One of the NGO which work for the children welfare ask me to test their website. That's a completely static website on the single page simple navigation toward the section so I need general tips to test the website, honestly speaking I am feeling bad because I could not find any bug or mistake in it.
Look & Feel
- Test for appearance like how does it look in IE, Chrome, etc.
- Test for accessibility so that your site is adopted for people with impaired vision (fonts, colors, contrast, etc)
- Test for mobile devices layout
- Test if it is comfortable to interact with the site using touch pad
- Check for the proper favicon
- Check for "error pages". Make sure they are no default and have the site common style.
- If there are the forms check if the order of switching the field focus when user presses TAB is correct
Integration with 3rd-party
- If there is the social media intergation check for "Share" button or analogue
- If there is some donation services integration, check it
- Check integration with site analytics systems if any (e.g. Google Analytics)
- If there are the forms, check for input limitations
- Also, if there are some forms, check for vulnerabilities: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
- Check the server for negative cases. You can pretend to be a website or an attacker and try to send different requests of different composition to check how the server is reacting
- Check for some non-regular load to be sure the site will not go down with the growth of popularity
- Check for robots.txt to make sure it masks out the pages which are not to be indexed by search engines.
- Check for site.xml to make sure there is a proper structure described
- Check for console to make sure all the page resources are loaded properly
- Check for cookies: either they are used to define a user session for a site or for site analytics.
no one has mentioned these yet.
- Check for Spelling Mistakes
- Check for Grammar Mistakes
- Check for use with Page Readers for the Blind
- Keyboard only Navigation
Keyboard Navigation and Page Readers go hand-in-hand
Try with different screen resolutions and different web browsers including mobile.
I like running static websites, myself. The things I worry about are:
Attacks on the shared host I use:
- The web server itself (Apache or whatever) or unpatched OS vulnerabilities
- Errors in configurations on the server-side
- Errors in my own configurations (e.g. .htaccess files)
- Compromises of my other sites under my account
- Attacks from other users in the shared system
- If you're self-hosted, all of that plus everything else you need to do to secure a host on the Internet
Attacks against my users:
- use HTTPS! Prevents the data from being modified; prevents other ads from being inserted (making it look like you are endorsing whatever their ISP injects); protects your users' privacy (probably especially important for a child-focused NGO!).
- CSS/XSS etc. vulnerabilities in the code I've written
- integrity of my data (e.g. how quickly can I restore a site when it gets compromised: hopefully just a push from VCS; if an internal actor modifies the site do you have traceability through your VCS?)
- is my data correct and accurate, so I'm not misleading them?
In that case, some of my tests would be:
- Test whether the appearance (GUI) is fine.
- Check the common contents like menu, logo etc are consistent in every web page in case of multiple web page site.
- Test the basic functionalities in the site are working properly.
- Check the website appearing and working properly after any update is done.
- Media and other files are showing and downloading properly.
- Check in multiple browsers (Firefox, Chrome, IE, Edge, Safari etc). Check in both old and latest versions.
- Check in multiple OS platforms (Windows, Mac, Linux etc), specially in the latests.
Check the site from mobile (Android, IOS, Windows phone etc).
For cross browser and cross platform testing, I use this site:
Test whether all internal links are working properly. For example: Personally I use
Xenutool that checks websites for broken links.
- Check title and status bar message.
- Check for grammatical and spelling errors in the contents.
Perform load and performance testing on the site.
JMeteris an open source load testing tool that you can use.
- Perform security testing. @Alexey R. and @drewbenn described this nicely.
I'd certainly run the site through accessibility checkers if it's public facing to ensure it's appropriate for as wide an audience as possible.
Ideally you'd want to ensure it's accessible for screen readers, keyboard accessible etc
To test the performance of the web site- google provides free tool: https://developers.google.com/speed/pagespeed/insights/
You just need to provide portal address of your website and, click on analyse. It will quickly perform page searching and heath test. It will also provide result and points to address to enhance the performance.
As usual, when you are confused or unsure about something, it might be useful to get back to fundamentals of testing and see whether they provide any guidance.
Testing is gathering information with intent of using it when making a decision. Bug is something that threatens value of the product. (These are simplified versions of definitions promoted by context-driven school of testing.)
These are some questions that immediately come into my mind:
- If I support case of this NGO case and want to support them in particular, how do I do it? How can I send them money? How do I get in touch with them to work together? Are these topics covered anywhere on the website?
- If I consider supporting them, but I am unsure, how can I learn more about their past performance? What have they done? Is this verifiable by independent 3rd-parties?
- If I know about something that might be potentially interesting for them (like I suspect that child in my neighbourhood might be abused), how do I get in touch with them? Can I do it anonymously?
- If I am child that suffers from abuse, how can I reach out to them to help me?
- What is area that they operate on? One district, one city, region of country, entire country, internationally?
- If I am government official, can I easily verify that all relevant laws are being followed?
To summarize. First, you should understand why they have website and whether the thing that they have fulfils that purpose. Then, you should think if there are any other reasons why they should have website that they haven't thought of.
Example: maybe they have website to raise awareness of all the things that they are doing. Then, you should verify if their current website does good job at that. But website is also great way to secure some additional funding. If they aren't making it easy for people to donate, you should point this missing opportunity out to them.
Don't be afraid to speak about problems even if you suspect they might not be able to fix them. But never insist that they introduce certain changes - you are here to provide valuable feedback, but it's up to them to decide how will they use it.