flagtail
Sample report Get My Report

Sample report

Harborview Family Dental

harborviewfamilydental.example

Checked October 8, 2026, 2:14 PM EDT How Outside-in review of the public website, desktop and phone Delivered as web report and PDF

This report is for a fictional dental practice. Your own report covers your own website, in the same layout.

The short version

Most of what a patient is likely to try works. One booking link is broken and one booking button could not be checked. Two other things are worth a conversation with whoever looks after your website and email.

Customers

Business risk

Trust

Looks good

Can patients do what they came to do?

We tried the three things a patient is most likely to try: book, call, and send a message. Each was tried on a desktop screen and a phone-sized screen. Nothing was submitted and no appointment was created.

Needs attention

A booking link on one page no longer reaches your scheduler.

What we found
The Book an Appointment button on your Services page goes to a page that no longer exists. The booking button on your homepage still opens your online scheduler and shows the new patient and existing patient choice. We did not pick one.
Why it matters
A patient who lands on Services first may assume online booking is unavailable and either wait to call during office hours or look at another practice.
What to do
Ask whoever manages your website to point the Services button at the same booking address your homepage uses. Then tap it once on a phone to confirm.
Details for your provider 
Finding       PATH-BOOKING-404
Source page   /services
Control       "Book an Appointment" (button)
Destination   https://harborviewfamilydental.example/book-now
Result        HTTP 404, site's own not-found page
Confirmed     2 attempts, desktop and phone, same result
For comparison / > "Book Online" > third-party scheduler
                 loaded in 1.8 s, 2 choices visible, none selected
Checked       2026-10-08 14:21 EDT

Terms used here: HTTP 404

Could not verify

The Book Now bar on phones opened a page we could not check.

What we found
On a phone-sized screen, a Book Now bar stays fixed at the bottom of every page. Its destination blocked our automated visit, so we could not tell whether it works. This is not a problem we found.
Why it matters
Phones are where most patients will tap that bar, so it deserves one manual look.
What to do
Tap it yourself on a phone. If a scheduler opens, nothing more is needed.
Details for your provider 
Finding       PATH-BOOKING-UNVERIFIED
Source page   all pages, phone viewport only
Control       "Book Now" (fixed bar)
Destination   https://secure-booking.example/harborview
Result        bot challenge page (HTTP 403), check did not finish
Attempts      2, same result
Checked       2026-10-08 14:23 EDT

Terms used here: HTTP 403 and bot challenge, viewport

Good

Your phone number is tap-to-call on phones.

On the phone-sized screen, the number in your header starts a call, and the number it dials matches the number shown. See the note under Trust about the two numbers.

Good

Your contact form loads and shows its fields.

The form on your Contact page loaded on desktop and phone, with name, phone, message and a Send button visible. We did not fill it in or send anything, so send yourself a test message now and then to confirm it arrives.

Details for your provider 
Finding       PATH-CONTACT-FORM-LOADS
Page          /contact
Fields seen   name, phone, message, submit (4)
Viewports     desktop, phone
Submitted     no
Checked       2026-10-08 14:20 EDT

Terms used here: viewport

Is anything putting the business at risk?

A small set of public settings that can expose the practice or its patients. Each is read from the outside. Nothing is tested by trying to get in.

Worth reviewing

Your email domain is set to watch for fake mail but not block it.

What we found
Your domain has an email protection record (DMARC), and its policy is set to monitor only. It tells receiving mail systems to take no action on messages that fail the check.
Why it matters
Patients get appointment and billing email from your domain. Someone could send them a fake invoice that appears to come from your practice, and receiving systems have not been told to stop it.
What to do
Ask your IT or email provider whether this is still an intentional monitoring phase, and whether the services that send email for you, such as your scheduler or billing system, are ready for a stricter setting. Monitoring first is normal. Switching too fast can block legitimate mail.
Details for your provider 
Finding       EMAIL-DMARC-MONITOR
_dmarc TXT    v=DMARC1; p=none; rua=mailto:dmarc@harborviewfamilydental.example
SPF TXT       v=spf1 include:spf.protection.outlook.com -all
Mail host     Microsoft 365 (MX)
Checked       2026-10-08 14:16 EDT

Terms used here: DMARC, SPF, MX, TXT record

Good

Your site's security certificate is valid.

The certificate matches harborviewfamilydental.example and does not expire until March 2027.

Good

Visitors who type the plain address are sent to the secure version.

Opening the http address redirected to https on the homepage.

Is anything quietly hurting trust?

Inconsistent or conflicting details can make a practice look careless, even when everything works.

Worth reviewing

Phone visitors and desktop visitors see different phone numbers.

