What is checked 

Scope 

Checks that look at pages and content only look at the pages of the selected site. Another site root in the tree ends the descent: a subtree with its own config.yaml is a site of its own and is checked there, not here.

Indexing and sitemap 

robots.txt is delivered

Warning · HTTP request to /robots.txt

Fails on any status other than 2xx, and reports the status code that came back. Every other robots check on the page reads this same response.

Search engines are not locked out

Blocker · the robots.txt response

Fails when the file forbids all user agents the whole site (User-agent: * together with Disallow: /). This is the staging file that was taken along on launch.

Can be fixed from the report if robots.txt comes from a static route in the site configuration.

Sitemap line points to this domain

Warning · the robots.txt response

Fails when there is no Sitemap: line at all, and when a line names a host other than the site's own. The expected value is the site's base followed by /sitemap.xml.

The host comparison is skipped when the base URL was only assumed, because the finding would then be a statement about the backend host.

Can be fixed from the report under the same condition as above.

sitemap.xml delivers a sitemap

Blocker · HTTP request to /sitemap.xml

Fails on a status other than 2xx — and also on status 200 when the body is not a sitemap. A 404 handler that serves a page answers 200 with HTML, so the body has to start with <?xml and contain <urlset or <sitemapindex.

Sitemap entries point to this domain

Blocker · the sitemap.xml response

Reads the first 50 <loc> entries and fails when any of them names a different host, listing up to five of them. Entries on a foreign domain make a search engine index the staging site, or discard the sitemap as not belonging to this property.

Pages excluded from search

Notice · database, table pages

Lists the visible pages of this site with no_index = 1 , up to twelve, each with a link to the record. It is a notice rather than a blocker because on a thank-you page the flag is right — only you know which is meant here.

Base address is the live domain

Blocker · site configuration, base

Fails when the base has no host at all, when the host is a development one (localhost, .ddev.site, .local, .test, .localhost, 127.0.0.1), and when the scheme is not https.

Every absolute address TYPO3 builds comes from here — canonical tags, hreflang, og:image, sitemap — and a wrong base makes all of them wrong at once without anything looking broken.

Website title belongs to the customer

Notice · site configuration, websiteTitle

Fails when it is empty or still one of the known template titles (New TYPO3 site, Bootstrap Package, Example and similar).

TYPO3 configuration 

Production context

Blocker · application context

Anything other than Production fails. In Development, TYPO3 answers errors with a full stack trace: file paths, class names and, depending on the error, configuration values.

404 handler works

Blocker · site configuration, errorHandling

Fails when there is no handler for error code 404. If the handler is of type Page and points at t3://page?uid=…, the target page has to exist and must not be hidden — a handler pointing at a deleted or hidden page turns every unknown address into a server error.

Other handler types and external URLs pass without further inspection.

Mail actually leaves the server

Blocker · $GLOBALS['TYPO3_CONF_VARS']['MAIL']

Fails on transport null or debug, on an SMTP server that is a mail catcher (mailpit, mailhog, mailcatcher, localhost, 127.0.0.1, ::1), on an empty defaultMailFromAddress, and on a sender address from a template domain (example.com, example.org, example.ch, domain.tld, localhost).

The contact form says thank you either way, and nobody misses an enquiry they never heard about.

No build-time extensions active

Warning · installed packages

Reports styleguide, adminpanel and bootstrap_package_demo while they are still active. Demo content is the fastest way to build a site, which is exactly why it stays in: its pages are reachable, appear in the sitemap and compete with the real ones.

Scheduler runs

Warning · database, table tx_scheduler_task

Skipped when typo3/cms-scheduler is not installed. Fails when no enabled task exists, when nothing has ever run, and when the last execution is more than 24 hours old — that last case is the cron job nobody set up.

Security 

Debug output is off

Blocker · $GLOBALS['TYPO3_CONF_VARS']

Reports SYS/devIPmask = *, SYS/displayErrors = 1, BE/debug and FE/debug. A * as the developer IP mask means every visitor on earth counts as a developer, and every error hands them the stack trace.

