine publishes one. Why the number keeps being repeated, what actually correlates, and when a short page is the right answer.

A score is a weighting choice, not a measurement. What actually differs between tools, and which parts of a report are comparable.

A report with 300 findings needs an order, not a checklist. The four questions that sort them, and why severity alone is the wrong sort key.

Cadence should follow change, not the calendar. What to check on every deploy, what monthly, what quarterly, and what only on events.

Public web archives hold captures of most sites going back years. What they can and cannot tell you, and why an archived page is not the page.

Taking over a site from a previous team, agency or owner: who controls the domain, the DNS, the mail and the certificates, and what else is quietly attached to it.

Beyond the checks every site needs: the checkout on a phone, product data that agrees with what the page shows, tracking that respects consent, and order emails that arrive.

How to retrieve a domain's SPF record, count its DNS lookups, and recognise the two failures that break it silently.

How to retrieve a DMARC record, what each tag means, and why p=none provides visibility rather than protection.

Mail delivered to the junk folder has passed the server and failed the filter. The authentication checks to settle first, and the causes an external check cannot see.

A newsletter tool, a help desk or a billing system that sends as your domain. The records to change, the limit it can push you over, and the order that avoids losing mail.

Bounce messages for mail you did not send mean someone used your domain as the sender. How to tell forgery from a compromised account, and what actually stops it.

The wrong keyboard, no autofill, a page that zooms on every field, targets too small to tap. The markup behind each, and why most are one attribute to fix.

Not verifiable means a check ran and could not establish an answer from outside. Why that is different from a pass, and why a report that never says it is lying.

A scan reaches a bounded number of pages and resources. Why coverage is reported rather than implied, and how to read a clean result against it.

A score compresses many weighted findings into one number. Why the last few points cost the most and buy the least, and what to optimise instead.

A comparison between two scans shows what appeared, what was resolved and what stayed. Why it is more useful than either scan alone, and what makes one misleading.

Analytics counts browsers that ran a script and consented; logs count every request that reached the server. Why the two never match, and which gap means something is broken.

What can honestly be assessed without access to the server — transport, headers, exposed files, cookies — and what requires a real security engagement.

The technical checks that determine whether a site can be crawled, indexed and understood — in the order that matters, with the manual method for each.

robots.txt is the wrong tool for this and makes it worse. What actually keeps a staging environment out of search results, and how to verify it.

Rule out measurement, then availability, then indexing, then everything else. The order matters because each step is cheaper than the one after it.

No single source lists every page. Combining the crawl, the sitemap, the content system, server logs and analytics, and what the differences between them reveal.

Valid structured data makes a rich result possible, never certain. The six reasons eligible markup produces an ordinary blue link.

Structured data helps where a page has facts worth stating. Where it adds nothing, where it creates risk, and what to mark up first.

A certificate that validates in one client and not another is almost always an incomplete chain. Why browsers hide the fault and other clients do not.

Automated renewal fails silently weeks before the expiry it causes. The five things that break it, and why nobody notices until the last day.

HSTS cannot be recalled from browsers that stored it. The checks that matter before committing, and why to start with a short max-age.

A site with a valid certificate can still be marked not secure. The four causes — the page loaded over HTTP, mixed content, an insecure form, a certificate fault — and how to tell them apart.