--- title: "Main Page Analyzer: Security Headers & Performance | WebPixie" description: "Audit your homepage: 15+ security headers across 50+ checks, request timing, HTTP version, the redirect chain, and canonical and hreflang signals, scored as a Main Page Score." canonical: "https://webpixie.io/features/main-page-analyzer" source_path: "/features/main-page-analyzer" lang: "en" generated_by: "scripts/generate-md.mjs" --- [Back to Features](/features.md) Main Page Analyzer # Homepage analyzer for security headers, performance, and redirects A technical audit of your homepage: HTTP security headers, request timing, protocol and HTTP version, the redirect chain, and canonical and hreflang signals, rolled into a Main Page Score. Start monitoring free 50+ header checks Performance timing Free plan, no credit card Main page analysis is included in the free plan. [Compare all plans](/pricing.md) ### Every finding maps to a standard, with a point impact A sample of what a homepage scan surfaces. WebPixie runs 15+ security headers across 50+ checks, grades each by severity, and ties it to a recognized standard, so the score is evidence rather than guesswork. ### See exactly where homepage time goes Each request phase is timed separately, from DNS lookup to the first byte. Your homepage is re-scanned every day. ### See which HTTP protocols your site supports WebPixie reports the protocols negotiated on the request, so you can confirm HTTP/2 is on and HTTPS is enforced. ### Trace every redirect, hop by hop A 200 at the end does not mean the path was clean. WebPixie traces each hop, so an extra redirect or an HTTP-to-HTTPS gap shows up instead of hiding behind the final response. ### Confirm the canonical and language alternates engines read WebPixie extracts the canonical URL and every hreflang alternate on the homepage, so you can confirm engines see the version you intend. ## How WebPixie analyzes your main page Your homepage is the page engines crawl most often and the first thing most visitors and bots see, so a problem there has the widest reach. WebPixie loads your homepage the way a browser does and measures the whole request: the HTTP version and protocol, the redirect chain, the status code, request timing, content size, and the security headers returned. Each part feeds the Main Page Score, a 0 to 100 figure that also rolls into your composite WebPixie Site Score. The header analysis covers 15+ security headers across 50+ checks, including HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, the cross-origin policies (COOP, COEP, CORP), CORS, Cache-Control, and cookie flags. A missing or weak header is flagged with its severity, so you can see which defenses are in place and which are absent. Performance and delivery sit in the same report. WebPixie shows where time goes across the request, whether HTTP to HTTPS is actually enforced, and whether the canonical and hreflang on the homepage point where you expect. 01 ### Score your homepage security headers 15+ headers, 50+ checks, each with a severity Security headers are easy to misconfigure and easy to forget after a deploy. WebPixie checks HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, the cross-origin policies, CORS, and cookie flags. Each finding carries a severity, so a missing Content-Security-Policy, which removes a layer of protection against cross-site scripting, ranks above a cosmetic gap. 02 ### See where homepage time goes Request timing, content size, HTTP version A slow homepage costs conversions and visibility. WebPixie measures the request end to end, from DNS and connection setup through TLS and time to first byte, and reports the content size and the HTTP version negotiated. You can see whether the page is served over HTTP/2 and where the largest delays sit. 03 ### Confirm HTTPS is actually enforced The full redirect chain, hop by hop An http URL that does not redirect to https, or a chain that bounces through extra hops, costs both performance and trust. WebPixie follows the redirect chain hop by hop and shows the response headers at each step, so you can confirm http to https is enforced and the chain is as short as it should be. 04 ### Check homepage canonical and hreflang The signals engines read first The homepage is the page engines crawl most, so its canonical and hreflang signals carry weight. WebPixie extracts the canonical target and checks whether it is self-referencing or points elsewhere, including cross-domain. It reads the hreflang alternates and flags non-reciprocating pairs, where one locale links to another that does not link back. This tells you which URL engines treat as the original, and it works alongside the site-wide view from the indexability checker. ### Analyze your homepage in 60 seconds Free plan, no credit card. Included on every plan. [Start monitoring free](https://app.webpixie.io/app?lang=en&utm_source=website&utm_medium=website_link&utm_campaign=features_main_page_analyzer&utm_content=mid_cta) ## Everything you need to monitor a website. In one workspace. A quick look at other WebPixie features. Main Page Analyzer Find what slows down or breaks your homepage. Currently viewing [Uptime](/features/uptime-monitoring.md) Catch downtime first with multi-region and keyword checks. Learn more [Domain](/features/domain-monitoring.md) Never be caught off guard by a domain renewal or transfer. Learn more [DNS](/features/dns-monitoring.md) Spot unexpected DNS and DNSSEC changes with daily checks. Learn more [SSL](/features/ssl-monitoring.md) Get warned 15 days before certificates expire, with daily SSL checks. Learn more [Certificates](/features/certificates-manager.md) See every certificate and its expiry in one place. Learn more [Link Crawler](/features/link-crawler.md) Find broken links before your visitors do. Learn more [Indexability](/features/indexability-checker.md) Check whether search and AI engines can access your content. Learn more [Incidents](/features/incident-management.md) Track failures from detection to resolution in one place. Learn more [API](/features/api-integration.md) Automate monitoring with the GraphQL and REST API. Learn more [Workspaces](/features/workspace-management.md) Organize monitoring and bring your team into one workspace. Learn more ## Why teams choose WebPixie for homepage analysis ### Set up in 60 seconds No agent to install and no access to your server needed. Enter a domain and WebPixie analyzes the homepage from its own servers. ### Your whole site in one workspace Main Page analysis sits next to uptime, SSL, DNS, domain, and link health in one dashboard. Its header and homepage checks roll into your composite Site Score. ### Headers and performance together One report covers security headers, request timing, and redirects, so you fix the homepage in one place. ### Frequently Asked Questions Common questions about the Main Page Analyzer. ### What does the Main Page Analyzer check? The Main Page Analyzer checks the technical health, security posture, and SEO-critical signals on your homepage. WebPixie calls the homepage and evaluates response time, protocol support, HTTPS enforcement, redirect chains, canonical URL, hreflang tags, meta tags, cache directives, cookie attributes, and HTTP security headers. Header checks include HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, CORS, and Cache-Control. The [Main Page Analyzer](/features/main-page-analyzer.md) assigns findings a severity level such as CRITICAL, HIGH, MEDIUM, LOW, or INFO so teams can decide what to fix first. It complements [Indexability Checker](/features/indexability-checker.md) checks for crawl and indexing signals, and [uptime monitoring](/features/uptime-monitoring.md) checks for ongoing availability and response behavior. ### Can I monitor campaign landing pages? Yes, you can monitor campaign landing pages and find out fast when one is broken, slow, or incorrect. [Uptime monitoring](/features/uptime-monitoring.md) can check each landing page for reachability, response time, expected status code, redirects, and body keywords such as a campaign headline or form text. This helps catch issues like expired pages, failed deployments, broken tracking redirects, server errors, and missing conversion elements while campaigns are active. You can configure alerts through the notification channels available on your plan, so marketing, growth, or DevOps teams can respond before budget is wasted. For page-quality issues beyond availability, the [Main Page Analyzer](/features/main-page-analyzer.md) can surface caching, header, redirect, canonical, and meta problems that may affect conversion or search visibility. Use the [Link Crawler](/features/link-crawler.md) to find broken links connected to campaign pages. ### What does the connection-timing waterfall show? The connection-timing waterfall in the [Main Page Analyzer](/features/main-page-analyzer.md) breaks a homepage request into timed phases, so you can see where load time is spent. It records DNS lookup, TCP connection, TLS handshake, pre-transfer wait, time to first byte, content download, and the total, each as its own measurement. When a page feels slow, the waterfall shows whether the delay sits in DNS resolution, the TLS handshake, or the server's time to first byte, which points you at the layer to fix. It runs alongside the request and redirect path, HTTP protocol support flags, and canonical data on the Main Page view. This timing data is live today; Lighthouse-based SEO and performance scoring is in development and not yet part of the analysis. The waterfall complements response-time trends from [uptime monitoring](/features/uptime-monitoring.md), and you can compare plan limits on the [pricing page](/pricing.md). ### Can I see how fast my landing pages load? Yes, WebPixie shows response time data for landing pages during uptime checks. [Uptime monitoring](/features/uptime-monitoring.md) measures how long each monitored page takes to respond from the selected monitoring locations, so you can spot slowdowns, timeouts, and regional access problems while campaigns are running. This is especially useful for ad landing pages, checkout entry points, lead forms, and campaign pages where slow server response can reduce conversions. WebPixie can also validate expected status codes and body keywords, helping confirm that the page is both reachable and serving the right campaign content. The [Main Page Analyzer](/features/main-page-analyzer.md) adds technical context by checking response time, protocol behavior, redirect chains, cache headers, cookies, and other header-related issues. For broken or slow linked destinations, combine this with the [Link Crawler](/features/link-crawler.md). ### Does the Main Page Analyzer check HTTP/2 and HTTP/3 support? Yes. The [Main Page Analyzer](/features/main-page-analyzer.md) detects which protocols your homepage supports and shows flags for HTTP, HTTP/2, HTTP/3, HTTPS, and whether HTTP redirects to HTTPS. These flags tell you whether visitors and crawlers can negotiate a faster HTTP/2 or HTTP/3 connection or are falling back to older protocols. The same view records the full request and redirect path with per-hop headers, the canonical URL and its alternates, and the connection-timing waterfall, so a missing HTTPS redirect or an unexpected hop is visible in one place. Protocol and header signals here overlap with what [SSL monitoring](/features/ssl-monitoring.md) validates on the certificate side, which is why teams often watch both. You can compare plan limits on the [pricing page](/pricing.md). [See all FAQs](/resources/faq.md) ### Ready to score your homepage? Free plan, no credit card. Headers, performance, and redirects in one audit. [Start monitoring free](https://app.webpixie.io/app?lang=en&utm_source=website&utm_medium=website_link&utm_campaign=features_main_page_analyzer&utm_content=bottom_cta) [See all features](/features.md) ## Source Attribution This file is automatically generated by WebPixie AI and summarizes publicly available content from WebPixie pages. Authoritative details should always be verified from the original URLs.