What Vigilo checks

50+ technical checks in eight categories. Each one is tied to a published standard or guideline, and tells you exactly how to fix it.

55 checks in total: 32 run in the free scan, 23 more in the deep audit included in Report and Monitor.

HDR

Security headers

Is your site's front door locked?

HTTPS, security headers and a security contact — the basics every browser looks for.

Relevant to: GDPR Art. 32 (security of processing), NIS2 good practice, OWASP Secure Headers. · Category weight 15

ID	What we check	Weight	Runs in
hdr.https_redirect	HTTP redirects to HTTPShttp:// redirects to https:// (≤2 hops)	Critical	Free scan
hdr.hsts	Strict-Transport-Security (HSTS)Strict-Transport-Security present, max-age ≥ 15552000	Important	Free scan
hdr.csp	Content-Security-PolicyContent-Security-Policy present and not only */unsafe-inline everywhere	Important	Free scan
hdr.x_content_type_options	X-Content-Type-OptionsX-Content-Type-Options: nosniff	Minor	Free scan
hdr.frame_ancestors	Clickjacking protectionCSP frame-ancestors or X-Frame-Options	Minor	Free scan
hdr.referrer_policy	Referrer-PolicyReferrer-Policy is strict-origin-when-cross-origin or stricter	Minor	Free scan
hdr.security_txt	security.txt/.well-known/security.txt exists with Contact: and valid Expires:	Minor	Free scan
hdr.server_disclosure	Server version disclosureServer/X-Powered-By reveals versions	Info only	Free scan
hdr.tls_cert_expiry	TLS certificate validityCertificate valid > 14 days	Critical	Deep audit

MAIL

Email authentication

Can anyone send email as you?

SPF, DKIM and DMARC decide whether mail "from" your domain is trusted — and whether fakes are blocked.

Relevant to: Google & Yahoo bulk-sender requirements (2024), Microsoft Outlook.com sender requirements (May 2025), internet.nl / Forum Standaardisatie standards. · Category weight 15

ID	What we check	Weight	Runs in
mail.mx	Mail servers (MX)Domain has MX records	Info only	Free scan
mail.spf_present	SPF recordExactly one v=spf1 TXT record	Important	Free scan
mail.spf_lookups	SPF lookups and endingSPF resolves within 10 DNS lookups, ends -all or ~all	Important	Free scan
mail.dmarc_present	DMARC record_dmarc TXT with v=DMARC1	Critical	Free scan
mail.dmarc_policy	DMARC policy strengthp=quarantine or p=reject, pct 100	Important	Free scan
mail.dmarc_rua	DMARC reporting addressrua= reporting address present	Minor	Free scan
mail.dkim_selector	DKIM keyDKIM key found on common selectors: default, google, selector1, selector2, k1, mail, dkim, s1, s2, mxvault	Important	Free scan
mail.mta_sts	MTA-STSMTA-STS policy published	Minor	Deep audit

TRK

Trackers & fonts before consent

What loads before visitors say yes?

Analytics, ad pixels and Google Fonts that load before a visitor has agreed.

Relevant to: GDPR / ePrivacy (Dutch Telecommunications Act art. 11.7a); the Dutch DPA (AP) checks around 10,000 websites a year for cookie consent. A German court (LG München I, 2022) addressed Google Fonts loaded from Google’s servers. · Category weight 20

ID	What we check	Weight	Runs in
trk.scripts_static	Tracking scripts before consentKnown tracker hosts in static HTML <script src> not gated by a CMP type="text/plain" pattern	Critical	Free scan
trk.google_fonts	Google Fonts loaded from GoogleLinks to fonts.googleapis.com / fonts.gstatic.com	Important	Free scan
trk.cookies_first_response	Tracking cookies on first responseNon-essential cookies in Set-Cookie of the first HTML response (matches _ga, _fbp, _gcl_*, …)	Important	Free scan
trk.third_party_hosts	Third-party hosts referencedCount of distinct third-party hosts referenced in HTML	Info only	Free scan
trk.requests_before_consent	Tracker requests before consent (real browser)Real browser: network requests to tracker hosts before any consent interaction	Critical	Deep audit
trk.non_eea_transfers	Pre-consent transfers outside the EEADestinations of pre-consent requests located outside the EEA	Important	Deep audit

CNS

Cookie banner

Can visitors say no as easily as yes?

Whether a banner appears when needed, offers "Reject" as easily as "Accept", and is respected.

Relevant to: GDPR / ePrivacy; EDPB Cookie Banner Taskforce report (2023); AP guidance on cookie banners. · Category weight 15

ID	What we check	Weight	Runs in
cmp.vendor_detected	Consent tool detectedKnown CMP script (Cookiebot, OneTrust, Complianz, CookieYes, Usercentrics, Iubenda, Didomi, Borlabs, Termly, Cookie Information)	Info only	Free scan
cmp.policy_link	Cookie / privacy policy linkLink with text/href matching cookie(s) / cookiebeleid / privacy	Minor	Free scan
cmp.banner_visible	Banner shown when neededBanner visible on first load (only required when non-essential cookies/trackers are present)	Important	Deep audit
cmp.reject_first_layer	"Reject" on the first layer"Reject" option on first layer, comparable prominence to "Accept"	Critical	Deep audit
cmp.no_prechecked	No pre-ticked purposesNo pre-ticked non-essential purposes	Important	Deep audit
cmp.reject_respected	Reject is respectedAfter clicking reject: no tracker requests, no tracking cookies	Critical	Deep audit

A11Y

Accessibility statement & signals

Can everyone use your site?

An accessibility statement plus basic signals that people using assistive technology can use your site.

