wpbeginner.com website health report

88Overall

Website health report

wpbeginner.com scores 88/100

Good overall, with a few things worth fixing. We found 20 issues; the weakest area is Security (79/100).

Last checked October 27, 2026 · 2 scans · WordPress detected

1 High
6 Medium
13 Low
29 Passed

Free expert review

Send this report to SuperSiteBros. An expert will look it over and email you with the highest-impact fixes — no obligation.

Free weekly monitoring

Weekly monitoring is built and ready, but outbound email from this server is not reliable yet (no SPF/DKIM/DMARC and no SMTP). Sign-ups stay closed until that is fixed — use the free expert review above in the meantime.

Matched SuperSiteBros services

Based on the categories that need work. Prices are from supersitebros.com.

SSL / mixed content fix$79 one-time

Eliminate mixed-content warnings and force HTTPS properly.

View on SuperSiteBros →Super Plan$99/month

Everything in Starter, plus weekly backups, security scans and performance optimizations.

View on SuperSiteBros →

Score history

Previous scans (2)

Date (UTC)	Score	Grade	Security	Performance	SEO	Accessibility	Best practices
Oct 27, 2026 18:04	88	B	79	85	95	87	99
Oct 27, 2026 17:50	84	B	79	74	91	89	98

Lighthouse speed test (desktop)

Performance

Accessibility

100

Best practices

100

SEO

Largest Contentful Paint: 1.2 s
Cumulative Layout Shift: 0.005
Total Blocking Time: 0 ms
First Contentful Paint: 0.8 s
Speed Index: 3.3 s

Top opportunities

Reduce initial server response time~4.6 s
Serve images in next-gen formats~0.3 s
Properly size images~0.3 s
Eliminate render-blocking resources~0.2 s
Reduce unused CSS~39 KiB

Lab data from headless Chrome; results vary slightly between runs.

The crawl stopped early because the site responded slowly; results cover the pages we reached.

Pages checked

Page	Status	Title	Words	Issues
/	200	WPBeginner - Beginner's Guide for WordPress	1751	—
/blog/	200	WordPress for Beginners Blog	1751	—
/category/beginners-guide/	200	WordPress Beginners Guides - Essential Tips for Beginners	1758	—
/category/news/	200	Top WordPress News All in One Place	1788	—
/category/opinion/	200	Opinions and Ideas by WPBeginner	1801	—
/category/showcase/	200	WPBeginner Showcase - Best Website Tools Picked by Experts	1787	—
/category/wp-themes/	200	Best WordPress Themes Tutorials - Start Learning Today	1781	—
/category/wp-tutorials/	200	700+ Best Free WordPress Tutorials (Step by Step)	2012	—
/category/plugins/	200	Browse 600+ How-To Guides & Reviews on WordPress Plugins	2019	—
/showcase/24-must-have-wordpress-plugins-for-business-websites/	0	—	0	—
/beginners-guide/how-to-install-google-analytics-in-wordpress/	200	How to Install Google Analytics in WordPress for Beginners	7289	—
/showcase/best-ai-website-builders-for-wordpress/	200	7 Best AI Website Builders for WordPress (Expert Picks in 2026)	5139	—
/showcase/best-wordpress-themes/	200	2026's Most Popular and Best WordPress Themes (Expert Pick)	7002	—
/common-wordpress-errors-and-how-to-fix-them/	200	65 Most Common WordPress Errors and How to Fix Them	9643	—
/start-here/	200	Start Here - Your Guide to WordPress by WPBeginner	1612	—
/start-a-wordpress-blog/	200	How to Start a WordPress Blog in 2026 (My Expert Advice)	10671	—
/guides/	200	How to Make a WordPress Website in 2026 (Ultimate Guide)	10468	—
/wp-tutorials/how-to-start-an-online-store/	200	How to Start an Online Store in 2026 (Step by Step for Beginners)	7231	—
/wp-tutorials/how-to-create-online-course-in-wordpress/	200	How to Create and Sell Online Courses with WordPress (Step by Step)	8731	—
/beginners-guide/how-to-choose-the-best-website-builder/	0	—	0	—

Issues to fix on wpbeginner.com

HighSlow server response (TTFB)Performance

Time to first byte was 4.81s (measured from our test server in the US East).

Why it matters

Time to first byte is the wait before anything can start to load. Google rates over 1.8s as poor; it delays every other metric, including Largest Contentful Paint.

