Your position
47th percentile of 30 sites audited. The average site scores 73, the median 72.
Website audit report
sheaf.shop
70
/ 100
C · Needs work
36 issues found across 108 checks. Nothing critical.
- Checks run
- 108
- Passed
- 57
- Failed
- 36
- Pages crawled
- 2
Scanned 2026-09-02T00:18:28+00:00 · 1 host IP · cert expires in 42 days
This report is not offered to search engines. It is reachable by link only. If you own sheaf.shop you can publish or delete it.
How you compare
Measured against every site SEOking has audited: a corpus that grows with each scan and cannot be reconstructed after the fact.
The most unusual thing you fail
Content identifies who wrote it
100% of the sites we have audited get this right and yours does not. Of everything on this report, it is the fault that most sets you apart from your competition, which makes it the first thing worth fixing.
Inbox Trust Index
Our own measure of whether your domain is trusted by the systems that decide if mail reaches an inbox. No other website audit reports this. It is built from BounceZero's deliverability platform.
49
/ 100
Weak
Multiple authentication faults. Expect filtering and spoofing risk.
What is pulling it down: DMARC enforcement · DKIM signing. See the email deliverability section below.
Measured against our corpus
We have measured deliverability across 223,556 domains. Yours is not among them, which simply means no one has needed to verify an address at it. The score above is from live measurements of your own DNS.
For context, 3.7% of the domains we have measured accept mail to any address, which makes their bounce behaviour unpredictable.
How your page actually renders
Loaded in a real browser at phone size. This is close to what a visitor and Google's renderer see.
- Largest paint
- 0.8s
- Layout shift
- 0
- Requests
- 17
- Words rendered
- 189
- JS errors
- 0
- Failed resources
- 3
Your plan
The 36 faults on this report come from 12 underlying causes. Fixing a cause fixes everything under it, so this is ordered by score returned per unit of work, not by severity alone.
The 5 quickest steps here take you from 70 to about 81. That is 11 points for changes measured in minutes and hours, not weeks.
1. Fix email authentication
DNS edit · minutes→ 74/100These are all records in your DNS. One editing session fixes every one of them, and it is the change most likely to stop your mail being filtered.
Fixes 5 findings: DMARC policy is enforced · DKIM signing is configured · MTA-STS policy published · TLS reporting enabled · BIMI logo published
2. Make the structured data qualify
Template change · a few hours→ 81/100Rich results — ratings, prices, FAQs, breadcrumbs — are what turn a listing into an advert, and they are decided by whether a few required properties are present. Markup that is invalid or incomplete is work already done that currently earns nothing.
Fixes 6 findings: The business is a describable entity · Content is marked up to be answered · The business is identified in structured data · Breadcrumbs are marked up · Site-wide search is declared · The entity links out to its profiles
3. Write the titles and descriptions
Content work · days→ 86/100Your title and description are the advert Google runs for you, free, every time someone searches.
Fixes 6 findings: Page titles are unique · Homepage meta description is present · Every page has a meta description · Structured data present · Social preview configured · Link previews are configured for X/Twitter
4. Fix what search engines are allowed to see
Server or CDN config · under an hour→ 88/100These decide whether your pages can appear at all. Nothing else on this report matters until they are right.
Fixes 2 findings: XML sitemap published · Homepage canonical is correct
5. Close the takeover and impersonation gaps
DNS edit · minutes→ 89/100A subdomain pointing at a service that released it can be claimed by anyone, who then publishes on your domain. Deleting the record costs nothing and closes it immediately.
Fixes 1 finding: No lookalike domain can send mail as your brand
6. Complete the security headers
Server or CDN config · under an hour→ 91/100All set in the same place — your web server or CDN. Half of them are single lines.
Fixes 4 findings: Content Security Policy header · MIME sniffing protection header · Clickjacking protection header · Referrer policy header
7. Harden DNS and hosting
Server or CDN config · under an hour→ 93/100Resilience and reputation work — lower urgency, but cheap while you are already in these systems.
Fixes 3 findings: All page resources load successfully · DNSSEC enabled · CAA record restricts certificate issuance
8. Fix the page on a phone
Template change · a few hours→ 95/100Google indexes the mobile version of your site, and these are measured in a real phone-sized browser rather than inferred. A page that scrolls sideways or needs pinching to read loses the visitor before the content matters.
