Website owners are usually the last to know something is broken. A customer messages you: "your form won't send." A friend asks why your company has no description under its Google link. By then the leads have gone to a competitor. Almost all of these problems show up in a couple of minutes with an automated check: speed, search snippets, certificates, email, legal pages and privacy law. Here are seven silent leaks to start with.
Why silent? Because the site still loads and looks fine. You open it on your work laptop, see a nice home page and assume everything is OK. The nastiest leak on this list is number six. It doesn't just lose customers. It can cost you real money in fines.
Leak 1. Your site loads slower than people will wait
A slow site loses visitors before they read a single line. A 2016 Google study of more than 10,000 mobile sites found that 53% of visits are abandoned when a page takes longer than three seconds to load. The number is a decade old and networks are faster now. People's patience isn't.
Today speed is measured with three Google metrics called Core Web Vitals (Google's main signals for how pleasant a page feels to use):
- LCP (how long until the main block of the page shows up): good is 2.5 seconds or less.
- INP (how fast the page reacts when you tap something): good is 200 milliseconds or less.
- CLS (how much the layout jumps around while loading): good is 0.1 or less.
You know the moment. You reach for "Buy," a banner pops in at the top, and your thumb lands on an ad. That's bad CLS. The thresholds are public, so you can check speed as a number instead of a gut feeling. Each metric is explained in our Core Web Vitals guide.
A fast site still has to be found, though. That's where the second leak starts.
Leak 2. Your search result has no description, or the wrong one
People decide whether to click based on two lines in the results: the page title and its description. Leave the description empty and the search engine grabs random text, something like "Your cart is empty. Sign in. Register." Next to nine tidy snippets (the preview of a link in search results), that looks abandoned.
What to check: every important page has its own title under 60 characters and a description of roughly 140 to 160 characters. Your site isn't blocked in robots.txt (a small file that tells search crawlers where they may go). You have a sitemap and no broken links. A robots.txt mistake is especially sneaky. One line can remove your whole site from Google while everything looks normal from the outside.
Leak 3. ChatGPT and Google's AI answers can't see you
More and more people get their answer right on the search page and never click through. In 2025 Pew Research Center tracked the browsing of 900 U.S. adults. When Google showed an AI summary above the results, people clicked a regular link in 8% of visits. Without the summary, it was 15%. Links inside the summary itself got clicked in just 1% of visits.
So if an AI search tool can't read your site, it won't quote you or mention you. Common causes: the text is drawn by a script after the page loads, so the crawler sees an empty page; AI crawlers are blocked in robots.txt; or your pages don't have short, clear answers to real questions. If you're new to these assistants, start with our beginner's guide to ChatGPT, Claude and Gemini. For fixes on your own site, see the AI search visibility guide.
Leak 4. Your certificate expires and the browser scares people off
An SSL certificate (the site's digital ID, the reason you see https and a padlock) has an expiry date. When it lapses, the browser shows a red "Your connection is not private" warning instead of your home page. Few people click through that.
This leak got riskier in 2026. In April 2025 the CA/Browser Forum, the group of certificate authorities and browser makers including Apple, Google, Microsoft and Mozilla, voted without a single no to shorten certificate lifetimes. Since 15 March 2026 a certificate can last at most 200 days, down from 398. From March 2027 the limit is 100 days, and from March 2029 just 47. If you renew by hand once a year, sooner or later you'll miss one. Here's how to check your certificate.
The certificate protects your site. But what protects the emails sent in your name?
Leak 5. Scammers email your customers from your address
If your domain doesn't have SPF, DKIM and DMARC set up (three records that prove to email providers a message really came from you), anyone can send mail that appears to come from info@your-company. Your customer gets an "invoice" from a familiar business and pays a scammer. You're the one who has to clean it up.
It's the same trick as voice fakes: criminals copy whatever people trust without checking. We covered how little audio it takes to clone a voice. Email is easier to protect. It's three records in your domain settings, explained step by step in the SPF, DKIM and DMARC guide.
Leak 6. Your forms and cookies break privacy law
The most expensive leak is a legal one. The EU, the U.S., Kazakhstan, Russia, Belarus and many other places have personal data laws, and websites break them in the same few ways:
- a form collects a phone number or email with no consent checkbox and no link to a privacy policy;
- there's no privacy policy, or it doesn't say who handles the data and why;
- Google Analytics and ad trackers start before the visitor clicks "Accept" on the cookie banner.
What that can cost depends on the country and the size of the business:
- European Union (GDPR, Article 83): up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaking core rules such as consent. GDPR also applies to sites outside the EU that serve people in the EU.
- Kazakhstan (Administrative Code, Article 79): collecting data without consent costs from 259,500 tenge for a small business to 865,000 tenge for a large one. If the data leaks, fines go up to 8.65 million tenge.
Regulators rarely hand out the maximum. They weigh how serious the breach is, how many people it touched and how quickly you fixed it. Still, one annoyed visitor's complaint can be enough to start an inquiry. See the full breakdown of GDPR fines and the Kazakhstan fines table.
The upside: this leak is the quickest to plug. You can build a policy with the free privacy policy generator and a banner that holds trackers back until consent with the cookie banner generator. Both come with setup notes for Tilda, WordPress, Bitrix and InSales.
Leak 7. The site opens for you but not for customers abroad
You open your site at the office and it works. A buyer one border over just sees a spinning wheel. The cause might be a block, an ISP outage, or security settings strict enough to shut out whole countries. You won't find out until someone writes "your site won't load."
The availability check opens your site from nodes in six countries, so you can see at a glance where it's unreachable.
How to check your site for all 7 leaks for free
Hunting each leak with a separate tool takes ages. That's why the Awe Reads team built Awe Check, a free website check with no sign-up. It opens your site the way a visitor would and runs more than 50 checks in one go.
- Open Awe Check and paste your address.
- Pick a market: the EU, the U.S., Kazakhstan, Russia or Belarus. You can pick several if you sell across borders.
- In about a minute you get a score from 0 to 100, a list of problems and the possible fine. The fine counts only actual violations. Risks are listed separately.
- Start with the fix-first block. It's sorted by harm and benefit.
The report lives at a permanent link and downloads as PDF or Markdown, so it's easy to send to your developer. Prefer chat? Send your address to the Telegram bot @AweChecksbot and it replies with your score and the top three problems.
What to do after the check
Don't try to fix everything in one evening. Take the three items doing the most harm, fix them and run the check again. The score updates, and you see what really changed and what only looked fixed.
Wondering why customers pick a competitor? Run a site battle: two addresses, one rulebook, and you see exactly where you fall behind. Once your score is good, you can show it off with a badge on your site.
Sites change every week, and certificates now expire faster. So you don't have to check by hand, Awe Check Pro will watch your sites and your competitors' sites. It messages you on Telegram or by email when the score drops, a certificate or domain is about to expire, or the site stops opening in a country. Pro is getting ready to launch, and checking one of your own sites once a month stays free.
Remember the customer who wrote "your form won't send"? Next time, you can know before they do. Open Awe Check and test your site now. It takes less time than reading this article did.
