85 checks.Here they all are.

Content-Security-Policy

Checks the Content-Security-Policy for one that is missing, report-only, or lets inline script — the browser's main defence against injected code.

Strict-Transport-Security

Requires Strict-Transport-Security with a long max-age: the header that makes a browser refuse plain HTTP next time, which is what closes off SSL-stripping.

DDoS protection

Reads the CDN and WAF fingerprints stamped on the response headers plus the hostname’s DNS chain: reports an origin that answers every request itself, and abstains when an unrecognised host sits in between.

Vercel hosting security

On a detected Vercel deployment: asks whether its own project files answer at a URL, what its edge cache did to a response that sets cookies, and whether it is served from Vercel’s shared domain.

Netlify hosting security

On a detected Netlify deployment: asks whether its own project files answer at a URL, what its CDN cache did to a response that sets cookies, and which of Netlify’s automatic deploy hosts is answering.

Cloudflare hosting security

On a Cloudflare-fronted site: asks whether its .dev.vars secrets or Wrangler config answer at a URL, what its edge cache did to a response that sets an application cookie, and whether a Cloudflare-issued address is serving it.

Clickjacking protection (X-Frame-Options / frame-ancestors)

Reports a missing or ineffective frame-ancestors / X-Frame-Options, which lets any other site drop this page into an invisible iframe and clickjack the visitor.

X-Content-Type-Options

Checks X-Content-Type-Options is set to nosniff; without it browsers guess at response types and an uploaded file can begin running as script.

Referrer-Policy

Checks Referrer-Policy — absent is flagged, and a policy that sends full URLs to every site you link to is flagged harder.

Permissions-Policy

Reports no Permissions-Policy, which leaves embedded third-party frames free to ask the browser for camera, microphone and geolocation.

TLS certificate expiry

Severity scales with how close the TLS certificate is to expiring. An expired one is critical: browsers refuse the site outright.

TLS protocol version

Checks the TLS version a modern client can negotiate. TLS 1.1 or older means the server offers nothing current browsers accept.

HTTP → HTTPS redirect

Flags pages reachable over plain HTTP, and port-80 responses that serve content instead of redirecting straight to HTTPS.

Cookie security flags

Checks Secure, HttpOnly and SameSite on cookies the scanned response sets. Names only — cookie values are never read or sent anywhere.

CORS policy

Reads the page response's Access-Control headers and reports a wildcard, or a wildcard paired with credentials, which lets any origin read what comes back.

Anonymous access to protected pages

Asks six of the site's own admin, API and debug paths for a page as a stranger, probes the routes its own JavaScript names, and reports open doors, walkable ids and bulk JSON lists — shapes only, never the records.

CSRF protection on state-changing forms

Reads the forms the scanned pages serve and reports a state-changing one that carries no anti-CSRF token as a field, meta tag, cookie or action parameter.

Mixed content

On HTTPS pages, finds scripts, styles, images or form targets still pointed at http://, which browsers either block or ship unencrypted.

Server header disclosure

Reports Server headers that reveal an exact product version, which narrows an attacker's search to the exploits written for that version.

X-Powered-By disclosure

Reports X-Powered-By, X-AspNet-Version and X-Generator stack banners; a version in the value counts for more than a bare product name.

security.txt

Requests /.well-known/security.txt and reports one that is missing, expired, answers as HTML, or carries no contact — the address researchers try first.

SPF record

Checks the domain SPF record: missing, duplicated, ending in +all, or past the 10-lookup limit, each of which leaves anyone able to send as the domain.

DMARC record

Checks _dmarc.<domain> for a record that is missing, invalid or p=none — spoofing unenforced, or enforced with no reporting address to see it happen.

DKIM signing keys

Queries a curated list of common selector names for revoked keys and test-mode flags. Finding nothing at those selectors is never reported as "DKIM is absent".

CAA record

Climbs the CAA records from host to registrable domain. With none published, any certificate authority may issue for the domain.

Domain registration expiry

From registry (RDAP) data, reports a domain expired or expiring within 30 days — a lapsed domain takes the website and every mailbox on it down.

Domain registry state

From the same registry record: no transfer lock or a transfer in progress, DNSSEC delegation versus a signed zone, and served nameservers against the ones the registry delegates to.

Subdomain takeover

Reads the zone's own CNAME chains from DNS and reports names that point at a resource nobody holds any more — the record an attacker claims next.

Exposed sensitive files

Requests a fixed list of paths like .env and .git files, and reports only those that answer with content that genuinely matches what they should be.

