Lighthouse vs ScanlyFix
It measures the page.This measures the response
Lighthouse is the best free instrument there is for a page that loads slowly in a browser. This is an instrument for the things a browser never shows you — the headers, the certificate, the DNS records, the file that bars every AI crawler. Run both, and here is exactly where each wins.
- 85 checks · 6 pillars
- Performance: honest about being weaker
- axe-core overlap, admitted
- Engine 1.24.12
Line by line
Same URL,
two different objects
Each row names what Lighthouse measures from a rendered page, what this reads from a response, and the two places the work genuinely overlaps.
What it reads
Lighthouse
A Chrome instance loads the URL, executes the JavaScript, and audits the rendered document plus the requests the page made. The measurement is of the page after the browser has finished its work.
ScanlyFix
One HTTP GET of the URL, plus DNS, TLS and robots.txt, and the checks run over that response before any script has run. 85 checks across 6 pillars.
Performance
Lighthouse
The strongest lab measurement available for free: FCP, LCP, TBT, CLS, Speed Index on a throttled mid-range mobile profile, with an element-level diagnosis of what delayed each one.
ScanlyFix
Weaker, and stated as weaker. Three of the 4 performance checks read the response — compression, caching headers, image formats — and the fourth, Core Web Vitals, comes from the PageSpeed Insights API, which is a Lighthouse run on Google’s infrastructure plus CrUX field data. This product does not drive a browser of its own.
Accessibility
Real overlapLighthouse
axe-core against the rendered page, scored on a weight per issue rather than a count of them.
ScanlyFix
The same engine on the same job: axe-core against the rendered, post-JavaScript page in a headless browser, alongside the 3 static reads it ships with — image alt text, form labels, link text. When no browser tier ran, the static checks stand down instead of pretending they covered the rest.
Security
Lighthouse
Best Practices flags a handful of things that look security-adjacent — an insecure TLS origin, a vulnerable library version, a deprecated API — and checks that the page is served over HTTPS.
ScanlyFix
That is the gap this product was built for. 49 security checks: Content Security Policy and its report-only twin, HSTS, frame and referrer policy, cookie attributes, certificate and protocol, exposed paths and source maps, keys compiled into the bundle, CORS, JWT handling, the mail and DNS records (SPF, DKIM, DMARC, CAA), subdomain takeover, and Supabase or Firebase rules on a verified domain.
SEO
Real overlapLighthouse
On-page signals the loaded document can settle: title, meta description, heading order, link crawlability, hreflang, image alt, structured data parsing.
ScanlyFix
Overlapping on the document, wider on the files beside it: 17 SEO checks that include the ones a browser never fetches unless you ask — robots.txt and what it says about AI crawlers, the XML sitemap, and the meta robots directive — and a duplicate-title check that compares your sub-pages, which no single render of a single URL can produce.
AI answer engines
Lighthouse
No category for it, and no claim of one.
ScanlyFix
8 checks on what an AI crawler fetches: whether the text survives without JavaScript, whether robots.txt admits GPTBot, OAI-SearchBot, ChatGPT-User, PerplexityBot, ClaudeBot and CCBot, whether llms.txt exists, entity and FAQ schema, answer-shaped structure, authorship and date signals, and outbound citations. None of them query an assistant, and the page that describes them says so.
What happens next
Lighthouse
An HTML or JSON report, and opportunities ranked by estimated savings. Turning them into changes is your afternoon.
ScanlyFix
Every finding carries the raw value it was measured from, and the report ends in one prompt that groups the work by the file each change belongs in — written for a coding agent to execute.
Running it
Lighthouse
Free, open source, yours to run: a Chrome tab, the npm package, or the PageSpeed Insights API. It can be pointed at a staging URL behind your firewall.
ScanlyFix
A hosted scan of a public URL. Paste the address, an account made of an email code, no agent to install and nothing to configure. Which means a local or authenticated target is Lighthouse’s job, not this one.
A lab score of 100 and a header the browser never sees are not the same measurement.
Where each wins
Four statements
against our own interest
A comparison written by one side is only worth reading for the parts that hurt it. Start there.
Lighthouse is the better instrument for a slow page
It runs the page in a real browser, throttles it to a phone you can name, and tells you which element held up Largest Contentful Paint. A response reader cannot do that and does not claim to. If the question is "why is this page slow", open Lighthouse.
This is the better instrument for what a browser cannot see
The certificate chain, the header that never reaches the DOM, the CNAME pointing at an account someone stopped paying for, the robots.txt line that quietly bars every AI crawler. None of it exists in the rendered document, so none of it is in a lab audit.
The two numbers will disagree, and that is information
Lighthouse lab metrics describe one simulated load; CrUX field data describes what real visitors experienced over the last 28 days. A page can score 95 in the lab and be slow for the audience it actually has. This report reads the field number where there is one, and says where there is not.
Run both
Lighthouse is free and takes a minute. There is no version of this comparison in which running it is the wrong move — the point is that it answers a different question from the one this product answers, and a site usually needs both answers.
The checks named above are Response compression and Asset caching from the performance pillar, plus the 4 accessibility checks — all of them listed, with what they read, on the checks page.
FAQ
The questions
a fair comparison asks
Including the one where the answer is “use Lighthouse instead”.
Does ScanlyFix run Lighthouse?
Not itself. The performance pillar calls the PageSpeed Insights API, which runs Lighthouse on Google’s infrastructure and returns both the lab result and CrUX field data. That call is cached per URL for six hours, because a full lab run takes fifteen to thirty seconds and the free tier of the API has a monthly quota worth not burning. When the call cannot be made, the checks that depend on it abstain rather than scoring the site for something nobody measured.
Is a Lighthouse score of 100 enough?
For what it measures. A perfect Performance and Best Practices pair says the page loads quickly and does not use deprecated APIs. It does not say the CSP is parseable, that the session cookie has SameSite set, that an API key is not compiled into the bundle, or that the certificate renews in time — none of those are in the audit’s field of view.
You both check accessibility with axe-core. Why two?
Because the same engine run against different documents gives different answers. Lighthouse audits the rendered page it loaded. Here the axe-core run is one of 4 accessibility checks alongside static reads of the HTML, and the whole thing sits in the same report as the security findings, so one pass over a URL covers both conversations. It is honest overlap, not a hidden one.
Can I scan a staging site or a page behind a login?
No, and that is Lighthouse’s ground. This product requests a public URL the way a stranger would: no authentication, no submitted forms, nothing that changes state. A page that needs a session is either audited locally in a browser you drive yourself or read from the repository that implements it.
Which should I fix first?
Whichever finding is both true and cheap. A missing HSTS header and an unreachable CNAME take minutes and close real exposure; a Largest Contentful Paint improvement is a sprint. The grouped fix prompt exists for the cheap half — it orders the work by the file each change belongs in, so the response-level fixes land as one commit.
Where do the numbers on this page come from?
The per-pillar counts are read from the scan engine’s registry at build time, alongside engine version 1.24.12. Nothing about Lighthouse is counted here that Google does not document itself, and nothing about this product is stated that the registry cannot back up.
Lighthouse on the page.
This on the response
49 security checks, 17 SEO, 8 for AI answer engines, 4 performance and 4 accessibility — one read-only pass over a URL, the raw value behind every finding, and one prompt that fixes them.
Scan your site
ScanlyFix
Security, SEO and AI-answer-engine scanning for anything you put on the internet. Paste a URL, read the evidence, run the fix.
Home