21

One of the NGO which work for the children welfare ask me to test their website. That's a completely static website on the single page simple navigation toward the section so I need general tips to test the website, honestly speaking I am feeling bad because I could not find any bug or mistake in it.

  • 1
    What do you mean by "general tips" ? Are you asking about what should be addressed by your tests or more generally about how you should test the website and communicate the results? Keep in mind that testing a website is more about validating a scope/usage than hunting bugs. – Florent B. Apr 3 '18 at 16:57
  • How testing an 'NGO site for children' relevant for the question? – Vishal Aggarwal Apr 4 '18 at 21:32
40

Look & Feel

  • Test for appearance like how does it look in IE, Chrome, etc.
  • Test for accessibility so that your site is adopted for people with impaired vision (fonts, colors, contrast, etc)
  • Test for mobile devices layout
  • Test if it is comfortable to interact with the site using touch pad
  • Check for the proper favicon
  • Check for "error pages". Make sure they are no default and have the site common style.
  • If there are the forms check if the order of switching the field focus when user presses TAB is correct

Integration with 3rd-party

  • If there is the social media intergation check for "Share" button or analogue
  • If there is some donation services integration, check it
  • Check integration with site analytics systems if any (e.g. Google Analytics)

Security Testing

  • If there are the forms, check for input limitations
  • Also, if there are some forms, check for vulnerabilities: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
  • Check the server for negative cases. You can pretend to be a website or an attacker and try to send different requests of different composition to check how the server is reacting

Performance Testing

  • Check for some non-regular load to be sure the site will not go down with the growth of popularity

SEO

  • Check for robots.txt to make sure it masks out the pages which are not to be indexed by search engines.
  • Check for site.xml to make sure there is a proper structure described

Other

  • Check for console to make sure all the page resources are loaded properly
  • Check console to make sure there are no javascript errors (for all the browsers).
  • Check for cookies: either they are used to define a user session for a site or for site analytics.
  • If site use SSL, make sure make sure there is no mixed content. Also how it looks on mobile. – VarunAgw Apr 3 '18 at 7:33
  • 8
    If site use SSL, [...], else use SSL. – aloisdg Apr 3 '18 at 8:35
  • 3
    @kubanczyk: Modern trends are moving towards it effectively being not optional. Why would you not provide it? Why do you want your users to not have privacy? – Lightness Races in Orbit Apr 3 '18 at 11:27
  • 1
    @AlexeyR. what financial resources? I can run an nginx server with a free certificate from LetsEncrypt on a $5/month DigitalOcean instance. If the site is popular enough that it's getting more than ~20 hits per second then they should be able to spend a little more on a larger instance. – Doktor J Apr 3 '18 at 20:50
  • 1
    Not enough for a new answer, but I'd also say you'd want to review colors for both modernness and visibility to a color-blind person. For example, you could use something like Google's Material UI to determine good color combinations. material-ui.com/#/customization/colors – kuhl Apr 3 '18 at 21:02
20

no one has mentioned these yet.

  • Check for Spelling Mistakes
  • Check for Grammar Mistakes
  • Check for use with Page Readers for the Blind
  • Keyboard only Navigation

Keyboard Navigation and Page Readers go hand-in-hand

  • 6
    On a similar note as page readers, the readability for those who are colorblind. – Izkata Apr 3 '18 at 1:49
  • 1
    Spelling mistaks are one of my pet peeves – Darren H Apr 4 '18 at 13:07
8

Try with different screen resolutions and different web browsers including mobile.

7

I like running static websites, myself. The things I worry about are:

Attacks on the shared host I use:

  • The web server itself (Apache or whatever) or unpatched OS vulnerabilities
  • Errors in configurations on the server-side
  • Errors in my own configurations (e.g. .htaccess files)
  • Compromises of my other sites under my account
  • Attacks from other users in the shared system
  • If you're self-hosted, all of that plus everything else you need to do to secure a host on the Internet

Attacks against my users:

  • use HTTPS! Prevents the data from being modified; prevents other ads from being inserted (making it look like you are endorsing whatever their ISP injects); protects your users' privacy (probably especially important for a child-focused NGO!).
  • CSS/XSS etc. vulnerabilities in the code I've written
  • integrity of my data (e.g. how quickly can I restore a site when it gets compromised: hopefully just a push from VCS; if an internal actor modifies the site do you have traceability through your VCS?)
  • is my data correct and accurate, so I'm not misleading them?
5

Test with Google Pagespeed and make sure you're minifying css/js, using gzip, and optimizing images with something like ImageOptim. If you're self-hosting, try accessing it on your phone on cellular data, to make sure it's accessible outside your network.

