Your first scan, without an account

The free scan is the whole runtime half of the product, not a teaser. 110 of the rules run on it - every live-site rule and every real-browser rule a single pass can raise: security, privacy, speed, the domain and its mail records, indexing, AI crawler policy, error pages and accessibility alike - and it needs nothing from you but an address that resolves publicly.

1. 1
   Submit a URL and an email

   Use the form on the home page. The email is where the report link is delivered; product news is a separate, explicit opt-in you can leave unticked.

2. 2
   Watch it run

   Progress streams to the page over server-sent events, step by step. You can close the tab - the scan keeps going.

3. 3
   Open the report

   The report opens at a private link of its own, so you can send it to someone without giving them an account.

What the free scan covers

• HTTPS, certificate validity and expiry, the HTTP to HTTPS redirect, HSTS and mixed content.
• Content-Security-Policy quality, clickjacking protection, MIME sniffing, referrer policy, Permissions-Policy, COOP, CORP and version disclosure.
• Session cookie flags, cookie scope and lifetime, and cross-origin rules.
• Markup: integrity hashes on CDN code, frames granted camera or microphone, forms that post to another company, development hosts left in a production page.
• Credentials in public JavaScript, published source maps, exposed .env, .git, backups and developer tooling.
• One page recorded in a real browser: every request it makes, third parties, errors and failed requests.
• How fast that page is: Core Web Vitals, the longest main-thread task, page weight, duplicate and N+1 requests, render-blocking scripts, uncached assets and oversized images.
• What leaves the page: personal data sent to a third party, trackers that run before anyone clicks, session-replay tools that record typing.
• A read-only access-control probe that proves whether a data API answers without a session.
• The domain itself: addresses, dangling CNAMEs, DNSSEC and CAA, and email authentication - SPF, DMARC, MTA-STS, TLS-RPT, BIMI and the common DKIM selectors.
• SEO and indexing: noindex, title and description, the canonical and whether it answers, structured data, robots.txt, sitemaps and security.txt.
• AI crawler policy: which AI crawlers robots.txt blocks or allows, and whether an llms.txt is published.
• How missing pages are handled: a real 404 against a soft 404, redirects to the home page, error pages that leak internals, and broken internal links.
• Accessibility basics on the rendered page: images without alt text, unlabeled controls, buttons and links without a name, landmarks, a skip link and the document language.
• Third parties: every host the page talks to, trackers, session replay and consent platforms, and how many bytes leave your origin.

The report lists what the scan saw beside what it found: the checks that ran and passed by area, then the DNS and mail records, indexing, 404 handling, accessibility, third parties and delivery. A section the scan could not reach says so rather than showing zeros.

What it does not cover

Anything that needs your repository: the source rules, dependency advisories, infrastructure files, pull request verdicts and Fix with AI. Those arrive when you connect GitHub on a paid plan.