What's wrong with your website?
Paste a URL. It fetches the page, reads the markup, probes robots.txt, sitemap.xml and llms.txt, inspects the TLS certificate and DNS records, and grades what it finds: meta tags, Open Graph cards, structured data, AI crawler access, accessibility, performance, security headers, exposed files and email spoofing protection.
Scan sites you own or are authorised to test. The security checks are read-only reconnaissance: ordinary GET requests to conventional paths, a TLS handshake and public DNS lookups. No payloads, no traversal, no credential guessing, nothing written to the target.
Title, description, canonical, viewport, robots directives
Heading structure, link quality, crawlability, thin content
How the page unfurls on X, Facebook, Slack, iMessage
GPTBot, ClaudeBot, PerplexityBot access, llms.txt, JS-shell detection
JSON-LD validity and schema.org completeness
Alt text, form labels, landmarks, language, zoom
Payload, compression, caching, render-blocking resources
HSTS, CSP, clickjacking, cookie flags, version leaks
Stray .env and .git, source maps, directory listings, secrets in markup
Chain trust, expiry, hostname match, legacy protocols, cipher strength
SPF lookup limits, DMARC policy, DKIM selectors, CAA
Expiry, transfer locks, DNSSEC and registrar, straight from RDAP
Redirect chains, soft 404s, mixed content, manifests
Static analysis only: the page is fetched and parsed, not rendered in a browser. Core Web Vitals, colour contrast and keyboard behaviour need a real browser session and aren't covered here.