Secrets in JavaScript

Scans the page's inline scripts and its own downloaded bundles for known credential shapes — keys compiled into client-visible code.

Source maps

Follows sourceMappingURL in the page's own scripts and reports maps that really download, since they hand back original source, comments and API shapes.

Directory listing

Requests the folder of one asset the page actually loads and reports when the server answers with an autoindex listing of every filename in it.

Subresource Integrity

Flags cross-origin scripts and stylesheets loaded without an integrity hash, so a file changed at its host would run inside the page.

Audit logging & monitoring exposure

Reports the surfaces whose job is the log — the actuator index, Go pprof, Apache server-status — when they answer unauthenticated, plus the trace headers on the response.

Open redirect through URL parameters

Places a reserved test host in the site's own redirect parameters and reads the Location header back without following it; also flags page JavaScript that navigates to a URL read from the address bar.

GraphQL endpoint protection

Asks the site's own GraphQL endpoints three read-only questions and reports what they volunteer: an open schema, a development console, stack traces in errors or suggested field names.

SQL injection in query parameters

On ownership-verified deep scans only: appends a true and two false SQL conditions to a page’s own query parameters and compares the shape of the answers. Two endpoints, GET only, nothing extracted.

Reflected cross-site scripting

Appends two inert canaries to a page’s own query parameters and reads which of their characters come back unescaped, and in what part of the document. Two endpoints, GET only, nothing executed.

DOM-based XSS sinks fed by URL input

Reads the page’s own JavaScript for a DOM sink — innerHTML, document.write, eval — that is fed straight from the URL fragment, a query parameter or a postMessage payload.

Session credentials in browser storage

Reads the page’s own JavaScript for tokens, JWTs and API keys kept in localStorage or sessionStorage, where any script on the origin can read them back.

JSON Web Tokens published to anonymous visitors

Reads the JSON Web Tokens an anonymous visitor already gets — in the page, the site’s own bundles or a crawled page — and reports their algorithms, claim names, lifetimes and where they were found. No requests.

JWT algorithm confusion at the site’s API

On ownership-verified deep scans only: sends one token payload unsigned, under an alg:none header and signed with the site’s own published public key, and reports whichever the API accepts. GET only, bodies never read.

Tech stack & CVE

Fingerprints the components a page loads from asset filenames, script banners and headers, matches precise detected versions against known CVEs, and names the release that fixes each one.

Tech stack inventory

Lists every framework, library and platform the scan recognises and where each fingerprint came from — an inventory of what the site runs, with no findings or scoring of its own.

File upload content validation

On ownership-verified deep scans only: uploads a frozen marker file through the site's own upload forms and fetches it back, reporting forms that accept it without validating content — worst when the file is served inline.

Webhook signature verification

On ownership-verified scans only: delivers one frozen event twice to a webhook path the site itself names — once unsigned, once with a well-formed signature that cannot be valid — and reports a receiver that accepts either.

Mobile API rate limiting

On ownership-verified scans only: sends the same GET seven times to API paths the site's own code names, and reports an endpoint that neither refuses the burst nor advertises a limit — read honestly, a small burst proves little.

Supabase row-level security

Only on ownership-verified scans: asks a detected Supabase project whether its public key can read row counts. Counts and table names, never row data.

Firebase security rules

Only on ownership-verified scans: asks the Firebase database, Storage bucket and site-named Firestore paths for public read or list access, and tests writes by deleting a path it proved empty.

Indexing directives

Parses every directive Google documents in the page’s robots and googlebot meta tags and the X-Robots-Tag header — not just noindex — and, on a deep scan, in the sub-pages its crawl kept.

robots.txt

Checks /robots.txt for rules that block Googlebot or every crawler, a missing file, or HTML served where plain text should be.

XML sitemap

Parses the sitemap robots.txt declares, or /sitemap.xml if none is, and reads it as a document — entries, hosts, dates, duplicates — then samples two URLs to see whether the list still matches the site.

Page title

Checks the page title exists exactly once and sits inside the 30–60 characters a search result has room to show.

Meta description

Checks the meta description behind a result snippet: missing, empty, duplicated or left as a template placeholder, outside 50–160 characters, or copying the page title.

H1 heading

Reads the H1 by the name assistive tech takes from it — text, aria-label, aria-labelledby or an image’s alt — and reports it missing, nameless, hidden, or left inside a template.

Viewport meta tag

Checks the viewport tag that mobile-first indexing ranks pages on, and flags the ones that switch pinch-zoom off.

