Every check, and the rules behind it.
Patch runs 63 checks on every scan. Each one below explains why it matters, how Patch checks it and how to fix it. Every legal check names the official guidance it's based on and the date we last reviewed it.
Legal & privacy
Consent, privacy policies, terms and notices. Which rules apply depends on where your visitors are, so Patch looks from the UK, the EU and the US.
- Trackers load before consentMost cookie banners look fine. The question is what your site does before anyone clicks. ShipPatrol opens your site from the UK, the EU and the US and lists every…
- Trackers still load after the visitor clicks RejectA Reject button that doesn't stop anything is worse than no button at all. It tells visitors you asked and then ignored the answer. ShipPatrol clicks Reject, reloads…
- No privacy policyIf your site collects an email address, runs analytics or takes payments, it needs a privacy policy that people can find. ShipPatrol looks for one in your links,…
- No cookie bannerNot every site needs a cookie banner. Sites that use analytics, ad pixels or chat widgets usually do. ShipPatrol checks whether you need one and whether your…
- Cookie banner has no Reject button on the first screenA banner with a big Accept button and a "Settings" link that leads to forty toggles is a well-known pattern. Regulators know it too. ShipPatrol checks whether Reject…
- Privacy policy doesn't mention services the site usesPlenty of sites have a privacy policy. Fewer have one that matches what the site actually does. ShipPatrol compares the services your pages talk to with the ones…
- Signup form has no privacy noticeThe moment someone types their email address is the moment the law expects you to tell them what happens to it. ShipPatrol checks the forms on your site for a…
- Subscription sold without clear renewal and cancellation termsSelling a subscription means telling people, before they pay, that it renews, how much it costs and how to cancel. ShipPatrol reads your pricing page for that…
- No terms of serviceIf people sign up, pay or rely on your service, terms set out the deal: what you provide, what they can't do, refunds and how the account ends. ShipPatrol looks for them.
- No contact for data requestsPeople have the right to ask what data you hold about them, or to have it deleted. They need somewhere to send that request. ShipPatrol checks your policy gives them one.
- Privacy policy doesn't explain people's rightsA privacy policy is supposed to tell people what they can do: see their data, correct it, delete it, object and complain. ShipPatrol checks yours mentions those rights.
- No "Do Not Sell or Share" option for US visitorsIf ad pixels on your site share visitors' data for targeted advertising, California expects you to offer an opt-out. ShipPatrol looks for the link and checks which…
- No ImpressumGerman law requires most commercial websites run from Germany to publish an Impressum: who runs the site and how to reach them quickly. ShipPatrol looks for one.
- Google Fonts loaded from Google's serversLoading fonts from fonts.googleapis.com sends every visitor's IP address to Google before they have agreed to anything. ShipPatrol checks whether your fonts load…
- Site may collect children's data without the extra protectionsSites aimed at children, or that know children use them, have extra rules: parental consent in the US, age-appropriate design in the UK, and age limits for consent…
Security
Keys in your JavaScript, open database rules, missing headers. The things that work fine right up until someone else notices them.
- Secret API key in your JavaScriptAI site builders make it very easy to paste an API key straight into the front end. Anything in your JavaScript can be read by anyone who visits. ShipPatrol scans…
- Supabase tables readable with the public keySupabase's public anon key is meant to be public. What protects your data is row-level security. If it's off, anyone with the key, which is everyone, can read the…
- Firebase data readable without signing inFirebase projects often start in "test mode", with rules that let anyone read everything, and some never leave it. ShipPatrol checks your Realtime Database, common…
- Configuration files can be downloadedA .env file or a .git folder left on the web server is a gift to attackers: database passwords, API keys, sometimes your whole source code. ShipPatrol checks, on…
- HTTPS is not enforcedYour site has a certificate. The question is whether someone typing your address without https:// ends up on the secure version. ShipPatrol checks the plain http://…
- API accepts credentialed requests from any websiteCORS headers decide which other websites can read responses from your API. Reflecting any origin while allowing credentials lets a malicious page read your signed-in…
- JavaScript libraries with known vulnerabilitiesOld versions of popular libraries carry published vulnerabilities that anyone can look up. ShipPatrol detects library versions in your pages and checks them against…
- Software with a vulnerability attackers are already usingSome vulnerabilities are theoretical. The ones on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list are not: someone has…
- Software with known vulnerabilitiesEvery library your site loads has a version, and many old versions have published security advisories. ShipPatrol works out which versions you run and checks them…
- No Content-Security-Policy headerA Content-Security-Policy tells the browser which scripts and resources your page is allowed to load. It's the main defence against cross-site scripting. ShipPatrol…
- No HSTS headerHSTS tells browsers to only ever use HTTPS for your site, even if someone types http://. ShipPatrol checks your headers for it.
- Site can be embedded by other websitesIf any website can load yours in an invisible frame, it can trick your visitors into clicking things they can't see. ShipPatrol checks for the headers that stop it.
- Secure pages load insecure resourcesAn HTTPS page that loads scripts, images or styles over plain http is only partly secure, and browsers block or flag some of it. ShipPatrol lists what's still on http.
- Source maps are publicSource maps turn your minified JavaScript back into the original code, comments and all. Handy in development, generous in production. ShipPatrol checks whether…
- Content-Security-Policy allows inline scriptsHaving a CSP is good. A CSP that allows 'unsafe-inline' scripts blocks a lot less than it looks like it does. ShipPatrol reads your policy.