Fixes 2 findings: Tap targets are big enough to hit · Body text is legible on a phone
9. Show who stands behind the content
Content work · days→ 97/100Google's guidance asks who produced a page and why they should be trusted. For advice, health, legal or financial topics an anonymous, undated page competes badly against a named one.
Fixes 3 findings: Content identifies who wrote it · There is a route to who you are · A publisher is declared in structured data
10. Serve images at the right size and format
Development work · days to weeks→ 98/100Images are what Largest Contentful Paint usually measures, and WebP is typically a third smaller than the same JPEG. On image-led pages this is the largest saving available.
Fixes 2 findings: Images have alt text · Images are sized for the device
11. Strengthen thin pages
Content work · days→ 99/100Pages with little unique content rarely rank and can hold back how the whole site is judged.
Fixes 1 finding: Pages have enough content
12. Reduce what the page has to load
Development work · days to weeks→ 100/100Image and script weight drive every speed metric you are failing. This is the slowest fix here and the one with the longest tail.
Fixes 1 finding: Images load lazily
Fix these first
Ranked by severity, then by how much score each returns.
- high
1. DMARC policy is enforced
+9 ptsNo DMARC record. You have neither protection against domain spoofing nor any visibility into it.
How to fix: Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain to start, then tighten to quarantine.
- high
2. DKIM signing is configured
+8 ptsNo DKIM keys found on any common selector. Without DKIM your mail cannot prove it was not altered in transit, and DMARC cannot pass on forwarded messages.
How to fix: Enable DKIM in your mail provider and publish the key it gives you.
- high
3. No lookalike domain can send mail as your brand
+8 ptsWe generated and checked 46 plausible misspellings and variants of your domain. 10 of the 10 registered variants has mail servers configured, so it is technically able to send email that reads as yours to anyone skimming a sender address. Many such domains are entirely unrelated businesses that happen to have a similar name — this is a risk to be aware of and to defend against, not evidence that anyone is doing anything.
shaef.shop [mail configured] shaf.shop [mail configured] shead.shop [mail configured] sheaf.co [mail configured] sheaf.com [mail configured] sheaf.io [mail configured] sheaf.net [mail configured] sheaf.org [mail configured]
How to fix: Publish DMARC at enforcement so mail claiming to be your domain is rejected outright — that is the defence that works regardless of who owns a lookalike. Then register the closest unregistered variants; they cost a few pounds a year and are the cheapest brand protection available.
- high
4. Page titles are unique
+6 pts2 pages share 1 duplicated title(s). Google treats near-identical pages as competing with each other, and usually indexes only one.
2× Sheaf Shop
2 affected URLs
How to fix: Give every page a title describing that page specifically.
- high
5. The business is a describable entity
+6 ptsNo Organization or Person markup. An assistant that cannot name the entity behind the site will describe the business from fragments, or not at all, which is how a competitor becomes the answer.
How to fix: Add Organization JSON-LD with name, url, logo and sameAs links, so the description an assistant gives of the business is the one you wrote.
Full results
Security & trust
Whether the connection, certificate and headers hold up.
6 passed · 4 failed
81%
- ✕Content Security Policy headermedium
Missing. Limits where scripts may load from, which is the main defence against injected code and card skimmers.
Add a Content-Security-Policy header, starting in report-only mode.
- ✕MIME sniffing protection headerlow
Missing. Stops browsers guessing file types.
Send X-Content-Type-Options: nosniff
- ✕Clickjacking protection headerlow
Missing. Stops your site being framed inside someone else's.
Send X-Frame-Options: SAMEORIGIN, or use CSP frame-ancestors.
- ✕Referrer policy headerlow
Missing. Controls how much of your URL is leaked to other sites.
Send Referrer-Policy: strict-origin-when-cross-origin
- ✓Served over HTTPS
Secure connection working.
- ✓HTTP redirects to HTTPS
Plain HTTP requests are redirected to the secure version.
- ✓No insecure mixed content
All resources load securely.
- ✓Certificate is not near expiry
Certificate valid for another 42 days (expires 2026-10-14).
- ✓Modern TLS version
Negotiated TLSv1.3.
- ✓HSTS header
HSTS is set.
Email deliverability
Whether your mail reaches inboxes or spam folders.