Canonical URL

Checks this page's canonical link — the URL you tell Google to index — for missing, empty, conflicting, http or off-site targets.

HTML language attribute

Checks <html lang> the way WCAG 3.1.1 asks — that it exists, parses as one BCP 47 tag and not a locale name or template value, and matches the script the page is written in — so a screen reader loads the right voice.

Open Graph tags

Reads the og: tags a shared link is previewed from on Slack, WhatsApp and LinkedIn: missing or empty values, unrendered {{ template }} syntax, URLs with no host, and one property written twice.

X (Twitter) card

Only reads pages that declare a twitter:card: the type X recognises, the image, player iframe or app fields that layout needs, and tags left blank, templated, relative or without an @ handle.

Structured data (JSON-LD)

Reads this page's JSON-LD blocks in full: whether each parses, declares a schema.org @context and @type, carries the properties Google lists as required for its type, and has no blank value.

Favicon

Reads the icons a browser tab uses: a declared <link rel="icon"> is fetched and must answer with an image, and with none declared /favicon.ico is asked. apple-touch and mask links are reported, not judged.

Heading order

Reads this page's heading outline the way a screen reader walks it — nav, header, footer, aside and search regions keep their own sequence, hidden headings hold no rank — and reports a jump down of more than one rank.

hreflang

Reports only on pages that declare hreflang alternates: whether the language tags are valid, the URLs absolute, and this page is in its own set.

Broken internal links

On deeper scans, follows this page's same-origin links and reports the ones that answered 404, 410 or 5xx, naming where each sits. A 4xx that only refused us is listed as information, never called broken.

Duplicate titles and descriptions

On deeper scans, first reduces the sampled URLs to the pages they claim to be, then flags a title or description shared by more than one page. One page answering at several URLs is information, never a duplicate.

Server-rendered content

Detects a page that ships a nearly empty framework shell and fills it in the browser, which is nothing at all to a crawler that skips JavaScript.

AI crawler access

Reports AI crawlers that robots.txt shuts out of the whole site, and raises severity when llms.txt on the same host invites those bots in.

llms.txt

Checks /llms.txt, the plain-text guide AI crawlers read. Absence is reported as an opportunity, HTML served in its place as a defect.

Entity schema

On the home page, checks for Organization or Person schema whose sameAs links tie the site to an entity assistants already recognise.

Answer structure

On pages over 400 words, flags missing section headings and unbroken paragraphs — the boundaries an assistant uses to find a quotable passage.

FAQ and HowTo schema

Fires only where three or more question headings or accordions exist with no FAQPage schema, so the Q&A already on the page becomes quotable.

Author and date

On article pages only, checks for a machine-readable author and publication date, signals assistants weigh before citing a claim from the page.

Outbound citations

On articles over 600 words, flags those with no link outside the site; assistants weigh whether a page's claims can be traced to a source.

Response compression

Checks text responses over 2 KB arrive gzipped or brotli-compressed. Uncompressed HTML costs every visitor bytes, and slow mobile links the most.

Asset caching

Fetches one content-hashed same-origin asset: a short or missing max-age means returning visitors re-download a file that cannot change without its name changing.

Image formats

Counts four or more JPEG or PNG images with no WebP or AVIF offered alongside them — formats that carry the same picture at a fraction of the bytes.

Core Web Vitals

Asks Google PageSpeed Insights for LCP, INP and CLS: real-user Chrome data when it exists, a simulated phone load as a lower-severity fallback, otherwise nothing.

Image alt text

Lists images with no alt attribute, which a screen reader announces as a filename. A decorative empty alt is correctly exempt. Skipped when axe ran.

Form labels

Reports form fields with no label or ARIA name, which a screen reader announces as blank; a placeholder does not count. Skipped when axe ran.

Link text

Finds links with no accessible name and filler like "click here", which is all a screen reader's link list will read out. Skipped when axe ran.

Accessibility audit (axe-core)

Runs axe-core in a real headless browser against the rendered, post-JavaScript page, so it catches computed issues like contrast. Silent when no browser tier ran.

Tracking before consent

Loads the page once and flags analytics or ad scripts from a fixed vendor list, or tracking cookies already set, before any consent was given.

Consent mechanism

Where trackers fire, looks in the served HTML for a consent platform or banner markup. A banner that only renders in JavaScript stays invisible to this.

Privacy policy link

Scans the page's links for a privacy policy by URL or by wording in several languages. Pages too sparse to be expected to carry one are skipped.