Free tools
Eight front doors.One engine behind them.
85 checks, one report, and a page for whichever word you searched — security, SEO, AI visibility, or the tool that generated your app. None of them is a separate product with its own scanner.
- 85 checks per scan
- No agent to install
- Free account, no card
- One runs without an account
By question
Three scanners,
three questions
Every one of these is the same scan, filtered to what one kind of reader cares about. Paste a URL and all three reports come back.
- Security scanner49
Response headers, TLS and certificates, cookies and CORS, DNS and mail records, exposed paths and source maps, JWTs, GraphQL, upload and webhook endpoints, hosting configuration.
Open - SEO scanner17
What a crawler can make of a page: title and description, robots and sitemap, canonicals and hreflang, heading order, structured data, social previews, broken links.
Open - AEO scanner8
Whether an answer engine can read, resolve and cite the page: text without JavaScript, AI crawlers, llms.txt, entity schema, dates and outbound citations.
Open
By what built your app
Four builders,
one shortlist
These pages exist because of how people search, not because of how the engine works. There is no Lovable check and no Bolt check: there are the same 85 checks, and each page below names the ones that most often have something to say about an app that went from prompt to public in a day.
- Lovable scanner
Built and published the same afternoon, on a public subdomain. The checks that bite: row-level security, keys left in the bundle, cookie flags, CORS, CSP.
Open - Bolt scanner
A full stack with real endpoints. Rate limiting, anonymous access, injection and redirect shapes, webhook signatures, vulnerable package versions.
Open - v0 scanner
The UI is generated; so is the plumbing it ships on. What a default Vercel deployment gives away: server headers, source maps, exposed paths, duplicate metadata.
Open - Cursor scanner
An editor, not a host — so this is the one page with two halves: the live URL gets the site scan, and the repository gets secrets, dependency vulnerabilities, licences and an SBOM.
Open
A tool page is a search result. The scan behind all eight is the same one.
Runs without an account
The Supabase
RLS checker
Paste a project URL and the publishable (anon) key your frontend already ships, and the same Level-1 engine asks what that key can read. Severity counts and finding titles come back; the descriptions, evidence and remediations are what a connected account opens. Nothing is stored — the key you type is never written down, because nothing on this endpoint writes to a database at all.
- 10
- tables probed per run
- 5
- checks per project a day
- 20
- checks per address a day
- 0
- keys stored
Shared by all eight
What every tool
here has in common
The parts that do not change whichever page you came in through.
Read-only, every time
A scan requests pages the way a browser and a crawler do. It never logs in, never submits a form of yours, never calls a state-changing endpoint, and refuses private and metadata addresses before a request leaves. The two checks that touch a backend run against a project you pasted the key for, or one you have connected.
A free account, no card
Scanning needs an account; the account needs a code to your email and nothing else — no password to invent, no payment details to hand over. What a report looks like to someone without one is on the privacy and sharing pages.
Every number here is derived
85 checks, and the per-pillar counts above, are read from the check registry at build time. A check that stops existing leaves these pages in the same commit; nothing here can advertise coverage the engine does not have.
Engine 1.24.12, and honest about failures
Every scan records the engine version it was measured with, so score changes can be told apart from coverage changes. If a check errors, it is recorded as our failure rather than your finding, and the pillar it belongs to is marked provisional.
Adjacent
Not a tool.
The rest of it
Where to go when the honest answer is that you need a different kind of tool, or the full list rather than a shortlist.
- How this compares
What a website scan is, what it cannot be, and which other kind of tool answers the questions it has to abstain from.
Open - All 85 checks
The directory: every check by name, what it looks at, and the value it reads to decide.
Open - Pricing
One paid plan, said once, with the limits the code actually enforces.
Open
Pick whichever
describes your site
They all run the same 85 checks and produce the same report. The URL you came in through only decides which findings get explained first.
Scan your site
ScanlyFix
Security, SEO and AI-answer-engine scanning for anything you put on the internet. Paste a URL, read the evidence, run the fix.
Home