4 passed · 5 failed
58%
- ✕DMARC policy is enforcedhigh
No DMARC record. You have neither protection against domain spoofing nor any visibility into it.
Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain to start, then tighten to quarantine.
- ✕DKIM signing is configuredhigh
No DKIM keys found on any common selector. Without DKIM your mail cannot prove it was not altered in transit, and DMARC cannot pass on forwarded messages.
Enable DKIM in your mail provider and publish the key it gives you.
- ✕MTA-STS policy publishedlow
No MTA-STS policy, so mail to you can be delivered unencrypted if an attacker strips TLS.
Publish an MTA-STS policy and the _mta-sts TXT record.
- ✕TLS reporting enabledlow
No TLS-RPT record, so delivery-encryption failures go unreported.
Publish a _smtp._tls TXT record with a reporting address.
- ✕BIMI logo publishedlow
No BIMI record. With DMARC at enforcement you could display your logo next to your messages in Gmail and Apple Mail.
Once DMARC is at quarantine or reject, publish a BIMI record with an SVG logo.
- ✓Domain can receive email
5 mail server(s) configured.
- ✓SPF ends with a fail qualifier
Ends in ~all (soft fail) — the usual safe setting.
- ✓SPF stays under the lookup limit
The record forces about 1 DNS lookups. Comfortably within the limit of 10.
- ✓Exactly one SPF record
One SPF record, as required.
Speed & Core Web Vitals
How fast real visitors experience the site.
7 passed · 2 failed · 1 skipped
84%
- ✕Images load lazilylow
0 of 1 images use lazy loading.
Add loading="lazy" to images below the fold.
- ✕Images are sized for the devicelow
0 of 5 image(s) provide a srcset. Without one, a phone downloads the full desktop image and then scales it down — paying for pixels it never shows.
Add srcset and sizes so each device downloads an appropriate image.
- –Core Web Vitals from real users
Not available: PageSpeed API returned 429. This usually means the site does not yet have enough Chrome traffic for Google to report field data. Lab measurements below still apply.
- ✓Compression enabled
Served with gzip compression.
- ✓Server responds quickly
Median response across 2 page(s) was 204 ms.
- ✓Homepage HTML is not oversized
Homepage HTML is 1 KB.
- ✓Images declare width and height
1 of 1 images declare dimensions.
- ✓Reasonable number of scripts
1 external script file(s) on the homepage.
- ✓Browser caching is allowed
Pages may be cached by browsers and CDNs.
- ✓Images use a modern format
No raster images found on the crawled pages.
Search fundamentals
The tags, files and signals search engines read first.
15 passed · 12 failed · 4 skipped
66%
- ✕The business is a describable entityhigh
No Organization or Person markup. An assistant that cannot name the entity behind the site will describe the business from fragments, or not at all, which is how a competitor becomes the answer.
Add Organization JSON-LD with name, url, logo and sameAs links, so the description an assistant gives of the business is the one you wrote.
- ✕Content is marked up to be answeredhigh
No FAQPage, HowTo or QAPage markup. When an assistant answers a question about this service, the page has nothing structured to be cited from, so the citation goes to whoever wrote the answer block.
Add FAQPage schema for the questions the page answers (the answer must appear as visible text, not only in the markup) and HowTo for process content.
- ✕XML sitemap publishedmedium
No XML sitemap. Google has to discover your pages by following links, which means deeper pages may never be crawled.
0 URLs · not referenced in robots.txt
Publish sitemap.xml and reference it from robots.txt.
- ✕The business is identified in structured datamedium
No Organization markup. This is what Google assembles a knowledge panel from — the box with your logo, name and links that appears beside branded searches — and what connects your site to your social profiles. Without it Google infers your identity from third parties instead of from you.
Add Organization JSON-LD with name, url, logo and sameAs links to your social profiles.
- ✕Homepage meta description is presentmedium
No meta description, so Google writes the snippet for you from whatever text it finds.
Write 120-160 characters that give someone a reason to click.
- ✕Homepage canonical is correctmedium
No canonical tag, so duplicate URLs of the same page can compete.
Set a self-referencing canonical on every page.
- ✕Structured data presentmedium
No structured data. Google is reading your page as plain text and cannot qualify you for any rich result.
Add JSON-LD for Organization and your primary content type.
