snag.page

gov.uk

Checked 15 Nov 2026, 19:23 UTC

1 thing to fix

1 low25 passed

What to fix

  1. 1

    No CAA record

    Low

    DNS Any certificate authority may issue a certificate for the domain.

    1. Find who issued your current certificate.
    2. Add a CAA record naming them; the one below names Let's Encrypt.
    DNS record at gov.uk
    gov.uk. CAA 0 issue "letsencrypt.org"

    About this check

Also worth doing

  1. 2

    No Cross-Origin-Opener-Policy

    Worth doing

    Headers A window this page opens, or one that opened it, keeps a handle on it that can be misused.

    1. Send the header below; use same-origin-allow-popups if the site opens sign-in or payment windows.
    Header
    Cross-Origin-Opener-Policy: same-origin

    About this check

  2. 3

    No DKIM key under the usual names

    Worth doing

    Email snag.page looked under the names most providers use; without DKIM, receivers can't check your email was signed by you.

    1. Turn on DKIM signing at your email provider.
    2. Publish the TXT record it gives you.

    About this check

Quality

3 to improve27 passed

  1. 4

    No X card

    Worth doing

    Sharing Links shared on X show a small card without one.

    1. Add the tag below; X takes the title, description and image from Open Graph.
    HTML
    <meta name="twitter:card" content="summary_large_image">

    About this check

  2. 5

    No structured data

    Worth doing

    Sharing JSON-LD tells search engines what the site is, an organisation, a product or an article, for richer results.

    1. Add a JSON-LD block describing the site, such as the one below.
    HTML
    <script type="application/ld+json">
{"@context": "https://schema.org", "@type": "Organization", "name": "Site name", "url": "https://example.com"}
</script>

    About this check

  3. 6

    No llms.txt

    Worth doing

    AI and agents An llms.txt gives AI assistants a short guide to the site and links to plain versions of its pages.

    1. Publish /llms.txt in Markdown: a heading with the site's name, a one-line summary, then links to the pages that matter.
    /llms.txt
    # Site name

> What the site does, in a sentence.

## Pages

- [About](https://gov.uk/about): who runs it

    About this check

All checks

58

DNS

Headers

  • No Cross-Origin-Opener-Policy
  • Content-Security-Policy is set
  • Other sites can't frame it
  • Browsers keep to the content type
  • The referrer policy is safeReferrer-Policy is strict-origin-when-cross-origin.
  • Permissions-Policy is set
  • No software versions in headers
  • Other sites can't read it as the visitor

Email

Sharing

AI and agents

  • No llms.txt
  • Says what AI crawlers may doBlocks none of the AI crawlers it names.

HTTPS

  • Answers over HTTPShttps://www.gov.uk/ answered 200.
  • Sends http:// to https://
  • HSTS is onFor 365 days, ready to preload.
  • gov.uk and www.gov.uk both lead to www.gov.uk

Cookies

  • Sets no cookies on the home page

Page contents

  • Loads nothing over http://
  • No libraries with known flawsOnly libraries named with a version in a script's address can be checked.
  • Every script comes from a host that existsIt loads no scripts from other hosts.

Security contact

  • Publishes a security contact

Exposed files

  • No exposed files found49 well-known paths checked.
  • No keys in the site's own scriptsThe home page and 5 scripts from the site checked.

Open services

  • No risky services seen openIts addresses are a CDN's, so Shodan's scans see the CDN, not the server behind it.

Reputation

HTML

  • The HTML is validNo errors in the home page.

Loading

  • The HTML is compressedContent-Encoding: br.
  • No scripts block the page from showing
  • Every image has a width and height
  • The HTML is a reasonable size84 KB.
  • One redirect before the page
  • The site's scripts are cached5 checked.

Search

  • Has a page titleWelcome to GOV.UK
  • Has a meta description
  • Search engines may list it
  • robots.txt doesn't block search engines
  • Has a sitemap
  • Has a canonical link
  • Has a main heading
  • Missing pages answer 404

Accessibility

  • Heading levels go in order
  • Every link has a name
  • Says its languagelang="en".
  • Every image has alt text
  • Zooming works
  • Every form field has a label

Readability

  • The text is easy enough to readReading ease 50, about US grade 8 (age 13), sentences of 8 words on average, from 434 words of the page's text.

Privacy

  • No known trackers in the pageScripts a tag manager adds after the page loads aren't seen.

Links

  • The home page's links work10 of its links to the site checked.

Speed for real visitors

Passes Core Web Vitals

Loading LCP

755 ms

Good

96% good1% poor

Responsiveness INP

109 ms

Good

94% good1% poor

Visual stability CLS

0.00

Good

99% good1% poor

First content FCP

697 ms

Good

Server response TTFB

331 ms

Good

Passes Core Web Vitals

Loading LCP

519 ms

Good

98% good1% poor

Responsiveness INP

44 ms

Good

99% good0% poor

Visual stability CLS

0.00

Good

88% good1% poor

First content FCP

456 ms

Good

Server response TTFB

202 ms

Good

The 75th percentile of Chrome users' page loads at www.gov.uk, 17 Oct 2026 to 13 Nov 2026.