- Cookies without security flagsCookies have three flags that cost nothing: Secure, HttpOnly and SameSite. ShipPatrol checks the cookies your own site sets.
- No X-Content-Type-Options headerX-Content-Type-Options: nosniff stops browsers from guessing a file's type, which closes a small but real class of attacks. ShipPatrol checks for it.
- No Referrer-Policy headerWhen a visitor clicks a link away from your site, the browser tells the destination where they came from. Referrer-Policy decides how much it says. ShipPatrol checks…
- No Permissions-Policy headerPermissions-Policy lets you switch off browser features your site never uses, such as the camera, microphone and location, so no embedded script can ask for them.…
- Server announces its software versionHeaders like "Server: Apache/2.4.29" or "X-Powered-By: PHP/7.2" tell everyone exactly which version you run. ShipPatrol checks your headers.
- Forms have no visible bot protectionPublic forms attract bots: fake signups, contact-form spam and email bombing that gets your sending domain blocklisted. ShipPatrol looks for bot protection on your forms.
SEO
Whether search engines and link previews can see your pages, and whether each page says what it is.
- Homepage tells search engines not to index itOne meta tag or header can keep your site out of Google entirely. It's often left over from a staging setup. ShipPatrol checks your homepage for noindex.
- robots.txt blocks all crawlersA robots.txt with "Disallow: /" asks every crawler to stay away. Sometimes that's the plan. Often it's a leftover. ShipPatrol reads yours.
- Pages are blank without JavaScriptSites built as single-page apps often send an empty page and build everything in the browser. People see a website. Many crawlers and link previews see nothing.…
- Pages with missing or duplicate titlesThe title tag is usually what shows as the blue link in search results. Every page needs its own. ShipPatrol checks every page it crawls.
- Pages with missing or duplicate meta descriptionsThe meta description is your pitch under the link in search results. Google doesn't always use it, but when it's missing it has to improvise. ShipPatrol checks every…
- No sitemap.xmlA sitemap lists the pages you want search engines to find. Small sites can get by without one, but it's an easy win. ShipPatrol looks for yours.
- No social preview imageWhen someone shares your link on LinkedIn, Slack, WhatsApp or X, the preview comes from Open Graph tags. Without them you get a bare URL. ShipPatrol checks your homepage.
- Pages with no main headingEvery page should open with a main heading that says what it's about. ShipPatrol checks the pages it crawls for one.
- No canonical URLsThe same page can often be reached at several addresses: with and without www, with tracking parameters, with a trailing slash. A canonical tag says which one…
- No robots.txtrobots.txt is the first file most crawlers ask for. You don't strictly need one, but it's where you point them to your sitemap. ShipPatrol checks it's there.
- Broken internal linksLinks that lead nowhere frustrate visitors and waste crawlers' time. ShipPatrol checks the internal links on the pages it crawls.
- Missing pages don't return a 404Ask for a page that doesn't exist and your server should say so with a 404 status. Many single-page apps answer "200 OK" with the homepage instead. ShipPatrol checks.
- Slow to show the main contentLargest Contentful Paint measures how long it takes for the main thing on the page to appear. Google suggests 2.5 seconds or less. ShipPatrol measures it in a real…
- Images are heavy or have no dimensionsLarge images are the most common reason a page is slow, and images without width and height make the page jump around while it loads. ShipPatrol checks both.
- No structured dataStructured data tells search engines what your page is: an organisation, a product, an article, a local business. It can unlock richer results. ShipPatrol looks for it.
- No faviconThe favicon is the little icon in browser tabs and next to your site in Google's mobile results. ShipPatrol checks you have one.
- Page language not declaredThe lang attribute on the <html> tag says which language your page is in. ShipPatrol checks it's set.
Accessibility
The basics that let everyone use your site, including people using screen readers or a keyboard.
- Form fields without labelsA form field needs a label that assistive technology can read, not just placeholder text that disappears when you type. ShipPatrol checks your forms with axe.
- Images without alt textAlt text describes an image for people who can't see it, and for search engines. ShipPatrol checks your pages with axe.
- Text contrast too lowLight grey on white looks elegant in a design tool and disappears on a phone in sunlight. ShipPatrol checks text contrast with axe.
- Buttons with no accessible nameAn icon-only button (a hamburger, a cross, an arrow) looks obvious and sounds like "button" to a screen reader. ShipPatrol checks with axe.
- Links with no accessible nameLinks with only an icon or an image and no text are announced as just "link". ShipPatrol checks with axe.
- Page language not setScreen readers use the page language to pick a voice and pronunciation. ShipPatrol checks the <html> tag says which language you're using.
- Pages without a titleThe page title is the first thing a screen reader announces and what people see in their tabs. ShipPatrol checks every page has one.
- Headings skip levelsHeadings work like a table of contents. Jumping from H1 to H4 leaves gaps in it. ShipPatrol checks heading order with axe.
- Content outside page landmarksLandmarks (header, nav, main, footer) let assistive technology jump straight to the part of the page you want. ShipPatrol checks with axe.
- Other accessibility issuesShipPatrol runs axe-core, the open-source accessibility engine used by many testing tools, on your homepage and two more pages, and explains what it finds in plain…
Severity shown is the usual one. Your report can rate a finding higher or lower depending on what Patch finds and where your visitors are. ShipPatrol is not legal advice.
Free scan
See what Patch finds on your site.
Free, no signup. You get a score, every issue with its severity, and full detail on the top three.