Your Website Is Being Judged Every Day — Here's the Test It's Probably Failing
Open a new browser tab and go to pagespeed.web.dev. Type in your website address. Wait thirty seconds. If you see red or orange, this article is for you.
What you just looked at
That tool is run by Google, and it measures something called Core Web Vitals — three simple questions about your website:
- How fast does the main content appear? (Largest Contentful Paint)
- Does the page jump around while loading? (Cumulative Layout Shift)
- How quickly does the page respond when someone clicks? (Interaction to Next Paint)
Green means good. Orange means needs work. Red means your visitors are suffering — and leaving.
I want to be blunt about this: these are not vanity metrics for developers to obsess over. Google uses these scores as a ranking signal. Two websites with similar content? The faster one wins. Your competitor with green vitals sits above you in search results, and you never even know why.
What slow really costs you
Here is the part that should worry you more than rankings.
Google's own research found that when a page takes longer than three seconds to load on mobile, more than half of visitors give up and leave. They don't complain. They don't email you. They just press back and click the next result — which is your competitor.
So a red Core Web Vitals score hits you twice:
- Fewer people find you, because Google ranks you lower.
- Fewer of the people who do find you stay, because the experience is frustrating.
That's not a technical problem. That's a revenue problem wearing a technical costume.
Now the part nobody checks: security headers
While you had pagespeed.web.dev open, here's a second test almost nobody runs: securityheaders.com. Type in your address again.
Security headers are instructions your website sends to every visitor's browser. They say things like "never load this site inside a scam page", "only accept content over a secure connection", and "don't let injected scripts run here". Missing headers won't make your site look broken. That's exactly the danger. Everything appears fine — right up until:
Someone embeds your login page inside a fraudulent site (clickjacking)
A malicious script runs on your pages and harvests your customers' data
Your site gets flagged as unsafe, and browsers start showing warnings to your visitors
If you handle any personal data — a contact form counts — weak headers are also a GDPR exposure. "We didn't know" is not a defence regulators accept.
Does security affect SEO too?
Yes, more than most people realise. Google has confirmed HTTPS is a ranking signal, and the wider pattern is clear: Google wants to send its users to sites that are fast, stable, and safe. A hacked site gets removed from search results entirely — sometimes for weeks, even after you've cleaned it up. I've seen businesses lose years of SEO work to one compromise that proper headers would have made far harder.
Security headers are the cheapest insurance you will ever buy. Most take an afternoon to configure correctly. The cost of not having them is measured in lost trust, lost rankings, and lawyers' fees.
The honest bit
I'll say something that most agencies won't: Drupal sites are often worse at Core Web Vitals than they should be. Years of accumulated modules, oversized images, render-blocking scripts, themes built in 2016 — it adds up. Drupal can be extremely fast. Out of the box, with a neglected setup, it usually isn't.
The good news is that both problems — slow vitals and missing headers — are completely fixable, and fixing them doesn't require rebuilding your website. It requires someone to actually look.
What to do this week
Run your site through pagespeed.web.dev and securityheaders.com. Screenshot the results and date them. If either shows red — or your security grade is below a B — treat it with the same urgency you'd treat a leaking roof. It's not getting better on its own.
If you'd rather have someone who does this every day take a look, that's exactly what I do. No jargon, no scare tactics beyond what you've just read — just an honest assessment of where your site stands and a fixed price to put it right.
Your website is being judged every day. The least you can do is see the scores.