Twelve analyzers — security headers, CSP, cookies, privacy & trackers, AI readiness, email, DNS, SEO, performance, accessibility, links & PWA. Each returns a letter and the exact fix.
Try: this site · github.com · example.com
11 layers at once, one combined grade.
Your sitemap's pages checked together — drift shows up per page.
All your domains as a live wall of grade badges on one URL.
Pinged every 15 minutes, public status pages, 7 days of history.
Every monitored grade over time, in one view.
What changed across your sites this week — regressions first.
Two URLs side by side on any layer, drift highlighted.
HSTS, framing, sniffing, CORS, mixed content — 15 checks.
Reads your policy the way an attacker would.
Every Set-Cookie, inspected like a browser does.
Which analytics, ad pixels & recorders watch your visitors — and do you ask consent?
SPF, DMARC, DKIM — can strangers send mail as you?
DNSSEC, CAA, redundancy, IPv6.
Titles, descriptions, canonicals, OG, sitemap.
TTFB, blocking scripts, layout shift, third-party fan-out.
Alt text, labels, zoom, heading order — WCAG smoke test.
Dead links, stale redirects, insecure targets, probed live.
Does your site say whether AI crawlers may read it?
Manifest, icons, display mode — can it be installed as an app?
A config for your server containing only the fixes you need.
The full A-grade setup for six stacks, copy-ready.
curl with fail_under=B blocks deploys that regress.
Live grade badges for READMEs; 90-day frozen report links.
Follow a URL hop by hop — loops, downgrades, wasted hops.
Is your .git, .env, a DB dump or phpinfo() reachable? Content-verified, no false alarms.
Check or generate your RFC 9116 vulnerability-disclosure policy — expiry and all.
Valid — or secretly an HTML page, or one stray Disallow: / from deindexing you? Read as a document.
Is your sitemap.xml valid XML, within Google's 50k-URL cap, and full of absolute HTTPS URLs — or secretly an HTML 404?
See how a link unfurls on X, Facebook, Slack — before you post.
Generate paste-ready JSON-LD for review stars, FAQ, breadcrumbs — or paste your own and check it wins the rich result, against Google's rules.
Build a hardened Content-Security-Policy from what your site loads — Analytics, Fonts, Stripe, YouTube — starting from default-src 'self'. The author-side mirror of the CSP layer.
Generate correct SPF & DMARC records from who sends your mail — Google, Microsoft 365, SendGrid, SES — or lock down a domain that sends none. The author-side mirror of the email layer.
Alerts on regressions, private slots, higher limits.
HTTPS enforcement (HTTP → HTTPS redirect) · Strict-Transport-Security · Content-Security-Policy · X-Content-Type-Options · clickjacking protection (X-Frame-Options / frame-ancestors) · Referrer-Policy · Permissions-Policy · Cross-Origin-Opener-Policy · cookie security (Secure / HttpOnly / SameSite) · CORS (Access-Control-Allow-Origin reflection & credentials) · mixed content (http:// scripts, styles, frames & images on HTTPS pages) · Subresource Integrity on third-party scripts/styles · cache-control sanity · security.txt (RFC 9116) · information disclosure (Server / X-Powered-By). Each rolls up to a letter grade with the exact fix to apply.