The fifteen-minute test that tells you if your website is broken

Our own website threw a certificate warning this morning. The full red screen, the one that says your connection is not private, on a studio that builds websites for other people.

Nothing warned me. No email, no alert, no dashboard turning orange. I went to load a page and the browser stopped me at the door.

So run these seven checks on your own phone. Fifteen minutes, and the only login you need is your own email. Each one is a pass or a fail. Most of the small business sites I audit fail two or three.

Nothing on your website will ever tell you it stopped working. The form will not send you an email to say it stopped sending emails.

Check 1: Does your site still have a padlock? (2 minutes)

Open your homepage on your phone and look at the address bar.

If you get a warning screen, or the words "Not secure" sitting next to your address, your security certificate expired or was never set up properly. Visitors who hit that screen leave. A good number of them assume you got hacked and tell a friend.

Certificates run on a clock, and that clock sped up this year. The CA/Browser Forum, the group of browser makers and certificate authorities that writes these rules, voted in April 2025 to shorten how long a certificate can live. On March 15, 2026 the maximum dropped from 398 days to 200. In March 2027 it drops to 100. By March 2029 it will be 47 days.

A renewal you used to handle once a year is now twice a year. In three years it is closer to every seven weeks. If your host does not renew automatically, this will keep catching you, and it will catch you more often each year.

Pass: padlock, no warning. Fail: anything else. Call your host today. This one costs you customers every hour it stays broken.

Check 2: Tap your own phone number (1 minute)

Find the phone number on your homepage. Tap it with your thumb, the way a customer would.

Your phone should offer to call. If nothing happens, that number is either baked into an image or sitting there as plain text nobody linked. Every person who tried to call you from their phone had to memorize seven digits or give up.

A barbershop in Fishers had their number set inside the logo graphic. Six years of that. The owner had no idea, because he had never once tapped his own phone number.

This is one item from a longer mobile pass I published last spring, and if this check fails, the rest of that list is worth running on your phone too.

Pass: it dials. Fail: it does nothing when you tap it.

Check 3: Where does your contact form actually go? (3 minutes)

Fill out your own contact form. Put the word "test" in the message. Hit submit.

Most people stop there. Go find that email. The page saying thank you proves nothing on its own. You are checking whether a message reached an inbox that a human being opens.

An HVAC contractor in Brownsburg discovered his form had been delivering to an office manager who quit in 2023. Eighteen months of quote requests went into an account nobody had the password to. He found out because a customer called to ask why he never heard back.

Forms rot silently. The plugin updates, the host changes mail providers, somebody's email address goes away, and the form keeps showing a cheerful confirmation message the whole time. I have watched a contact form swallow six months of leads without a single visible symptom.

Pass: your test message is in a live inbox within five minutes. Fail: you cannot find it, or it landed somewhere nobody checks.

Check 4: Do your hours match your Google profile? (2 minutes)

Read the hours off your website. Then open your Google Business Profile and read those. Word for word, day by day.

A veterinary clinic in Westfield had Saturday 8 to 2 on the website and closed Saturdays on the profile. Both had been true at some point. Only one was true that month, and the profile is the one people saw.

Google shows profile hours in search and in Maps, which is where most people check before they drive over. When the two disagree, the customer follows the profile and blames the website. If your profile is doing the heavy lifting anyway, that is worth understanding, because for a lot of local shops the profile outperforms the website by a wide margin.

Pass: identical, including holidays. Fail: any day is different. Fix the profile first, then the site.

Check 5: Turn off Wi-Fi and load your homepage (2 minutes)

Turn off Wi-Fi on your phone. Walk out front, where your customers stand. Load your homepage on cell data and count out loud until you can read something.

Google's own target for this is 2.5 seconds, measured across the slowest quarter of your visits. Your shop Wi-Fi with everything already cached will lie to you about this. Stand in the parking lot with two bars and trust that number instead.

Pass: you are reading real text by the count of three. Fail: you counted past five, or you watched a spinner.

Check 6: Change one word (3 minutes)

Pick something small and true. Add "Closed Sundays" to your homepage, or fix a typo you have been ignoring.

Time yourself. If you can log in and change it in under five minutes, you own your website. If you have to email somebody and wait, you are renting it, and the rent includes a delay every time reality changes.

A tailor in Zionsville needed her holiday hours updated in December. Her developer replied on January 4. She had already written the hours on an index card and taped it to the door, which worked better than her website did.

That gap is the real cost of a cheap site, and it rarely shows up on the invoice. Free website builders charge you here instead.

Pass: the change is live and you did it yourself. Fail: you had to ask permission.

Check 7: Ask an AI what you sell (2 minutes)

Open ChatGPT or Gemini and ask it what your business does and when it is open. Use your business name and your city.

A brewery in Garfield Park got back a confident answer about a taproom that closed in 2022, along with hours from a menu page they deleted. The information was old and the tone was certain, which is the worst combination for a customer deciding where to spend Friday night.

More people start here every month, and being on Google Maps does not mean an assistant has ever heard of you. If the answer is wrong, the fix usually starts with putting the correct hours, services and address in plain readable text on your own pages, where a crawler can find them.

Pass: it describes your business accurately. Fail: it invents something, mixes you up with another shop, or draws a blank.

What your score means

Add up your passes.

Seven out of seven. Your site is doing its job. Go back to work, and run this again in six months when your certificate renews.

Five or six. One Saturday of somebody's attention. Nothing here is a rebuild, and none of it requires a new website.

Four or fewer. Your website is costing you money right now, quietly, and has been for a while. Start with checks 1 and 3, because a security warning and a dead contact form both lose customers who were already sold. If a few of these failed and you would rather not spend your Saturday on it, tell us which ones and we will tell you what it takes.

None of these checks need a developer. Six of the seven need nothing but your thumb.

We renewed our certificate this morning. The whole fix took eleven minutes, and nine of those were spent finding the login.

---

Sources

#	Source	What it backed up
1	Ballot SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods	The CA/Browser Forum approved the schedule shortening certificate lifetimes in April 2025, running from March 2026 to March 2029.
2	TLS Certificate Lifetimes Will Officially Reduce to 47 Days	The phase dates: 398 days until March 15 2026, then 200 days, 100 days in March 2027, and 47 days in March 2029.
3	Largest Contentful Paint (LCP)	Google's 2.5 second loading target, measured at the 75th percentile of page loads and split by mobile and desktop.
4	Edit your business hours	Business Profile hours are what Google displays in Search and Maps, separately from anything on your own website.