Privacy policy link
Whether the crawled pages link a privacy policy. Any site that takes a form entry, sets a cookie or logs an IP address needs one.
A privacy policy tells visitors what personal data the site collects, why, on what legal basis, how long it is kept, who it is shared with and how to exercise their rights. Under the GDPR it is not optional for anyone processing personal data — and a contact form, an analytics cookie or a server log with IP addresses already counts. Payment providers, ad networks and app stores also expect a link to one.
How SiteScan checks it
The scan reads every link on the crawled pages and looks at both the address and the anchor text for words such as privacy, datenschutz, prywatnosci or «конфиденциальность». A single matching link on any page — usually the footer — counts for the whole site.
- Green — a privacy policy is linked.
- Red — no crawled page links one; the report also raises a medium-severity finding listing which legal pages are missing.
When the scan could not read any page at all (for example, bot protection answered every request), no finding is raised.
Fixing it
Publish the policy on its own URL and link it from the global footer so it is reachable from every page, including landing pages. Keep it in step with what the site actually loads — the trackers the scan detects are a good checklist.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Privacy & consent”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data