How we assess websites at WebYes

A keurmerk is only credible if you can explain exactly how the assessment works. At WebYes that starts with a public, free scan in beta, and ends, for those who pay and clear the thresholds, with an embeddable badge, a public profile page and a re-audit roughly every thirty days. This post describes that route step by step: what we measure, what we deliberately do not claim, and how the public register looks without fabricated counters.

We write this because clients, agencies and IT teams often ask the same questions. Is the scan a full site audit? No. Can a badge keep hanging while the site declines? No. Does everyone who ever scanned appear in the register? Also no. Only real paid, active orders. Below you read how that works in practice, and where to go deeper in the knowledge base on the techniques behind each pillar.

The free beta scan: first diagnosis

On the homepage you enter a web address. The scan visits up to six pages of that domain. That is enough for the homepage, a few landing pages and for example contact or product, but not a crawl of hundreds of URLs. We call the scan beta: the engine underneath is the same audit engine we use for professional checks, while the translation into four pillar scores can still tighten. Score thresholds may shift slightly over the coming months and more checks will be added.

If you scan the same domain again within sixty minutes, we show the existing result instead of crawling again. That dedupe window keeps the tool fast and prevents a site from being visited more often than needed. You do not need an account. The report shows per finding what goes wrong and which direction you should take. If you want to understand how this kind of technical scan relates to tools such as Lighthouse, read website audit: there we explain what an automated check does and does not cover.

Four pillars, one keurmerk threshold

Every scan yields four scores from 0 to 100: speed, security, mobile and accessibility. The average is the total score. For the WebYes keurmerk a double threshold applies: average at least 80, and each pillar separately at least 60. A site that excels on three pillars but stays below 60 on one fails. That is intentional. A keurmerk that leans on one weak pillar says little about the experience of your visitors.

The speed pillar looks at loading performance and the Core Web Vitals, among other things. Google describes LCP, INP and CLS as core metrics for how fast and stable a page feels. We translate those and related signals into a pillar score in the report, with a fix direction per finding. The mobile pillar tests viewport, font size and tap targets, among other things: issues that often stay invisible on desktop until someone tries to tap on a phone.

Security: more than a padlock

For security we check HTTPS, the HTTP-to-HTTPS redirect, and the presence of important security headers, among other things. A padlock in the browser bar is not a keurmerk by itself. If HSTS is missing, or Content-Security-Policy is too loose or turned off entirely, you see that in the report. Our guide to Content Security Policy explains what CSP does and how to build a policy without breaking your own scripts.

For a broader check on modern internet standards you can use the Internet.nl website test alongside WebYes. It looks at TLS configuration and DNSSEC, among other things, and is a useful independent reference. WebYes stays focused on diagnosis within the four pillars plus fix direction. Internet.nl remains useful when you want to verify whether your server stack follows current standards.

Accessibility: what we test mechanically

The accessibility pillar tests machine-checkable criteria, such as alt texts, contrast, labels and focusable controls. That is a serious first line, not a substitute for a full manual WCAG audit. Digital accessibility is broader than what a crawler can see. In digital accessibility we explain how standards, statements and legal frameworks connect.

For organisations that fall under the European Accessibility Act, or that want to show voluntarily where they stand, an accessibility statement often belongs as well. That statement is a separate track: you describe the status of your site, known issues and how visitors can get in touch. WebYes measures technical signals in the scan; the statement remains your organisation's responsibility. Both belong in an honest accessibility story, but they are not the same product.

From scan to badge, profile and re-audit

The free scan is the first step. The paid keurmerk adds three things the free check does not. First an embeddable badge you can place on your site, with a link to your public WebYes profile. Second that profile page itself: scores and status are visible there for visitors, clients or partners. Third a re-audit cadence: active paid orders are reassessed roughly every thirty days, so a badge does not sit still while the site declines.

To keep the badge and the certified status picture, the site must keep meeting meetsKeurmerk: average at least 80 and each pillar at least 60. If one or more pillars drop below the floor, the status changes. In the public register you then see an honest status such as certified, remediation in progress or assessment in progress. No sticker that stays green forever without checks. That is the difference between a keurmerk with maintenance and a one-off screenshot.

What the register does and does not show

The public register on WebYes lists only real paid, active orders. Sites that were once scanned for free but never had an order do not appear. We publish no fabricated counts of certified sites, no fake social proof and no sticker wall of domains that do not clear the threshold. If an agency covers multiple sites under one subscription, the same logic applies per covered domain: active coverage, honest status, re-audit according to the rhythm of active orders.

That sounds strict, and it is. A trust product that counts how many stickers hang online without checking whether the underlying sites still pass undermines itself. We prefer a smaller, honest list over an impressive-looking counter. You can therefore show the register as an overview of sites that actually participate, not as a marketing claim about market share.

How best to prepare for the assessment

Start with the free scan on the URLs your visitors see most. Fix pillars below 60 first: those block the keurmerk regardless of how high the average is. Then work toward an average of at least 80. Use the fix direction in the report as a starting point, and the knowledge base for deeper explanation. Combine speed and mobile where possible: heavy media and too much JavaScript hit phone users hardest.

Do not plan security and accessibility as a one-off sprint. Headers, CSP and HTTPS configuration change with your stack. Accessibility needs ongoing attention, especially when content editors, CMS plugins or third parties add scripts. When you are ready for badge and profile, you already know from this post what follows: paid order, threshold check, public profile, and re-audit roughly every thirty days for as long as the order stays active.