5

In that case, some of my tests would be:

  • Test whether the appearance (GUI) is fine.
  • Check the common contents like menu, logo etc are consistent in every web page in case of multiple web page site.
  • Test the basic functionalities in the site are working properly.
  • Check the website appearing and working properly after any update is done.
  • Media and other files are showing and downloading properly.
  • Check in multiple browsers (Firefox, Chrome, IE, Edge, Safari etc). Check in both old and latest versions.
  • Check in multiple OS platforms (Windows, Mac, Linux etc), specially in the latests.
  • Check the site from mobile (Android, IOS, Windows phone etc).

    For cross browser and cross platform testing, I use this site:

    Browserstack: https://www.browserstack.com/

  • Test whether all internal links are working properly. For example: Personally I use Xenu tool that checks websites for broken links.

    Xenu : http://home.snafu.de/tilman/xenulink.html#Description

  • Check title and status bar message.
  • Check for grammatical and spelling errors in the contents.
  • Perform load and performance testing on the site. JMeter is an open source load testing tool that you can use.

    JMeter: https://jmeter.apache.org/

  • Perform security testing. @Alexey R. and @drewbenn described this nicely.
4

I'd certainly run the site through accessibility checkers if it's public facing to ensure it's appropriate for as wide an audience as possible.

Ideally you'd want to ensure it's accessible for screen readers, keyboard accessible etc

https://wave.webaim.org/

https://webaim.org/resources/contrastchecker/

https://achecker.ca/checker/index.php

4

To test the performance of the web site- google provides free tool: https://developers.google.com/speed/pagespeed/insights/

You just need to provide portal address of your website and, click on analyse. It will quickly perform page searching and heath test. It will also provide result and points to address to enhance the performance.

  • that page is only for load speed, I am not sure that this answer fully answers the question because this is not a Manual Test, this is automated by Google and only looks at the speed in which the page is loaded. please correct me if you see it otherwise. – Malachi Apr 5 '18 at 14:59
3

As usual, when you are confused or unsure about something, it might be useful to get back to fundamentals of testing and see whether they provide any guidance.

Testing is gathering information with intent of using it when making a decision. Bug is something that threatens value of the product. (These are simplified versions of definitions promoted by context-driven school of testing.)

These are some questions that immediately come into my mind:

  1. If I support case of this NGO case and want to support them in particular, how do I do it? How can I send them money? How do I get in touch with them to work together? Are these topics covered anywhere on the website?
  2. If I consider supporting them, but I am unsure, how can I learn more about their past performance? What have they done? Is this verifiable by independent 3rd-parties?
  3. If I know about something that might be potentially interesting for them (like I suspect that child in my neighbourhood might be abused), how do I get in touch with them? Can I do it anonymously?
  4. If I am child that suffers from abuse, how can I reach out to them to help me?
  5. What is area that they operate on? One district, one city, region of country, entire country, internationally?
  6. If I am government official, can I easily verify that all relevant laws are being followed?

To summarize. First, you should understand why they have website and whether the thing that they have fulfils that purpose. Then, you should think if there are any other reasons why they should have website that they haven't thought of.

Example: maybe they have website to raise awareness of all the things that they are doing. Then, you should verify if their current website does good job at that. But website is also great way to secure some additional funding. If they aren't making it easy for people to donate, you should point this missing opportunity out to them.

Don't be afraid to speak about problems even if you suspect they might not be able to fix them. But never insist that they introduce certain changes - you are here to provide valuable feedback, but it's up to them to decide how will they use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.