- ✕Breadcrumbs are marked upmedium
No BreadcrumbList markup. Google replaces the raw URL in your listing with a readable breadcrumb trail when this is present, which is more legible and measurably more clickable — and it is one of the cheapest rich results to earn.
Add BreadcrumbList JSON-LD to every page below the homepage.
- ✕The entity links out to its profileslow
No entity markup to attach profiles to.
Add sameAs URLs to the Google Business Profile, LinkedIn, X and any other profiles the business owns.
- ✕Social preview configuredlow
No Open Graph tags, so links shared on social or WhatsApp show no image, title or description.
Add og:title, og:description and og:image.
- ✕Site-wide search is declaredlow
No WebSite markup. With a SearchAction it can give you a search box directly inside your Google listing for branded queries.
Add WebSite JSON-LD, with potentialAction/SearchAction if the site has its own search.
- ✕Link previews are configured for X/Twitterlow
No twitter:card tags. Open Graph covers most platforms, but X falls back to a bare link without them, and a link with no image or title is measurably less likely to be opened.
Add twitter:card ("summary_large_image"), twitter:title and twitter:description.
- –International targeting
Not applicable — this site publishes in a single language and declares no regional or translated versions, so hreflang annotations are not needed. Adding them to a single-language site does nothing.
- –Search Console connected
Not measured — not configured on this instance. Connecting Search Console adds what no crawl can see: the queries this site already appears for, where it ranks, and how many people click. It is read-only and can be disconnected at any time.
- –AI assistants can read this site
Not measured — no robots.txt was served, so no crawler is restricted by it. Every assistant may read the site.
- –Current search visibility
Not measured — ranking data is not configured on this instance.
- ✓Homepage is indexable
Homepage is open to indexing.
- ✓Mobile viewport declared
Mobile viewport is declared.
- ✓Homepage title is present and well sized
Title is 10 characters.
- ✓robots.txt does not block the site
No robots.txt file. Not fatal, but it is where you point search engines at your sitemap.
- ✓Canonicals point at indexable pages
Every canonical points at a page that is allowed to be indexed.
- ✓Canonical targets are live pages
Canonical targets all return 200.
- ✓Structured data parses
All structured data blocks are valid JSON.
- ✓Noindex directives are readable
No page relies on a directive Google is blocked from reading.
- ✓Marked-up content qualifies for rich results
Every marked-up entity carries the properties Google requires.
- ✓Most crawled pages are indexable
2 of 2 crawled page(s) (100%) can actually be indexed.
- ✓No canonical chains
No canonical points at a page that then canonicals somewhere else.
- ✓Pages are close to the homepage
Every crawled page sits within four levels of the homepage (deepest: 1).
- ✓URLs are readable
URLs use lowercase, hyphenated, extension-free paths.
- ✓Content is not served behind query parameters
0 of 2 crawled URLs carry query parameters other than tracking tags.
- ✓Page language declared
Language attribute present.
Content & structure
Whether pages are unique, linked and crawlable.
6 passed · 7 failed · 4 skipped
48%
- ✕Page titles are uniquehigh
2 pages share 1 duplicated title(s). Google treats near-identical pages as competing with each other, and usually indexes only one.
2× Sheaf Shop
2 affected URLs
Give every page a title describing that page specifically.
- ✕Pages have enough contentmedium
2 of 2 crawled pages carry under 150 words. Thin pages rarely rank and can drag down how the whole site is assessed.
2 affected URLs
Expand or consolidate thin pages so each answers a real question.
- ✕Content identifies who wrote itmedium
No author is named anywhere — no byline, no author metadata and no author in your structured data. Google's guidance on helpful content asks who produced it and why anyone should trust them, and for advice, health, legal or financial pages an anonymous page competes badly against one with a named, credentialed author.
Add a byline with a real name linking to an author page, and an author property in your Article or Organization markup.
- ✕Every page has a meta descriptionmedium
2 of 2 crawled pages have no meta description.
2 affected URLs
Write a description for each page, or generate one from its opening text.
- ✕Images have alt textmedium
2 of 5 images across the crawl have no alt attribute. Alt text is how search engines read images and how screen readers describe them.
Describe each meaningful image in its alt attribute.
- ✕There is a route to who you aremedium
No link to an about, team or contact page was found in the pages crawled. These are the pages both people and search engines use to decide whether a site belongs to a real business, and their absence is one of the strongest signals of a site that is not worth trusting.
