Website health check · 75 checks · no account
Point it at a URL.
Get the diagnosis.
One scan of any website, 75 checks, and a score out of 100 — then, for every one that failed, the evidence behind it and the fix for your stack. No account needed.
Free, no account, about 40 seconds — every check and every finding visible. Nothing is stored: the report is delivered to your tab and erased from the server as it leaves.
49
Held at 49 by one expired certificate
71 ran · 62 passed · 9 failed
QA
86
Good
SEO
71
Needs work
PERF
94
Good
SEC
40
Poor
A11Y
78
Needs work
UX
100
Good
One mark per check, in the order they ran. Taller and darker is worse, so the faults are findable before they are read — here, a critical one in security.
Illustrative — not a real scan
Includes an AI readiness score. Other tools check whether you have let ChatGPT and Claude in. This one also checks whether there is anything on the page once they arrive. What that means.
not just another score
A score tells you something is wrong.
Every finding tells you what to do.
Each failing check comes back with the evidence behind it and a fix written for your stack — not a recommendation to go and read about it. This is one of the 75, exactly as the report renders it.
Every check, explained — what each one looks for, why it matters, and the fix.
security-csp
Missing Content-Security-Policy header
- evidence
- No Content-Security-Policy in the response headers for https://example.com/
- how to fix
- Send a Content-Security-Policy header, starting in report-only mode so you can see what it would block before you enforce it.
- nginx
add_header Content-Security-Policy-Report-Only "default-src 'self'" always;
The report picks the snippet for the stack it detected on your site and puts that one first. Apache, Next.js and Netlify forms are shown too — a guess from response headers is not good enough to hide the others behind.