Security · Search · Speed · Accessibility
Already have a website? Get a free audit.
Paste an address and we will crawl up to ten pages, run 32 automated checks across security headers, search, performance, accessibility and links, and hand you a scored report with a PDF you can forward to whoever maintains the site.
- 32 automated checks
- Results in about 30 seconds
- Scored PDF report
- No sign-up, no email
Explore the sample reportCompare completed auditsBrowse recent auditsUse the API
01 /What you get
A score, a fix list and a plan
Paste an address
Any public site. Pick desktop or mobile, how deep to crawl, and your own pass mark, or keep the defaults.
We crawl and check
A background worker fetches up to ten pages and runs every check against the live responses, headers included.
You get the report
A score out of 100, the findings that cost the most points first, and a PDF to forward to whoever maintains the site.
- Security
- 52
- Search & sharing
- 90
- Performance
- 86
- Accessibility
- 78
- Links
- 100
- failContent-Security-PolicyMissing
- failStrict-Transport-SecurityMissing
- failImage text alternatives6 missing
- warnMeta description182 characters
02 /What we check
Thirty-two checks, five groups
Every check is rule-based and repeatable: the same page gives the same result, and every finding says what was expected and what was found. Nothing here replaces a manual test, but it catches the problems that should never reach a manual tester.
Security
11 checks
Transport and response headers from the OWASP Secure Headers project, plus mixed content, cookie flags and version banners.
- Served over HTTPS
- Without TLS every form, cookie and page can be read or changed on the way to the visitor.
- HTTP redirects to HTTPS
- Old links and typed addresses arrive over plain HTTP; they should be upgraded, not served.
- Strict-Transport-Security
- Tells browsers to refuse plain HTTP for this site, which closes the downgrade window.
- Content-Security-Policy
- Limits where scripts may load from, the strongest single defence against cross-site scripting.
- X-Content-Type-Options
- Stops browsers guessing a file type, so an upload cannot be executed as a script.
- Clickjacking protection
- X-Frame-Options or frame-ancestors keeps other sites from framing yours under a fake button.
- Referrer-Policy
- Controls how much of your URLs, including query strings, leaks to every third party you link to.
- Permissions-Policy
- Switches off camera, microphone and location for embedded content that has no business asking.
- Cookie flags
- Cookies without Secure and HttpOnly can travel over HTTP or be read by injected scripts.
- Version banners
- Server and framework versions in headers give an attacker a ready list of known exploits.
- No mixed content
- An HTTPS page that loads scripts or images over HTTP is only as secure as the weakest request.
Search & sharing
10 checks
What a crawler and a link preview read first: the title, the description, the headings, canonical and Open Graph tags.
- robots.txt
- The first file a crawler asks for; without it, crawl rules and the sitemap location are guesswork.
- XML sitemap
- Lists the pages you want indexed, so new and deep pages are found without waiting for links.
- Page responds with 200
- A page that errors or redirects in a loop is invisible to visitors and crawlers alike.
- Title tag
- The clickable headline in search results and the browser tab; 10 to 60 characters survive truncation.
- Meta description
- Often used as the snippet under the result; 50 to 160 characters is what search engines show.
- One H1 heading
- A single top-level heading tells crawlers and screen readers what the page is about.
- Canonical URL
- Names the preferred address when the same page is reachable through several URLs.
- Open Graph tags
- Decide the title and image when the page is shared on LinkedIn, Slack or messengers.
- Indexable
- A stray noindex left over from staging quietly removes a page from search.
- Mobile viewport
- Without a viewport tag phones render the desktop layout zoomed out, and search ranks it as not mobile-friendly.
Performance
5 checks
Server response time, page weight, compression and the habits that make a layout jump while it loads.
- Server response time
- Time to first byte is the floor under every other speed metric; nothing paints before it.
- HTML weight
- Large documents delay parsing on slow phones and usually mean inlined data nobody needs.
- Compression
- Gzip or Brotli shrinks HTML by 70 to 90 percent at no cost to the visitor.
- External scripts
- Every script is a request and a parse; tag-manager sprawl is the usual cause of a slow page.
- Image dimensions
- Images without width and height make the layout jump as they load, which hurts Core Web Vitals.
Accessibility
5 checks
The machine-checkable part of WCAG: text alternatives, form labels, accessible names, language and heading order.
- Page language
- Screen readers pick their pronunciation from the lang attribute; without it they guess.
- Image text alternatives
- An image without an alt attribute is announced as its file name, or not at all.
- Form labels
- An input without a label is an unnamed box to a screen reader and a smaller target for everyone.
- Link and button names
- Icon-only links and buttons need text or an aria-label, or they read as "link" and "button".
- Heading order
- Skipped levels, such as an H2 followed by an H4, break the outline people navigate by.
Links
1 check
A sample of the internal links on every crawled page, followed to see which ones end in an error.
- Broken internal links
- Links that end in 404 or 500 waste crawl budget and send visitors to dead ends.
03 /FAQ
About the audit
Is the audit really free?
Yes. It runs on automated checks with no account and no follow-up sequence. If the report raises questions you want an engineer to answer, the contact page is the place, but nothing here depends on it.
What does the score mean?
Each check passes, warns or fails, and is weighted by how much it matters: a missing Content-Security-Policy weighs more than a long meta description. The score is the weighted share of points earned, out of 100. The pass mark is yours to set, so a team can hold a staging site to a stricter bar than a landing page.
Will the crawl affect my site?
It requests at most ten pages and a sample of up to twenty links, one at a time, identifying itself in the User-Agent. That is lighter than a single visitor clicking around. Pages your robots.txt disallows are skipped beyond the address you entered.
Can I audit a staging or intranet site?
Only if it is reachable from the public internet. The crawler refuses private, loopback and cloud-metadata addresses on purpose, including hostnames that resolve to them, so the tool cannot be used to probe internal networks.
What happens to the file I attach?
It is checked by content, not by its name, stored in a private bucket that has no public URL, and deleted with the audit, either by you or automatically after 30 days.
Does this replace a manual QA or security review?
No. Automated checks find what is visible from outside in one pass. They cannot log in, judge whether a flow makes sense, or chain two harmless findings into a real attack. Treat the report as the list of things to fix before a person spends time on the rest.