Link an About and a Contact page from your main navigation or footer.
- ✕A publisher is declared in structured datalow
No publisher in your structured data. It ties each page back to the organisation that stands behind it, which is what carries trust from your brand to an individual article.
Add a publisher property naming your Organization, with its logo.
- –Internal link structure
Not measured — too few pages were reachable to analyse how the site links to itself.
- –Content carries recent dates
Not measured — no page declares a publication or modification date, so how recently the site was maintained cannot be determined. That is normal for a brochure site and worth fixing for anything article-based.
- –Internal authority
Not measured — too few pages were reachable to model how internal links distribute authority.
- –Content depth
Not measured — too few pages were reachable to tell the template apart from what each page actually says.
- ✓No broken internal pages
All 2 crawled pages returned successfully.
- ✓Missing pages return a real 404
No page answers 200 while telling the visitor nothing was found.
- ✓Meta descriptions are unique
All 0 descriptions found are distinct.
- ✓Links describe where they go
0 of 1 internal link(s) use text like 'click here' or no text at all.
- ✓One H1 per page
0 of 2 pages do not have exactly one H1 heading.
- ✓No long redirect chains
No multi-step redirects found.
Local business signals
What Google needs to place you in map results.
0 passed · 0 failed · 1 skipped
100%
- –Local business signals
Not applicable — nothing on this site indicates a physical location customers visit: no address, phone link, opening hours, map or local business markup. Local search checks are skipped and do not affect the score. If you do serve customers from premises, publishing an address and phone number is the place to start.
Infrastructure
DNS, hosting and delivery configuration.
9 passed · 3 failed · 4 skipped
76%
- ✕No lookalike domain can send mail as your brandhigh
We generated and checked 46 plausible misspellings and variants of your domain. 10 of the 10 registered variants has mail servers configured, so it is technically able to send email that reads as yours to anyone skimming a sender address. Many such domains are entirely unrelated businesses that happen to have a similar name — this is a risk to be aware of and to defend against, not evidence that anyone is doing anything.
shaef.shop [mail configured] shaf.shop [mail configured] shead.shop [mail configured] sheaf.co [mail configured] sheaf.com [mail configured] sheaf.io [mail configured] sheaf.net [mail configured] sheaf.org [mail configured]
Publish DMARC at enforcement so mail claiming to be your domain is rejected outright — that is the defence that works regardless of who owns a lookalike. Then register the closest unregistered variants; they cost a few pounds a year and are the cheapest brand protection available.
- ✕DNSSEC enabledlow
DNSSEC is not enabled, so DNS answers for your domain can't be cryptographically verified.
Enable DNSSEC at your DNS provider.
- ✕CAA record restricts certificate issuancelow
No CAA record, so any certificate authority may issue certificates for your domain.
Publish a CAA record naming the certificate authority you use.
- –Mail server IP is not blacklisted
Not checked: the blocklists declined queries from this resolver, so reputation could not be confirmed either way. This is excluded from your score rather than guessed at.
- –Certificate history reviewed
Not measured — the certificate transparency log was unavailable (returned 502).
- –Server log analysis
Not measured — no log file supplied. Server logs are the only source that shows what Googlebot actually fetched rather than what it could fetch: which pages it spends its crawl on, which it has never asked for, and what it receives when it does.
- –Whole-site analysis
Not measured — no whole-site crawl has been run for this domain. The audit above reasons from a sample of pages chosen to cover each template, which describes how the site is built. It cannot say how many of the site's pages are indexable, which templates are thin across every instance, or what sits too deep to be crawled — those are counts, and a sample cannot produce one.
- ✓Redundant nameservers
2 nameserver(s) configured.
- ✓No subdomain can be taken over
Checked 0 subdomain(s); none point at a cloud service that has released them.
- ✓No unbounded URL spaces
No filter, session or calendar URLs that would generate an unbounded space were found.
- ✓Pages are reached without redirect chains
Every page was reached directly or in a single hop.
- ✓Certificate is not shared with unrelated domains
Your certificate covers only your own domain.
- ✓Internal links pass authority
0 internal link(s) are marked nofollow.
- ✓Software versions are not disclosed
No version numbers advertised in response headers.
- ✓Hosting network identified
Served from AS16509 (AMAZON-02 - Amazon.com, Inc.), announced in 216.198.79.0/24 — a block of 256 addresses.
