Part of the guide From inquiry to record in the UAE, without copy-paste
Key takeaways
- A website can look polished and still lose enquiries in places no visitor sees.
- Certificate renewal, form delivery and mail records fail quietly, often long after launch.
- What loads before a visitor agrees to tracking is visible in any browser in a few minutes.
- Speed on a phone is measured by when the main content appears, not by a score.
- A free SEO checker reads rankings signals; it cannot tell you whether an enquiry reached a person.
What does a technical check of a UAE company website look at?
Picture a Dubai consultancy with a website its founder is proud of. Good photography, clear services, a contact form on every page. Traffic is there. Enquiries are not. The usual reaction is to blame the design or the ad budget, and to start a redesign.
A technical check starts somewhere else. It does not judge the look of a UAE site. It reads what the browser, the DNS and the page itself report, and asks one question: can a visitor who wants to get in touch actually reach you? Most "website audit" articles treat the audit as an SEO exercise about rankings and meta tags. That matters, but it is the second question. The first is whether the path from visitor to enquiry works at all, the path our guide from inquiry to record follows beyond the form.
Here is what such a check finds on sites that look fine, in the order we look.
Is the security certificate about to run out?
The padlock in the address bar comes from a certificate, and certificates expire. Free ones from Let's Encrypt are valid for 90 days by default and depend on an automatic renewal that someone set up at launch. When the agency that built the site moves on, or the hosting account changes, that renewal can stop without anyone being told.
The result is not a small warning. Browsers show a full-page security error, and almost nobody clicks through it. Lifetimes are also getting shorter for everyone: the CA/Browser Forum voted to reduce the maximum validity from 398 days to 47 days in steps starting in March 2026. Manual renewal every year is no longer a plan.
You can read the expiry date yourself: `openssl s_client -connect yourcompany.ae:443 -servername yourcompany.ae | openssl x509 -noout -enddate`. The check records how many days are left, and whether renewal is plausibly automatic.
Where does the contact form actually send?
This is the finding owners are most surprised by. A form can look perfect and still send its data somewhere unsafe, or nowhere useful.
Say a clinic in Abu Dhabi runs a landing page with an enquiry form. The page loads over HTTPS, but the form submits to an old `http://` address left over from a previous tool. Chrome calls these mixed forms, disables autofill on them and warns the visitor before sending. Many visitors stop right there. Mozilla's documentation on mixed content explains why browsers treat this so strictly.
The check looks at where the form posts, whether that target is recognisable, and whether the form carries the notice a visitor should see before giving personal data. What it cannot see from outside is whether someone reads the result. That is its own topic, and usually the bigger one.
Can your domain send and receive email properly?
An enquiry that reaches the inbox is only half the conversation. The reply has to arrive too. Three kinds of DNS record decide that: MX says where mail for your domain is delivered, SPF lists who may send for it (RFC 7208), and DMARC tells receivers what to do when a message fails those checks (RFC 7489).
In practice we also compare domains. A company whose website runs on `company.ae` but whose staff reply from a free mail address, or from an old domain, looks inconsistent to spam filters and to customers. A first DMARC record can be as simple as `v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.ae`, and it starts sending reports that show every system mailing as your domain. How to set this up for a new company is covered in our guide to domain, business email and website after the trade licence.
What loads before a visitor has agreed to anything?
Open your homepage in a private browser window, open the developer tools, switch to the Network tab and reload. Do not touch the cookie banner. Everything that appears in the list has loaded before consent.
For example, on many UAE sites that list includes an advertising pixel, an analytics tag and a chat widget, all firing on the first page view. A banner exists, but it decorates the page rather than controlling what happens behind it. A check records which third-party hosts load, which cookies are set, and whether a banner actually holds anything back. What the banner should do, and how to build it in properly, is explained in consent and cookies, building it in.
How slow is the site on a phone?
Speed scores are easy to argue about. What counts is when the main content appears. Google's guidance treats a Largest Contentful Paint of 2.5 seconds or less as good. A check measures this on a mobile profile, together with page weight and the number of requests, and repeats the run, because one measurement is noise.
The usual culprit on a site that looks fine is the thing that makes it look fine: for example, a full-width hero video or an uncompressed image gallery that a desktop on office Wi-Fi never notices. On a phone in a car park in Sharjah, the visitor sees a blank screen and leaves.
What does a free website checker miss?
Free tools do a classic SEO audit: how search engines see your pages. They report issues such as missing titles, duplicate headings, broken links, a missing sitemap, and whether robots.txt lets Google in. Use them; fixing those issues is cheap search engine optimization. But a free checker cannot tell you whether an expiring certificate will take the site down next month, whether form data reaches a person, or whether your replies land in a spam folder. Those are the findings that cost enquiries, and they only show up when someone looks at the whole path.
If you want that path checked on your own site, with the findings in plain language and in order of what to fix first, that is what our PDPL and website check is for.
Michael Wagner's take
We often see nice looking websites that look great on the first look. But when you try to work professionally with them, you realize that the technical foundation gets them bad ranking in google or leads to undelivered emails. So, never understimate a rock solid technical foundation for your website.
Written by
Founder and Lead Engineer, Orentara
Michael Wagner founded Orentara and builds its websites and automations himself. An engineer by training, he has spent his career connecting websites, databases and business processes, and now focuses on automating compliance work under the GDPR, AML rules and the UAE PDPL.
