5 Things Google Checks That Your Web Developer Never Told You

Your developer built a great site. Then left.

You hired someone to build your WordPress site. They did a good job. The design looks professional, the content is compelling, and they probably set up some basic SEO — a meta description here, an alt tag there, maybe even installed Yoast.

What they probably didn't tell you is that Google checks your site's technical health constantly. Not just once when it first discovers your site — continuously. And many of the technical signals Google looks at degrade over time if nobody maintains them.

Here are five things Google checks that most web developers never mention to their clients.

1. HTTPS and SSL validity

Google has been using HTTPS as a ranking signal since 2014. If your site doesn't have a valid SSL certificate, you're at an immediate disadvantage. But here's the thing most people don't know: SSL certificates expire.

If your certificate was set up with Let's Encrypt (which is excellent and free), it needs to renew automatically every 90 days. If the auto-renewal breaks — which happens more often than you'd think after hosting changes or server updates — your site suddenly shows a scary browser warning. Visitors see "Your connection is not private" and leave immediately.

Google won't rank a site with an expired SSL certificate well. And visitors certainly won't trust it.

How to check: Click the padlock icon in your browser's address bar. It should say the connection is secure and show the certificate's expiry date. Or check at SSL Labs for a detailed report.

2. Core Web Vitals (speed, but specific)

You've probably heard "site speed matters." But Google doesn't just measure how fast your page loads — they measure three very specific metrics called Core Web Vitals:

LCP (Largest Contentful Paint) — How quickly does the main content appear? Google wants this under 2.5 seconds. If your hero image takes 5 seconds to load, you're failing.

INP (Interaction to Next Paint) — When a visitor clicks a button, how quickly does the page respond? This should be under 200 milliseconds. Sites heavy on JavaScript often fail here.

CLS (Cumulative Layout Shift) — Does your page jump around while loading? Ads that push content down, images loading without dimensions set, fonts that swap and change the text size — Google measures all of this. Your score should be under 0.1.

These aren't obscure technical metrics. Google displays them prominently in Search Console and uses them directly in ranking decisions.

The problem: these metrics were probably fine when your site launched. But plugins added JavaScript over time, images were uploaded without optimization, and your hosting got slower. Core Web Vitals degrade silently.

How to check: Run your site through Google PageSpeed Insights. Test the mobile version — that's what Google uses for ranking. For a deeper dive, read our article on why website speed matters.

3. Mobile-friendliness

Google switched to mobile-first indexing years ago. That means Google primarily looks at the mobile version of your site when deciding how to rank it — even for desktop searches.

Your developer almost certainly built a responsive site. But "responsive" at launch doesn't mean "responsive forever."

Common ways mobile-friendliness breaks over time:

• New content gets added with fixed-width elements that overflow on small screens
• Plugin updates change the layout of forms, tables, or widgets
• Images get uploaded at full size without mobile-optimized versions
• Pop-ups or cookie banners obscure the content on mobile (Google explicitly penalizes this)
• Font sizes become too small as layouts shift

When was the last time you actually looked at your site on a phone? Not a screenshot — actually browsed it, scrolled through, tried to fill out a form?

How to check: Look at the Mobile Usability report in your Google Search Console. Or simply browse your site on your phone and note anything that feels awkward.

4. Crawlability (sitemap + robots.txt)

Google can only rank pages it can find. Your site has two key files that tell Google what to crawl:

robots.txt — tells Google which pages it should and shouldn't crawl. If this file accidentally blocks Google from your important pages, you're invisible.

sitemap.xml — a list of all the pages on your site that you want Google to know about. If your sitemap is outdated, Google might not discover your new content.

Here's what goes wrong:

• A plugin update changes the robots.txt and accidentally blocks Google from crawling your site
• Your sitemap was generated at launch and never updated with new pages
• A staging/development version of robots.txt (with "Disallow: /") gets accidentally deployed to production
• Redirect chains break, and Google can't reach certain pages anymore

We've seen businesses lose 50%+ of their organic traffic because of a robots.txt misconfiguration that went unnoticed for months. Nobody was checking.

How to check: Visit yoursite.com/robots.txt and yoursite.com/sitemap.xml in your browser. If either shows an error or looks wrong, there's a problem. Use Google Search Console's URL Inspection tool to see if Google can actually access your pages.

5. Security (malware and blacklisting)

Google actively scans websites for malware, phishing content, and other harmful software. If your site gets compromised — which is disturbingly common for unmaintained WordPress sites — Google will:

• Show a bright red warning page to anyone trying to visit your site
• Label your site as "This site may be hacked" in search results
• Potentially remove your site from search results entirely

Getting back into Google's good graces after a security incident isn't quick. You have to clean the malware, submit a review request, and wait — sometimes weeks — for Google to re-crawl and verify your site is clean.

Read our full article on what happens when your WordPress site gets hacked for the complete picture.

The connection between security and SEO is direct: keeping your WordPress site secure is an SEO requirement, not just a safety measure.

How to check: Use Google's Safe Browsing report to see if your site has been flagged. Check Google Search Console's Security Issues report for any detected problems.

The pattern you should notice

All five of these issues have something in common: they were probably fine when your site launched, and they degrade silently over time.

SSL certificates expire. Speed gets worse. Mobile layouts break. Sitemaps go stale. Security holes open up. None of these things announce themselves. They just quietly drag your site's Google ranking down, week by week, while you wonder why traffic is declining.

Your developer isn't checking. They built the site and moved on. Your hosting provider isn't checking — that's not their job. And you probably don't know these things need checking.

What you can do about it

Option 1: Check everything yourself on a regular schedule. Use the tools linked above. Set a monthly reminder. It takes about 30 minutes if you know what you're looking at.

Option 2: Set up automated monitoring. Services that check your site's technical health regularly and alert you when something needs attention.

Option 3: Let someone handle the maintenance that prevents most of these problems in the first place. Keeping WordPress, plugins, and themes updated prevents security issues (check 5), often improves speed (check 2), and ensures your site stays compatible with modern standards (checks 1, 3, and 4).

WPulse handles the maintenance side: monthly updates, backups, and health checks that keep your site in good shape technically. It's not a full SEO service — but it addresses the technical foundation that everything else is built on.

For a complete guide to assessing your site's health, check out our website health check guide.