How the Business Health Score works
You give us a website address. About sixty seconds later you have one number from 0 to 100, a letter grade, nine category scores and a ranked list of fixes. Here is exactly what happens in between, so you can trust the number.
1. What we read
Everything comes from public sources that anyone — Google, a customer, an AI crawler — can also see:
- Your pages. The homepage, then a small sample of internal pages (contact, about, services, and whatever the homepage links to). We fetch at most a few dozen pages, three at a time, and identify ourselves as CohelmBot.
- robots.txt and the XML sitemap, parsed the way Googlebot parses them.
- DNS records — A/AAAA, MX, TXT (SPF, DMARC, DKIM selectors), NS, CAA, DNSSEC — via DNS-over-HTTPS.
- The TLS certificate presented by your server: validity, expiry, protocol.
- The domain registry (RDAP): registrar, creation and expiry dates, transfer lock.
- Public archives and indexes: the Wayback Machine for site history, popularity rank and link-authority estimates.
- Google PageSpeed Insights for Lighthouse scores and real-user Core Web Vitals.
We never submit forms, never log in, never call or email anyone, and never store your pages beyond the two hours the report link stays live.
2. The nine questions
Every check belongs to one of nine categories. Each category is phrased as the question a customer, Google or an AI assistant is effectively asking about your business, and each carries a weight reflecting how much it tends to move revenue for a typical small or mid-sized business.
| Category | The question | Weight |
|---|---|---|
| Findability | Can Google find and understand the site? | 18% |
| Lead capture & responsiveness | When someone wants to buy, can they reach you in 10 seconds? | 16% |
| Google presence | Are you set up on the platform most customers use? | 14% |
| AI visibility | Do ChatGPT, Gemini and Perplexity know and recommend you? | 10% |
| Speed & mobile | Does the site load fast enough on a phone? | 10% |
| Trust & security | Does the site look and behave like a legitimate business? | 8% |
| Social & reputation | Are you present and reviewed where customers look? | 10% |
| Content & authority | Is there enough substance for people and machines to trust? | 8% |
| Email & domain health | Do your emails land? Will your domain quietly expire? | 6% |
3. How a check becomes a number
Each of the ~120 checks returns one of five statuses:
- Pass — full credit.
- Warn — half credit. Present but weak, or borderline (a 900 ms server response, a DMARC policy of
none). - Fail — no credit.
- Info — recorded for context, not scored (which CMS you use, which tools we detected).
- Skipped — we could not run it (third-party data unavailable, or the site blocked our scanner). Excluded from the denominator so it never counts against you.
Each check also has a weight from 1 (minor) to 5 (critical). A category score is the weighted credit earned divided by the weighted credit available. The overall score is the weighted average of the nine categories. Grades: A 90+, B 75–89, C 60–74, D 45–59, F below 45.
4. How fixes are ranked
“Fix these first” is not the list of failures in the order we found them. Each failing or warning check is ranked by category weight × check weight × how far from passing it is, so a missing phone number on a service business outranks a missing Permissions-Policy header — even though both are “fails”. The top of the list is where an hour of work buys the most.
5. What we deliberately do not do
- We do not guess traffic or revenue. Estimates from third parties are wildly inaccurate for small sites, so we show only a popularity rank, clearly labelled.
- We do not penalise you for blocking our scanner. If your firewall rate-limits us, those checks are marked as blocked, not failed.
- We do not score things we cannot see from the URL — how quickly you answer the phone, how good the work is. The report tells you how you look; that is its whole job.
6. Accuracy and false positives
Automated checks are conservative by design. Where a rule is ambiguous (Shopify's glob-style robots rules, privacy policies opened from a button rather than a link, sites that answer 200 for missing pages) we have tuned the checks against real sites to avoid crying wolf. If you believe a finding is wrong, re-run the check — many transient issues clear — and if it persists, email hello@cohelm.co with the report link. We fix the check, not the score.
Questions
Why is my score different from my SEO tool's score?
SEO tools score the website for search engines. Cohelm scores the business across nine areas — search is one of them, alongside whether a customer can reach you, whether AI assistants can read you, whether your email lands, and whether the site looks trustworthy. A technically perfect site with no phone number will score lower here than in an SEO tool.
Why do some categories show partial?
Some checks depend on third-party data (Google PageSpeed, listing data) that is occasionally unavailable or rate-limited. Those checks are marked skipped and excluded from the score rather than counted as failures.
Can I re-run the check after fixing things?
Yes, as often as you like. Scores usually move within minutes of a fix because we read the live site — with the exception of real-user Core Web Vitals, which Google aggregates over 28 days.