What it checks
01
Security certificate
Whether HTTPS works, whether browsers trust the certificate, when it expires, and whether plain http:// visitors are moved to the secure version.
02
Security headers
The small instructions a site sends that stop it being framed, sniffed or leaking addresses, plus whether it advertises its software versions.
03
Speed, phones and search
How quickly the server answers, whether pages are compressed, whether it is set up for phones, and the basics Google looks for, including an accidental "noindex".
04
WordPress exposure
If it is a WordPress site: a visible version number, a public readme, usernames listed by the API, XML-RPC and a browsable uploads folder.