- ✓What this audit examined
2 page(s) were examined, chosen to cover 1 of the 1 distinct page templates found across 2 known URLs. Pages are sampled by template rather than in sitemap order, because the first pages of a sitemap are usually all the same kind — a sample of one template would describe that template rather than the site. Findings below therefore apply to the templates listed, and a fault in a template is normally a fault on every page built from it.
Off-page authority
Who links to this site, with what text, and how that compares.
0 passed · 0 failed · 1 skipped
100%
- –Off-page profile
Not measured — off-page data is not configured on this instance.
What Google's renderer sees
The site loaded in a real browser, the way a visitor and a crawler get it.
10 passed · 3 failed
82%
- ✕All page resources load successfullymedium
3 resource(s) failed to load. Missing images and stylesheets are visible to customers; missing scripts break features.
https://connect.facebook.net/en_US/fbevents.js (failed) https://sheaf.shop/images/favicon.png (failed) https://connect.facebook.net/en_US/fbevents.js (failed)
Fix or remove these URLs.
- ✕Tap targets are big enough to hitmedium
20 of 20 tappable element(s) are smaller than 48x48 pixels, and 2 sit closer than 8 pixels to a neighbour. On a phone that means links and buttons that are hard to hit without zooming, and mis-taps on a checkout or contact button cost conversions directly.
Tout (49x30) Hommes (73x30) Femmes (71x30) Tout (57x30) Classique (89x30)
Give tappable elements at least 48x48 CSS pixels and 8 pixels of spacing — usually padding on the link rather than a bigger font.
- ✕Body text is legible on a phonemedium
16 of 23 text block(s) render below 12px on a mobile viewport. Text that small forces pinch-zooming, which is the single most common reason a visitor leaves a page on a phone before reading it.
Set body text to at least 16px, and never below 12px.
- ✓Content is in the HTML, not built by JavaScript
The served HTML contains 21 words and the rendered page 189 — the content is present before JavaScript runs.
- ✓The mobile page matches the desktop page
What the server sends a phone matches what it sends a desktop browser.
- ✓JavaScript does not rewrite indexing directives
The canonical and robots directives are the same before and after JavaScript runs.
- ✓Largest Contentful Paint under 2.5s (lab)
Measured 0.8s on a simulated phone viewport. Google's threshold for 'good' is 2.5s.
- ✓Navigation links are crawlable without JavaScript
1 links in the served HTML, 0 after rendering — navigation is discoverable.
- ✓Layout stays stable while loading (lab)
Cumulative Layout Shift measured at 0.000 (good is 0.1 or less).
- ✓No JavaScript errors on load
The page loaded without JavaScript errors.
- ✓The page fits the screen
The page fits the mobile viewport with no sideways scrolling.
- ✓No excessive JavaScript blocking
0 long JavaScript task(s) blocked the main thread while loading.
- ✓Reasonable number of requests
The page made 17 network requests to load.
Scan details
| Final URL | https://sheaf.shop/ |
|---|---|
| Host IPs | 216.198.79.1 |
| Pages crawled | 2 of 2 attempted |
| Sitemap URLs | 0 |
| Nameservers | dns1.registrar-servers.com, dns2.registrar-servers.com |
| Mail servers | eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com, eforward4.registrar-servers.com, eforward5.registrar-servers.com |
| DKIM selectors | none found |
| Mail server IPs | 162.255.118.51, 162.255.118.52, 162.255.118.51 |
| TLS | TLSv1.3 · TLS_AES_128_GCM_SHA256 · issued by Let's Encrypt |
| Detected stack | custom / Vercel / Namecheap |
| Browser render | Camoufox (stealth Firefox) · 5.7s · 189 words, 0 links after JavaScript |
2 URLs crawled
- https://sheaf.shop/
- https://sheaf.shop/watches/
Want these fixed?
BounceZero Ltd does this work: technical remediation, local SEO and email deliverability. Tell us what you want fixed and we'll reply with what it takes. No call required, no obligation.
Watch this site
We re-audit on a schedule and email you only when a check that was passing starts failing. That is usually a recent change to the site or its DNS, and it is findable while still fresh. No digest, no newsletter.
Monitoring means repeatedly fetching your site and emailing about it, so we ask you to prove you own sheaf.shop first.