Imprint (Impressum)
Whether the crawled pages link an imprint. Germany and Austria require one by law; elsewhere it is a convention.
An imprint (German Impressum) is a page that names who is behind the site: the person or company, a postal address, a fast way of getting in touch, and where relevant the register entry, VAT number and responsible editor. In Germany (§ 5 DDG, formerly the TMG) and Austria it is a legal requirement for almost every commercial site, and a missing or incomplete one is a classic target of warning letters. Elsewhere it is a convention that simply builds trust.
How SiteScan checks it
The scan looks for a link whose address or text contains impressum, imprint, legal-notice, mentions-legales or «реквизиты». One such link on any crawled page counts for the whole site.
- Green — an imprint is linked.
- Grey — none found. The report does not mark the site down for it, because whether one is owed depends on where the operator is based — which a scanner cannot know.
What to do
If you run a business site addressed to Germany or Austria, publish the imprint on its own page and link it from every page — the footer is the usual place, and the rule is that it must be reachable in no more than two clicks. Keep it separate from the privacy policy; both are expected.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Privacy & consent”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data