What we found
Your header shows (727) 555-0142 on a desktop screen and (727) 555-0188 on a phone-sized screen. Each number is tappable and dials as shown.
Why it matters
Showing different numbers by device is sometimes intentional. If it is not, one of the two may be an old line that no one answers.
What to do
Ask whoever manages your website whether both numbers are expected. If not, have them keep one.
Details for your provider 
Finding       CONTACT-PHONE-BY-VIEWPORT
Desktop 1280x800  text "(727) 555-0142"  href tel:+17275550142
Phone 390x844     text "(727) 555-0188"  href tel:+17275550188
Repeat load       same results on both
Call-tracking script  none identified
Note          If dynamic number insertion or campaign tracking
                 is intentionally in use, confirm both numbers are expected.
Checked       2026-10-08 14:19 EDT

Terms used here: viewport, tap-to-call link

Good

Your address is the same everywhere we looked.

The street address matches on the homepage, the Contact page and the footer.

Other things we noticed

A few things from reading your pages. These are observations, not tested findings, so they have no status.

What is behind the website?

Three things about how your website is put together that are worth a question. The full record is on the Website reference page at the end of this report.

Three different companies hold the pieces of your website.

Your domain name is registered with Namecheap, its address records run through Cloudflare, and the site itself is hosted by WP Engine.

Do you know who holds the login for each one?

Your online scheduler is on another company's account.

Appointments are handled by Adit, separate from your website provider.

Is that account in your practice's name, and who holds the login?

Two analytics and advertising systems are running.

Google Analytics 4 with Google Tag Manager, and Meta Pixel.

Is that intentional, and does your privacy page mention them?

What we checked, and what we did not

Checked

  • Your homepage and the pages in your main menu (6 pages).
  • Desktop (1280 wide) and phone (390 wide) screens.
  • One tap or click per button, link or form, up to 15 seconds.
  • Public records for your domain, email and hosting.

Not checked

  • Pages deeper than your main menu.
  • Anything behind a login, including patient portals.
  • Form submissions, appointments, payments or any personal information.
  • Whether your site meets any legal or compliance standard.

A Good result in this report applies only to the specific button, page or setting named in that finding. If we could not finish a check, we say so and do not guess. When an area has nothing to report, we tell you which checks completed.

What to hand to your provider

Forward this page, or the provider details under each finding. Everything they need to reproduce what we saw is there.

  1. Web manager. Fix the Services page booking link (PATH-BOOKING-404) and confirm the two phone numbers are expected (CONTACT-PHONE-BY-VIEWPORT).
  2. IT provider. Say whether the DMARC monitoring phase is intentional and when a stricter setting is planned (EMAIL-DMARC-MONITOR).
  3. You. Tap the Book Now bar on a phone once, check the two things we noticed about holiday hours and the extension, and fill in who holds each login on the Website reference page.

Appendix

Website reference

Harborview Family Dental, harborviewfamilydental.example. This is what was publicly visible on October 8, 2026. We never ask for or record logins. The last column is for you to fill in.

ItemWhat we foundWho holds the login
Primary domainharborviewfamilydental.exampleWho holds the login
Domain registrarNamecheapWho holds the login
Registered toCould not determine. The registrar's privacy service hides the owner's name.Who holds the login
Domain expirationMarch 14, 2028Read from public registration records on October 8, 2026.Who holds the login
DNS providerCloudflareWho holds the login
Website hostingWP EngineWho holds the login
Website platformWordPressWho holds the login
Email providerMicrosoft 365SPF present, DKIM signing keys found, DMARC monitor only.Who holds the login
Known public subdomainswww, bookFrom bounded public records. This list may be incomplete.Who holds the login
Booking providerAditWho holds the login
Forms providerJotformWho holds the login
Payment providerNot detected on the pages we checked.Who holds the login
Other connected servicesGoogle Analytics 4, Google Tag Manager, Meta PixelWho holds the login

Keep this page with your business records. If your website provider changes, this is the basic information you will want at hand.

Not sure what a term means?

Only the terms that appear in this report are listed.

HTTP 404
The standard message a website gives when a page does not exist. The link points to an address with nothing behind it.
HTTP 403 and bot challenge
A website refusing a visit, often because it suspects an automated tool. We treat it as a check we could not finish, not as a fault.
Viewport
The size of the screen a page is shown on. We use a desktop size and a phone size.
Tap-to-call link
A phone number set up so that tapping it on a phone starts a call.
TXT record
A line of text stored with your domain name. Email protection settings are kept in these.
MX
The record that says which service receives email for your domain.
SPF
A list of the services allowed to send email as your domain.
DKIM
A digital signature added to your outgoing email so receivers can tell it really came from you.
DMARC
Your instructions to receiving mail systems about what to do with messages that fail the SPF or DKIM checks. Monitor only (p=none) means receivers take no action and send you reports. That is the normal first stage before a stricter setting.

Get a report like this for your own website.

One website, one report, $29.99 one time. No subscription, nothing to install.

Get My Report