Relevant to: European Accessibility Act (Directive (EU) 2019/882, applies since 28 Jun 2025; micro-enterprises providing services (<10 staff and ≤€2M turnover or balance sheet) are exempt), EN 301 549 / WCAG; ACM supervises in the Netherlands. · Category weight 15

ID	What we check	Weight	Runs in
a11y.statement_link	Accessibility statement linkLink to an accessibility statement (toegankelijkheid / accessibility / toegankelijkheidsverklaring)	Important	Free scan
a11y.html_lang	Page language<html lang> set and valid BCP-47	Important	Free scan
a11y.img_alt	Images without alt text<img> without alt attribute on homepage	Important	Free scan
a11y.viewport_zoom	Zoom not blockedViewport meta present and does not block zoom (user-scalable=no, maximum-scale<2)	Important	Free scan
a11y.title	Page titleNon-empty <title>	Minor	Free scan
a11y.form_labels	Form fields without labelsInputs without label, aria-label or aria-labelledby on homepage	Minor	Free scan
a11y.statement_content	Accessibility statement contentsStatement contains: conformance status, known issues, contact/feedback route, date, enforcement/complaint route	Important	Deep audit
a11y.automated_violations	Automated accessibility rules (axe-core)axe-core WCAG 2.2 A/AA automated rules across crawled pages	Critical	Deep audit

Automated tools find only part of accessibility issues (estimates range from about 30% to 57%). A full WCAG-EM audit needs human testing.

SHOP

Webshop consumer law

Does your checkout tell buyers what it must?

The information EU consumer law asks webshops to show: who you are, withdrawal rights, prices and terms.

Relevant to: EU Consumer Rights Directive 2011/83/EU (incl. the online withdrawal function added by Directive (EU) 2023/2673, which Member States must apply from 19 June 2026), Dutch Civil Code book 6/7; ACM supervises. · Category weight 10

ID	What we check	Weight	Runs in
shop.detected	Webshop detectedPlatform signature (Shopify, WooCommerce, Magento, Lightspeed, CCV Shop, Shopware, PrestaShop) or cart/checkout links	Info only	Free scan
shop.company_identity	Company identityCompany name, geographic address, email, KvK number, VAT id findable	Important	Deep audit
shop.withdrawal_info	14-day withdrawal information14-day right of withdrawal explained, model form available	Critical	Deep audit
shop.withdrawal_function	Online withdrawal functionOnline "withdraw from contract" function/link reachable	Important	Deep audit
shop.price_display	Prices incl. VAT and delivery costsPrices incl. VAT, delivery costs shown before checkout	Important	Deep audit
shop.terms_link	General terms reachableGeneral terms reachable before purchase	Minor	Deep audit
shop.odr_link_outdated	Outdated ODR platform linkLink to the EU ODR platform (discontinued July 2025) still present	Info only	Deep audit

CWV

Performance

How fast does it feel?

Server response, page weight and Core Web Vitals.

Relevant to: no legal requirement; Google Search page-experience signals; user experience. · Category weight 5

ID	What we check	Weight	Runs in
perf.ttfb	Time to first byteTime to first byte from our edge	Minor	Free scan
perf.html_weight	HTML document sizeHTML document size	Minor	Free scan
perf.compression	CompressionContent-Encoding br/gzip	Minor	Free scan
perf.lcp	Largest Contentful PaintLargest Contentful Paint (field data if available, else lab)	Important	Deep audit
perf.inp	Interaction to Next PaintInteraction to Next Paint	Important	Deep audit
perf.cls	Cumulative Layout ShiftCumulative Layout Shift	Important	Deep audit

LNK

Broken links

Do your links go somewhere?

Homepage availability, broken internal and external links and reachable legal pages.

Relevant to: no legal requirement; legal pages (privacy, terms, imprint) must be reachable for the notices on them to work. · Category weight 5

ID	What we check	Weight	Runs in
link.homepage_status	Homepage reachableHomepage returns 2xx	Critical	Free scan
link.internal_broken	Broken internal linksInternal links returning 4xx/5xx	Important	Deep audit
link.external_broken	Broken external linksExternal links returning 4xx/5xx/DNS error	Minor	Deep audit
link.legal_pages	Legal pages reachablePrivacy, terms, imprint/contact pages reachable (2xx)	Important	Deep audit
link.redirect_chains	Redirect chainsInternal links with ≥3 redirect hops	Minor	Deep audit

How the score works

Every check ends in one of five results: Pass (1 point), Warning (half a point), Fail (no points), Info (an observation, not scored) or Not checked (not part of this scan type, or it timed out).

Each check has a weight: 3 for critical, 2 for important, 1 for minor. A category’s score is the weighted share of points it earned, from 0 to 100.

The overall score is the weighted mean of the category scores. Categories that don’t apply, such as Webshop consumer law on a site without a shop, are left out and the other weights are scaled up.

Critical cap: if any critical check fails, the grade is capped at C, whatever the score. The result says “Grade capped: critical issue”.

The free scan shows a quick score, based on the checks it could run (for example “based on 32 of 55 checks”).

Grade bands
Grade	Score	Means
A	90 and up	In good shape
B	80 to 89	In good shape
C	70 to 79	Some things need fixing
D	60 to 69	Some things need fixing
E	50 to 59	Several urgent issues
F	below 50	Several urgent issues

Category weights
Category	Weight
Security headers	15
Email authentication	15
Trackers & fonts before consent	20
Cookie banner	15
Accessibility statement & signals	15
Webshop consumer law	10
Performance	5
Broken links	5

Limits

Automated checks are a strong first filter, not the final word. Accessibility tools catch only part of the issues (estimates range from about 30% to 57%); a cookie banner can look right and still be configured wrong for some visitors. That’s why Reports include human review and why we never call a site “compliant”.

Technical observations against published standards. Not a legal assessment of compliance; doesn't replace a lawyer or a full WCAG-EM audit.