Host header is restricted

Warning · SYS/trustedHostsPattern

Tested by behaviour, not by wording: the pattern is matched against a host it must never accept. That catches .* as well as .*.*, (.*), .+ and ^.*$ — there are arbitrarily many spellings for "everything". The special value SERVER_NAME passes.

An empty or syntactically invalid pattern is not reported: TYPO3 then rejects every host, which is broken but not open, and this check only reports what is open.

No build-time password left

Blocker · database, table be_users

Takes up to ten enabled administrator accounts and tests their password hashes against password, admin, 123456, typo3, test, demo and Password1, using TYPO3's own hash implementation.

The verdict is cached against a fingerprint of the hash, so the hashing runs again only for an account whose password changed. A hash no known implementation can read is not reported — a false alarm on an administrator account costs more trust than it buys.

Document root is set correctly

Blocker · HTTP requests to four paths

Requests /.env, /composer.json, /config/system/settings.php and /config/system/additional.php. A hit counts only when the body looks like the file itself rather than like an HTML page, so a 404 page answering with status 200 does not raise a false alarm.

If the web server points at the project directory instead of public/, then .env and the database credentials are publicly readable.

http redirects to https

Warning · one HTTP request, redirects not followed

Calls the http:// variant of the base URL once. Fails when the answer is not a redirect, and when the Location does not point to https. Skipped when plain http does not answer at all, and when the base URL is not https to begin with — that is reported by the base check instead.

TLS certificate is valid

Blocker, Warning below 30 days · TLS connection to the base host

Reads the peer certificate and reports the subject, the issuer and the expiry date. Expired, an untrusted chain, or fewer than seven days left is a blocker; fewer than 30 days is a warning, because that is when Let's Encrypt renews.

This is the one check whose severity depends on its finding: expired means the site is unreachable, expiring in 25 days means it belongs in a calendar.

Protective headers are sent

Warning · HTTP request to the home page

Looks for X-Content-Type-Options: nosniff, Referrer-Policy, and protection against framing — either X-Frame-Options or frame-ancestors in a Content Security Policy, whichever is present. Strict-Transport-Security is only required on an https site, where it has an effect.

Legal 

Imprint and privacy page exist

Blocker · database, table pages

Looks for a page of this site whose slug contains impressum, imprint, legal-notice or mentions-legales, and one containing datenschutz, privacy or protection-des-donnees. Missing fails, and so does present but hidden.

Both pages are mandatory in German-speaking countries and both are actionable. They rarely miss entirely — more often they sit finished in the tree and are still hidden.

Content 

No filler text on visible pages

Warning · database, table tt_content

Searches header and bodytext of the visible content elements on this site's pages for lorem ipsum, dolor sit amet, Musterstrasse, Musterstraße, Mustermann, Musterfirma, Platzhalter, example.com, Ihr Text hier and your text here. Lists up to ten hits, each linking to the page module.

Filler text survives exactly where nobody looks any more: the third column, the collapsed accordion, the page that exists only for its menu entry.

Pages have a meta description

Notice · database, table pages

Lists visible standard pages of this site that are indexable and have an empty description, up to ten. Page types that never appear in a search result — folders, shortcuts, spacers — are not counted.

The twelve manual points 

These cannot be established by a machine. Ticking one records the backend user and the timestamp; see The manual checklist.

• Redirects from the previous site imported — blocker
• Search Console set up and sitemap submitted — warning
• Staging protected or taken offline — warning
• DNS and mail records switched over — blocker
• Backup set up and a restore actually tested — blocker
• Uptime and certificate monitoring in place — warning
• Contact form tested end to end — blocker
• Imprint and privacy text checked by the customer — blocker
• Nothing tracks before consent — blocker
• Image licences clarified — warning
• Tested on phone, tablet and desktop — warning
• Content proofread and links clicked — warning