The site's home page returns an error status
What this check looks for
The address answered, but with an error code rather than a page. Visitors landing on the home page see an error.
Why it matters
An error on the root path is the first thing both visitors and search engines see. If it is a 5xx it also tells you the application behind the server is failing, not just missing.
When the check passes, your report says: “The home page returns a successful status”.
What it costs your score
When this check fails it removes 10 points from your HTTP score, before the status, confidence and repeat multipliers are applied. HTTP carries a weight of 7 in the overall score.
It shares the http.reachability family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from HTTP. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 10 points
- Family cap
- http.reachability · 60
- Category
- HTTP
- Module
- Http reachability
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Make the root path return a page.
It is the first URL every visitor and every crawler requests.
Check the server's error log for the request.
If the status is 403, check for a WAF or bot rule blocking unfamiliar user agents.
If the status is 404, check the virtual host matches the hostname being requested.
How to confirm it worked
curl -sS -o /dev/null -w '%{http_code}\n' https://‹host›/ — expect 200
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
tail -n 100 /var/log/nginx/error.logtail -n 100 /var/log/apache2/error.logTechnical detail
https://‹host›/ returned HTTP ‹status›. A 4xx means the request was refused — a missing virtual host, an authentication wall, or a WAF rule that blocks unknown clients, which is worth ruling out since our scanner is one. A 5xx means the application errored. Note that only the root path was requested.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.