How to fix it

Add full-page caching, a faster host or PHP version, database/object caching, and a CDN close to your visitors.

WordPress tip: Use a page-cache plugin (WP Super Cache, W3 Total Cache, or your host’s cache), Redis object cache, and audit slow plugins with Query Monitor.

MediumForm fields without labelsAccessibility

8 of 16 form fields have no label.

Why it matters

Without a label, screen-reader users don’t know what to type, and placeholder text disappears as soon as people start typing.

How to fix it

Give every input a <label for="…">, or an aria-label if a visible label is impossible.

WordPress tip: Most form plugins have a “show label” option — use it instead of placeholder-only fields.

MediumStatic files have weak browser cachingPerformance

4 of 4 sampled CSS/JS files are cached for less than 7 days.

Why it matters

Without a long Cache-Control lifetime, returning visitors re-download the same CSS, JS and images on every visit.

How to fix it

Serve versioned static assets with `Cache-Control: public, max-age=31536000, immutable` (or at least 30 days).

WordPress tip: Most caching plugins and hosts can add expiry headers for static files.

Details

https://www.wpbeginner.com/wp-content/plugins/wpforms-form-locker/assets/css/frontend.min.css?ver=2.8.0 (Cache-Control: max-age=14400)
https://www.wpbeginner.com/wp-content/themes/wpbv7/assets/css/main.min.css?ver=1783702078 (Cache-Control: max-age=14400)
https://www.wpbeginner.com/wp-content/plugins/wpforms/assets/pro/css/fields/layout.min.css?ver=2.0.2.2 (Cache-Control: max-age=14400)
https://www.wpbeginner.com/wp-content/plugins/wpforms/assets/pro/css/fields/layout-screen-big.min.css?ver=2.0.2.2 (Cache-Control: max-age=14400)

MediumHTTP does not redirect to HTTPSSecurity

http://www.wpbeginner.com/ returned 200 without redirecting.

Why it matters

Visitors (and links) that use http:// get an unencrypted copy of the site. Search engines may also index both versions as duplicates.

How to fix it

Add a permanent (301) redirect from every http:// URL to the same https:// URL at the server or CDN level.

WordPress tip: Set both URLs in Settings → General to https://; most hosts also have a “Force HTTPS” toggle. Avoid doing it with a plugin if the server can do it.

MediumHSTS header missingSecurity

No Strict-Transport-Security header on the HTTPS response.

Why it matters

Strict-Transport-Security tells browsers to always use HTTPS for your domain, closing the window where a first http:// request can be intercepted and downgraded.

How to fix it

Send `Strict-Transport-Security: max-age=31536000; includeSubDomains` on HTTPS responses (start with a shorter max-age if you’re unsure every subdomain supports HTTPS).

WordPress tip: Add the header in your server config, CDN (Cloudflare → SSL/TLS → Edge Certificates → HSTS), or with a headers plugin such as “Headers Security Advanced & HSTS WP”.

MediumNo clickjacking protectionSecurity

Neither X-Frame-Options nor CSP frame-ancestors is set.

Why it matters

Without frame-ancestors (or X-Frame-Options), another site can load yours invisibly inside a frame and trick visitors into clicking buttons they can’t see.

How to fix it

Send `Content-Security-Policy: frame-ancestors 'self'` (modern) and/or `X-Frame-Options: SAMEORIGIN` (legacy browsers).

WordPress tip: WordPress already sends X-Frame-Options on wp-admin and the login page, but not on the front end — add it in the server config or a headers plugin.

MediumBroken linksSEO

2 broken internal and 0 broken external link(s) found.

Why it matters

Links to missing pages frustrate visitors and waste the authority you pass through links.

How to fix it

Update or remove links that return 404/410 or server errors; redirect deleted pages to their closest replacement.

WordPress tip: The free “Broken Link Checker” plugin or Redirection plugin help find and fix them.

Details

https://www.wpbeginner.com/showcase/24-must-have-wordpress-plugins-for-business-websites/ (no response) ← linked from /, /blog/
https://www.wpbeginner.com/beginners-guide/how-to-choose-the-best-website-builder/ (no response) ← linked from /, /blog/

LowLinks without readable textAccessibility

1 link(s) have no text or accessible name.

Why it matters

Icon-only or empty links are announced as just “link”, so screen-reader and voice-control users can’t tell where they go.

