Security · SEO · AI answer engines
Ship it.Then actually check it.
Paste a URL. In under a minute, get 85 security, SEO and AEO checks — each one showing the value we measured, and each with a copy-paste fix prompt for your AI editor.
- Free with an account — no card
- Read-only: it never logs in or submits a form
- A full scan takes under a minute
Coverage
85 checks, six pillars,
one request
One fetch builds a shared picture of the page — headers, HTML, cookies, TLS, DNS, robots.txt — and every check is a pure function over it. That is why a full scan costs your server one page view.
MCP server
Point Claude Code or Cursor at ScanlyFix and the agent runs the scan, reads the findings and applies the fixes itself.
CLI with JSON output
The same engine, in your terminal and in CI — so a deploy can fail on a finding instead of shipping it.
- Security headers
- TLS & certificate expiry
- Cookie flags
- CORS policy
- Exposed secrets in JS
- Source maps & sensitive paths
- SPF, DKIM & DMARC
- DNS CAA & domain expiry
- Core Web Vitals
- Schema & structured data
- robots.txt & AI crawlers
- Keyboard & screen-reader checks
- Trackers before consent
- Supabase RLS & Firebase rules
Evidence
We show you the value.
Not our opinion of it.
Every finding carries the raw observation behind it — the header, the record, the certificate, the response code. Nothing is inferred, and nothing is a generic best-practice bullet dressed up as a result. Run the same dig or curl yourself and you get the same string back.
Output
It ends in a fix, not a PDF.
One prompt for the whole report, grouped by where the change is actually made — response headers in one edit, DNS records marked as not-code, page markup in the shared template. Paste it into Claude Code, Cursor or your own agent and the work is already ordered.
Fourteen findings, one edit
It knows where, not just what.
“Add a Content-Security-Policy header” is not actionable until you know whether that means next.config.ts, a _headers file, an nginx block or a Cloudflare rule. ScanlyFix reads the platform off your own response and writes the instruction for that one. A leaked credential is ordered first, because every later change is wasted if the key is already in someone else’s hands.
Every instruction names the file it belongs in.
AI answer engines
Can ChatGPT actually read your site?
Search is becoming answers, and an answer engine that cannot parse a page does not rank it lower — it never mentions it. Nothing in Search Console reports the citation you did not get. The failures are mundane and invisible: the text arrives only after JavaScript runs, the robots file blocks the crawlers by name, there is no schema tying the page to a real entity.
Monitoring
Scan once, or
watch it forever.
A scan is a photograph. Most of what this engine measures — a certificate, a DNS record, a header set by a deploy — changes on a day nobody was looking. Monitoring re-runs the scan daily and probes from outside your own network, which is the only place an outage looks like an outage.
Certificates
Weeks of warning, not a morning of it.
The expiry date is read on every probe and warned about with weeks to spare — not on the morning the renewal cron did not run. The same probe watches the DNS and email records that quietly decide whether your mail is delivered at all.
Status pages
A link that already exists when you need it.
Publish a status page built from the same uptime data your alerts are. Visitors can subscribe, incidents open and resolve against it, and during an outage you are sending a URL rather than writing one.
An outage is only ever visible from the outside.
Safety
It never logs in.
It never reaches a private address.
A scan is a read: it requests pages the way a browser and a crawler would, never submits a form, and never changes state. Every socket resolves through a guard that validates the address at connect time, so a hostname pointing at 127.0.0.1, a cloud metadata endpoint or anything reserved is refused before a byte is sent — and each redirect hop is re-checked.
Reproducibility
The ruler never moves quietly.
Every scan records the engine version it was measured with — currently 1.24.12 — and nothing compares two scans across a change in it. Otherwise the day we ship new checks, every monitored site gets an email saying it got worse. A check that fails to complete is recorded as our error and its pillar is marked provisional, never published as a bad score.
Honest reports
No blurred rectangles.
Where a report withholds detail it does so by not sending it, and it tells you exactly what is missing: the count and the severities. A frosted panel over text the browser already has is a bluff, and the first reader to open dev tools finds out.
One report
Everything a scan found,
sorted the way you read it
Findings arrive grouped by pillar and ordered worst-first inside each one, so the thing that matters most is the thing at the top — not whichever check happened to be cheapest to run.
Pillars
- Security49
- SEO17
- AI answer engines8
- Performance4
- Accessibility4
- Compliance3
85 checks in total
Security
Can a stranger read, hijack or impersonate this site?
- Content-Security-Policy
- Strict-Transport-Security
- DDoS protection
- Vercel hosting security
- Netlify hosting security
+ 44 more in this pillar
ScanlyFix reads the platform off your own response and writes the fix for that one — then hands the work to wherever you already do it.
- Next.js
- Vercel
- Netlify
- Cloudflare
- nginx
- Claude Code
- Cursor
- GitHub
- Supabase
- Firebase
- Lovable
- Bolt
- v0
Who it is for
Built for everything
you put on the internet
A marketing site, a generated app, a client project or a production service — the checks are the same, and so is the fix prompt at the end of them.
Shipping with an AI editor
A generated app deploys before anyone has read its headers. Scan the URL, paste the prompt back into the editor that built it, and the findings close in the same session.
Solo founders
No security team, no SEO retainer, and a site that is the whole business. One scan tells you what a stranger can see, and what it would take to close it.
