WebAuditOS website audit platformOne URL. 9 categories.
Every finding shows its evidence.

Yes - a scan is a read-only observation of pages that are already public. We send GET requests only: no forms, no credentials, no POST, and nothing that changes anything on your side. robots.txt is checked before a URL is fetched rather than after. With no Crawl-delay declared we keep up to 4 requests in flight with at least 250 ms between requests in each of them, which is at most 16 requests a second; declare one and we honour it in full, at a single request in flight.

Only one you own or are authorised to assess - you tick a box confirming exactly that when you start a scan, the confirmation is recorded, and it is in the terms. Auditing client domains is the main case this is built for, which is what the agency workspaces and white-label reports are for. If you are on the receiving end of a scan you did not ask for, one line in your robots.txt stops us on the next request.

A JavaScript app, yes: pages are rendered in Chromium, so content that only appears after the JavaScript runs is seen and measured. On a large site the browser pass renders a sample of the crawled pages rather than all of them, and the scan tells you how many of each it did. Pages behind a login are not covered - we send no credentials to anyone, by design.

Those answer one question, about one page, and leave you nothing to hand anybody. This crawls the site, runs 199 checks across 9 categories, and returns one weighted score with the evidence attached to every finding - plus a prioritised fix list and a report you can send to a client, branded on Agency plans. The difference is not the checks, it is having one defensible artefact instead of four browser tabs and a spreadsheet.

Quite a lot, and we label it instead of guessing. Password hashing, CSRF tokens, rate limiting, row-level security and whether your backups restore are invisible from outside - no external scanner can see them, including this one. They sit in a manual attestation layer that never silently moves your score, and every finding is marked as auto-detected, inferred from public signals, or requiring your confirmation.

Neither. Paste a URL on this page and you get a score across all 9 categories, your highest-priority finding in full, and a link you can share - with no sign-up. An account is what keeps the history and opens the rest of the findings. Pro is the one paid plan with a trial - 7 days, card required, cancel any time. The others bill from the first day and can also be cancelled at any time.