What the tool measures, and what it refuses to do
An audit is only worth something if it can be replayed. This page describes the checks, how the site is accessed, the test sites that verify the tool, the review, and how data is handled. It also states the limits, without rounding them off.
The seven families
1. Search (SEO)
- Page title: presence and length.
- Description: presence and length.
- A single main heading, then a heading order that follows the content.
- Image alternative text, canonical address, language versions.
- robots.txt, sitemap, social preview, local structured data.
- Broken internal links, consistency of name, address and phone number.
2. Passive security
- HTTPS and redirection from the insecure address.
- Presented certificate and expiry date.
- Protection headers: HSTS, content policy, content type, referrer, frame.
- Mixed content, cookies without security attributes, forms sent in clear text.
- Server or software version disclosed in responses.
This is what a browser receives on arrival. It is not a penetration test.
3. Design and mobile
- Declared viewport, fixed width, text below 14 px.
- Touch targets below 44 px.
- Missing phone link, missing call to action above the fold.
- Horizontal overflow measured in a real browser, at 390 px wide.
4. Speed
- Total weight and number of requests.
- Uncompressed images, images without dimensions, images in an old format.
- Scripts and styles that block display.
- Time to first byte, compression, cache.
5. Obsolescence
- CMS and version, found in metadata or paths.
- Old libraries, outdated scripting engine.
- Table-based layout, obsolete style tags, missing doctype.
- Frozen copyright year.
6. Email and DNS
- Mail records.
- SPF and DMARC.
These are public data, read the way a correspondent would read them before sending a message. No mailbox is opened and no message is sent.
7. Visible compliance
- Presence of legal notice and a privacy policy.
- Presence of a cookie banner.
- Trackers loaded before consent, observed in requests.
This is a record of what is visible. It is neither legal advice nor a compliance audit.
Passive mode: what a visitor does
For a site that is not ours, the audit is limited to what a visitor or a search engine already does:
- reading the home page and a few linked pages, up to ten pages;
- reading robots.txt, the sitemap and the favicon;
- respecting robots.txt, one request per second at most, with an identified browser;
- reading public DNS and the presented certificate.
The tool never requests /.env, /.git, /wp-admin, or any administration file. It does not scan ports, submit any form or attempt any login. A mode with active probes exists only for the owner's own site, with written consent and proof of ownership.
Test sites and control, replayed for every version
Three test sites come with the tool. They do not change, and their expected results are written in advance:
- A deliberately degraded site must produce at least twelve findings, including at least five priority 1, with a score of 3 out of 10 or lower.
- A correct site must produce between four and ten findings, with no priority 1 point, and a score between 5 and 8 out of 10.
- A deliberately clean control must stay at zero priority 1 and zero priority 2 points, with a score of 9 out of 10 or higher.
If the control is not at zero, the tool is wrong, not the control. A failed test site is recorded and kept in the control report, never erased. Every check has at least one case that triggers it and one case that does not.
Human review before sending
Measurement produces findings, not a judgement. Before sending, every finding is reviewed: the evidence is checked, the context is examined, and an uncertain finding is removed. The report is dated and signed. The figures in it come from that day's measurement, not from an estimate.
Your data
Analysis runs on our machines. The pages read, the files and the findings are sent to no third-party analysis service. The request sent through the form travels through the site host to our mailbox, then the report is prepared locally. No account is created on the site, no analytics tracker is loaded, and fonts are served from this site.
Details of the data, retention periods and rights are on the privacy page.
Offline mode
A folder or archive of the site can be analysed without any network access. Findings from the file-based families are then the same as for the same page online. Families that depend on the network, such as passive security and email, cannot be measured offline: the report says so instead of guessing.
Criteria the tool must meet
- Sixty seconds at most per site in full mode, real browser included.
- Ten seconds at most in quick mode, on the page code alone.
- No request outside the allowed list in passive mode.
- The same findings offline and online, apart from network families.
Limits
- A site can be clean and still sit behind a better-established competitor: no audit promises a ranking.
- Visible compliance is recorded, not judged: legal questions remain with a legal professional.
- Passive security is not a replacement for a penetration test, which requires written consent and a defined scope.
- A measurement is dated: a site changes, and an old report is valid only for its date.
Last updated: 24 October 2026.