Agencies and freelancers
A report with the raw evidence in it is something a client can act on — and a public scan URL is something you can send before the invoice.
Engineers on call
Uptime probed from outside your own network, certificates warned about with weeks to spare, and a status page that already exists when an incident starts.
SEO and content teams
Technical SEO and the answer-engine checks Search Console will never report — whether your text survives without JavaScript, and whether AI crawlers are allowed at all.
Teams with a release checklist
The same engine runs in CI through the CLI, with JSON output, so a deploy can fail on a finding instead of quietly shipping it.
Pricing
Free to scan.
Pro to finish.
Both plans run all 85 checks and open every finding with the evidence behind it. Pro adds the prompt that fixes the whole report at once, daily monitoring, full history, the API and shareable reports.
Launch pricing
What’s inside
Everything Pro ships with — the report keeps working after the scan.
- All 85 checks on every scan
- 500 scans a month
- Every finding in full, with its evidence
- One prompt that fixes the whole site
- Scan history and score changes
- 25 monitored sites
- 25 projects
- API access and 10 keys
| Compare | FreeFreepermanent | Pro$17 / month |
|---|---|---|
| Scans | 10 a month · all 85 checks | 500 a month · all 85 checks |
| Findings | Full detail and evidence | Same |
| Fix prompts | One per finding | One grouped prompt for the whole report |
| Monitoring | 1 site, weekly | 25 sites, daily, with alerts |
| History and score changes | Last scan only | Full history |
| API, CLI, MCP, CI | Not included | Included · 10 keys |
| Shareable and white-label reports | Not included | Included |
Both plans run every check on every scan and open every finding with the value it was measured from. Pro is what keeps the report working after that: the grouped prompt, the history, the API.
FAQ
Before you paste
your domain
What a scan touches, what we keep, where it runs and how it is billed — the things worth knowing before you hand a security tool the address of something you own.
What does ScanlyFix actually do?
You paste a URL. One fetch builds a shared picture of the page — headers, HTML, cookies, TLS, DNS, robots.txt — and 85 checks run over it across six pillars: security, SEO, AI answer engines, performance, accessibility and compliance. You get a score per pillar, every finding with the raw value behind it, and one prompt that fixes the lot.
Will this attack my site?
No. A scan is a read: it requests pages the way a browser and a crawler would, never logs in, never submits a form, and never changes state. The two checks that touch a backend — Supabase row-level security and Firebase rules — run only on a domain you have verified you own.
Do I need an account?
To scan, yes — but a free one: a code to your email, no password to create. Sharing the result asks nothing more. A finished report lives at a public URL where anyone can see the score, the pillar breakdown and every finding’s title and severity without signing in. Reading the findings themselves is what the account opens.
How is this different from Lighthouse or an SEO audit?
Lighthouse measures one page in a browser; an SEO tool reads the markup. This reads the response — headers, TLS, cookies, DNS, robots — across 85 checks in six pillars, shows the raw value behind every claim, and ends in a prompt an AI coding agent can execute.
What is the AI answer engines pillar?
Checks on whether an answer engine can read, resolve and cite your page: whether the text survives without JavaScript, whether AI crawlers are allowed, whether there is schema tying the page to a real entity, and whether anything dates the content. Search Console reports none of this, because the citation you did not get leaves no trace in any dashboard you own.
Is there a free plan?
Yes, and it stays free — no trial clock on it. About 10 scans a month, every check run, every finding open with the raw value behind it, and a fix prompt for each finding. Pro is what continues after the report: one grouped prompt for the whole site, daily monitoring on more sites, the history of your scores, the API and CLI, and exported or white-labelled reports.
Can I run it in CI or from my editor?
Yes. There is a CLI with JSON output, and ScanlyFix is an MCP server — point Claude Code or Cursor at it and the agent runs the scan and applies the fixes itself, without a report ever being opened.
Why did my score change when I did not change anything?
It should not, and the engine is built so it cannot happen silently. Every scan records the engine version it was measured with, and no feature compares two scans across a change in it. If checks were added, coverage moved — and you are told so rather than emailed that your site got worse.
What happens if a check fails?
It is recorded as our error, not your finding, and the pillar it belongs to is marked provisional. A partly broken instrument is never presented as a measurement.
What do you store about me?
Almost nothing. Your email, the pillars you chose, and an opaque auth identifier. No name, no password, no phone number, no payment details — Razorpay holds those. Scans store the URL, scores and findings. The full list is on the privacy page.
Do you share my data?
Only what each processor needs to do its job: Supabase stores it, Resend sends your alerts, Inngest runs scans, Razorpay handles billing. We do not sell data, run advertising, or place tracking cookies.
How am I billed, and can I cancel?
Paid plans are billed monthly in advance through Razorpay, at the price shown at checkout. You can cancel at any time from settings; cancelling stops the next renewal and leaves your plan active until the end of the period you have already paid for. We do not pro-rate part-months. If a charge is wrong, write to us within 30 days and we will put it right.
Can I delete my account?
Email us from the address on your account and everything is deleted within 30 days — account, scans, findings, monitors. You can also request a copy of what we hold.
Find out what yours is
quietly getting wrong.
85 checks, the evidence behind every one, and a prompt that fixes them. About a minute, and a free account.
ScanlyFix
Security, SEO and AI-answer-engine scanning for anything you put on the internet. Paste a URL, read the evidence, run the fix.