How to fix it

Add visible text, an aria-label, or alt text on the image inside the link.

LowHeadings skip levelsAccessibility

Heading levels are skipped 1 time(s).

Why it matters

Screen-reader users navigate by headings; jumping from H1 to H4 makes the structure confusing.

How to fix it

Use headings in order (H1 → H2 → H3) and style them with CSS rather than picking levels for their size.

LowFairly large HTML documentPerformance

The HTML document is 311 KB.

Why it matters

The page’s HTML is heavier than most; it’s worth checking for inline SVG/CSS/JSON blobs you can externalise.

How to fix it

Externalise large inline CSS/JS/SVG and cut repeated markup.

LowLarge DOM (many elements)Performance

The page has about 1,907 elements.

Why it matters

Lighthouse flags pages over ~1,400 elements: a large DOM uses more memory, slows styling and makes interactions (INP) laggy.

How to fix it

Simplify nested wrappers, lazy-render off-screen sections, and avoid page-builder bloat.

LowOff-screen images not lazy-loadedPerformance

32 images further down the page load eagerly.

Why it matters

Images far down the page are downloaded straight away, competing with what visitors actually see first.

How to fix it

Add `loading="lazy"` to images below the fold — but not to the main hero/LCP image.

WordPress tip: WordPress adds lazy loading automatically since 5.5; if it’s missing, a theme or plugin is overriding it.

LowFirst large image is lazy-loadedPerformance

The first image in the page is marked loading="lazy".

Why it matters

The first image is often the Largest Contentful Paint element. Lazy-loading it delays the most important paint.

How to fix it

Remove loading="lazy" from the first visible image and consider `fetchpriority="high"`.

WordPress tip: WordPress 6.3+ skips lazy-loading for the first content image; custom themes may need the `wp_omit_loading_attr_threshold` filter.

Details

https://www.wpbeginner.com/wp-content/themes/wpbv7/assets/images/blocks/intro--main.png

LowImages not in modern formatsPerformance

64 of 64 images are JPEG/PNG/GIF without a WebP/AVIF alternative.

Why it matters

WebP and AVIF are typically 25–50% smaller than JPEG/PNG at the same quality and are supported by all current browsers.

How to fix it

Serve WebP/AVIF (with <picture> fallbacks if you need them) or let an image CDN negotiate the format.

WordPress tip: WordPress 5.8+ handles WebP uploads; an optimizer plugin can convert existing media in bulk.

LowNo security.txt fileBest practices

/.well-known/security.txt was not found (or has no Contact: line).

Why it matters

security.txt (RFC 9116) tells researchers how to report a vulnerability to you instead of disclosing it publicly or not at all.

How to fix it

Publish /.well-known/security.txt with at least a `Contact:` and an `Expires:` line.

LowX-Content-Type-Options missingSecurity

X-Content-Type-Options: nosniff is not set.

Why it matters

Without `nosniff`, some browsers guess a file’s type from its contents, which can turn an uploaded “image” into executable script.

How to fix it

Send `X-Content-Type-Options: nosniff` on all responses.

LowNo Referrer-PolicySecurity

No Referrer-Policy header.

Why it matters

Browsers default to a reasonable policy today, but setting one explicitly guarantees full URLs (which can contain tokens or search terms) aren’t leaked to other sites.

How to fix it

Send `Referrer-Policy: strict-origin-when-cross-origin`.

LowX-Powered-By header exposedSecurity

X-Powered-By: PHP/8.3.36

Why it matters

This header reveals the language/framework and often its exact version — free reconnaissance for attackers.

How to fix it

Disable it (PHP: `expose_php = Off`; Express: `app.disable('x-powered-by')`).

LowCookies without Secure / HttpOnly / SameSiteSecurity

3 cookie(s) set on the homepage lack security flags.

Why it matters

Cookies missing these flags can be sent over plain HTTP, read by injected JavaScript, or sent along with cross-site requests (CSRF).

How to fix it

Set `Secure` and `SameSite=Lax` (or Strict) on all cookies, and `HttpOnly` on any cookie JavaScript doesn’t need to read.

Details

PHPSESSID (missing SameSite)
wpbtsdksess (missing Secure, SameSite, HttpOnly)
wpbtsdksess (missing Secure, SameSite, HttpOnly)

LowNo robots.txtSEO

https://www.wpbeginner.com/robots.txt returned HTTP 403.

