Skip to content

Free · no account · no card

One answer at a time, or all of them at once.

Each of these runs one check against a URL you give it and tells you what it found, including when it could not find out. They are the same measurements the full audit makes; these are just the ones people arrive already asking about.

The whole thing Audit an entire website Security headers and TLS, SEO and structured data, AI visibility, conversion readiness, email deliverability, cookies and compliance, and what built the site, measured and explained in one pass. Takes under a minute. Run it

Or check one thing

One page per question, because that is how this is actually searched. Each says what it reads before you run it, and what it deliberately does not touch.

Are there API keys in your JavaScript? Paste a URL and we read the JavaScript your site ships to every visitor, looking for private API keys and tokens that should never have left the server. Free, no account. Everything a browser downloads is readable by whoever downloads it. A key that ends up in a bundle is published, not hidden, and the AI builders are unusually good at putting one there. We fetch your homepage and the scripts it links, and match them against the credential formats of the major providers. Scan my JavaScript Is your source code published with your app? Check whether your production build publishes its source maps, the file that lets anyone reconstruct your original source code from the shipped bundle. Free, no account. A source map maps your minified bundle back to the code you wrote: variable names, comments, file structure, and anything you left in them. Shipping one to production hands a reader your codebase. We fetch your bundles and check whether the maps they point at are actually reachable. Check my source maps Which security headers is your site missing? Check a site for the HTTP response headers that stop clickjacking, MIME sniffing and protocol downgrades: CSP, HSTS, X-Frame-Options and the rest. Free, no account. Response headers are the cheapest security work there is: a handful of lines in a config file, and every one of them closes off an attack a browser would otherwise allow. We make one request to your homepage and report which are set, which are missing, and how much each one is worth. Check my headers Will your email reach the inbox? Check a domain's SPF, DKIM and DMARC records: the three DNS entries that decide whether your mail lands in the inbox or the spam folder, and whether anyone can spoof your address. Free, no account. SPF says who may send as you. DKIM signs what you send. DMARC tells inbox providers what to do when the first two fail, and without it anyone can send mail as your domain and your own mail is treated with suspicion. We read the three DNS records and report what they say. Check my DNS records Can anyone read your Supabase database? AI app builders scaffold Supabase tables and skip the row-level security policies. This reads the public key your app already ships and checks whether an anonymous visitor can read your tables. Free, no account. Supabase publishes an "anon" key in your app on purpose: it identifies the request but authorises nothing on its own. Row-level security is what authorises. With RLS off, which is the state a tutorial leaves you in, that public key reads every row. We read the key out of your own bundle and issue read-only GETs against common table names. Nothing is written, changed or deleted. Check my database Can AI search engines read and cite your website? Check whether ChatGPT, Claude, Perplexity, and Google AI can crawl and cite your content, and generate standard-compliant robots.txt and llms.txt rules. Free, no account. AI assistants and answer engines (Perplexity, ChatGPT, Claude, Google AI Overviews) rely on robots.txt rules and llms.txt manifests to cite websites. If your server disallows their user-agents, your brand is invisible in AI answers. We inspect your live robots.txt and llms.txt files and help you generate standard configuration rules. Check my AI visibility

Before you point one at a live site

What these do, and what they will not do.

You are about to run a scanner against somebody's production website, possibly a client's. That is owed a straight answer rather than a footnote.

The whole of it, the standards behind every measurement and the rules the engine holds itself to, is on the methodology page.

reads only
Ordinary GET requests for pages and files the site already serves to anybody. Nothing is written, changed or deleted, and nothing is fetched that a browser would not fetch on its own.
first-party
Only the site's own pages and its public DNS, TLS and registry records. No data broker, no purchased list, and no source that needs an account to read.
identified
Throttled, sequenced one at a time per host, and named in the user agent. The point is to measure a site, not to load-test it.
fast tier only
No headless browser and no bundled scanners, with a thirty-second ceiling. The checks that actively probe anything are switched off entirely here.
not kept
An anonymous scan is swept after thirty days. Nothing here creates an account, and nothing here is added to a list.

What the free tier holds back

Everything on this page runs the fast tier, the whole-site audit included. What is missing from it is missing for a reason: each of these costs a headless browser, a scanner process or a full crawl, and a tool anybody can point at any address cannot spend those on every request. They run inside an account.

Lighthouse and real Core Web Vitals The fast tier reads how quickly the server answered. Lab performance scores and the field data Google collects from real visitors both need the full run.
A WCAG conformance count Counting accessibility failures means rendering the page in a real browser and walking the result. Nothing here starts one.
Deep TLS and vulnerability scanning The headers check grades what came back on one request. Protocol and cipher analysis, known-vulnerability signatures and the external port and subdomain surface are separate passes.
Anything beyond the one page you gave it No crawl, so no site-wide totals, no broken-link sweep, and no "what share of your pages are missing a title".
Reviews, rankings and the business behind the site The free tools measure a URL. The product measures a business: its review corpus, where it ranks, and who to contact about it.
A report you can hand to somebody These print an answer on the screen. A scored, fifteen-section report with a shareable link, a PDF and your own branding is the paid deliverable.
Start free, no card See everything it measures

One URL is a check. A city is a pipeline.

The same engine, pointed at a trade and a town instead of a single address, ranked by how much fixable trouble each business is in.

Start free Read the docs