Why it matters

Crawlers look for /robots.txt first. It’s optional, but it’s the standard place to point them to your sitemap and keep them out of low-value areas.

How to fix it

Create a robots.txt at the site root with at least `User-agent: *`, `Disallow:` and a `Sitemap:` line.

WordPress tip: WordPress serves a virtual robots.txt; SEO plugins let you edit it and add the sitemap line.

InfoNo CAA recordSecurity

No CAA records for www.wpbeginner.com — any public CA may issue certificates.

Why it matters

CAA records say which certificate authorities may issue certificates for your domain, reducing the risk of a mis-issued certificate.

How to fix it

Add e.g. `yourdomain. CAA 0 issue "letsencrypt.org"` for each CA you use (check your CDN’s required CAs first).

Passed checks (29)

Valid SSL certificate — Trusted certificate for www.wpbeginner.com, valid until 2027-01-12 (76 days left), issued by Let's Encrypt.
Content-Security-Policy present — upgrade-insecure-requests;
Permissions-Policy set — private-state-token-redemption=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com"), private-state-token-issuanc
No mixed content — Every resource referenced in the HTML uses https://.
Brotli compression — Content-Encoding: br
HTTP/2 and HTTP/3 supported — Served over HTTP/2 and advertises HTTP/3 (QUIC) via Alt-Svc.
Few render-blocking resources — 0 blocking script(s), 5 stylesheet(s).
Page loads successfully — HTTP 200 after 1 redirect(s).
Page is indexable — No noindex directive in meta robots or X-Robots-Tag.
Good page title — “WPBeginner - Beginner's Guide for WordPress” (43 characters).
Good meta description — 154 characters.
One clear H1 — “Learn the Ins and Outs of WordPress from the Real WordPress Experts”
Canonical URL set — https://www.wpbeginner.com/
Mobile viewport set — width=device-width, initial-scale=1
Open Graph tags present — og:title, og:description and og:image are set.
Structured data found — Types: BreadcrumbList, Organization, WebPage, WebSite.
Valid hreflang annotations — 12 language alternates.
XML sitemap found — https://www.wpbeginner.com/sitemap.xml (index with 10 entries).
Missing pages return 404 — A made-up URL returned 404.
One preferred hostname — wpbeginner.com redirects (301) to the preferred version.
Page language declared — lang="en-US"
All images have alt attributes — 116 images checked.
Standards-mode HTML5 document — Doctype and charset are declared.
REST user list protected — The users endpoint is not publicly readable.
XML-RPC blocked — /xmlrpc.php is not reachable.
SPF record present — v=spf1 +a +mx +ip4:198.1.79.173 include:_spf.google.com include:servers.mcsv.net -all
DMARC policy enforced — v=DMARC1; p=reject; rua=mailto:781926cb3fbb4b5e84bb1919d89f4f2d@dmarc-reports.cloudflare.net
Reachable over IPv6 — www.wpbeginner.com has an AAAA record.
Page titles are unique — Across 18 crawled page(s).

Site facts

Final URL: https://www.wpbeginner.com/
HTTP status: 200
Server response (TTFB): 4808 ms
Protocol: HTTP/2 · HTTP/3 advertised
Compression: br
HTML size: 310.9 KB
DOM elements: 1907
Words on page: 1751
Certificate: Valid, 76 days left (Let's Encrypt)
Email DNS: SPF ✓ · DMARC ✓ · CAA ✗ · IPv6 ✓
Server: cloudflare
Structured data: BreadcrumbList, Organization, WebPage, WebSite

Technology detected

WordPress
WooCommerce
jQuery
Google Analytics
Cloudflare
PHP

Want these fixed for you?

SuperSiteBros care plans take care of security hardening, speed, updates and monitoring so your grade stays high.

See care plans

This report was generated automatically from public information. How we score sites · Own this site? Request removal

wpbeginner.com website health report

wpbeginner.com scores 88/100

Free expert review

Free weekly monitoring

Matched SuperSiteBros services

Score history

Lighthouse speed test (desktop)

Top opportunities

Site crawl

Issues to fix on wpbeginner.com

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Details

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Details

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Details

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Why it matters

How to fix it

Details

Why it matters

How to fix it

Why it matters

How to fix it

Site facts

Technology detected

Want these fixed for you?