Check library
199 checks, each one attributable
Browse the audit engine by category. Every check carries a severity, a detection method and a documented reason it matters - nothing is scored on vibes.
Every check, by category
Security
Headers, TLS, cookies, exposure surface
Anatomy of a finding
Every issue arrives fix-ready
A severity badge is not actionable. A finding with the evidence we saw, a reason, an effort estimate and the change to make is.
No Content-Security-Policy header
The origin serves no CSP, so any injected script executes with full privileges.
- Technical explanation
- No `Content-Security-Policy` or `Content-Security-Policy-Report-Only` response header was observed on 128/128 crawled documents. No meta-equivalent CSP was present in the document head either.
- Why it matters
- CSP is the last line of defence against cross-site scripting and third-party script compromise. Without it, a single injected tag can exfiltrate session data or payment inputs.
- Detection evidence
- GET / HTTP/2 200 - response headers: server, x-powered-by, set-cookie, cache-control (no CSP)
- Recommended fix
- Start with a report-only policy scoped to the assets you actually load, monitor violations for 1–2 weeks, then enforce. Avoid 'unsafe-inline' by hashing or noncing inline scripts.
{
"id": "SEC-CSP-001",
"category": "security",
"severity": "critical",
"status": "fail",
"detection": "auto",
"effort": "M",
"impact": "high",
"standards": [
"OWASP ASVS 14.4.3",
"MDN CSP",
"CIS 2.1"
],
"pages": [
"/",
"/checkout",
"/account/login",
"/pricing"
]
}Severity model
Critical, high, medium, low, info, passed, manual check and not applicable. Not-applicable items never penalise your score.
Weighted scoring
Category weights, severity, and how much of the site a finding covers. A broken canonical across every page costs twice one on a single page; which page it is does not change the cost.
Confidence values
Inferred findings carry an explicit confidence percentage so you know how hard to push back on a client's developer.
Effort and impact
S/M/L effort against low/medium/high impact, which is what drives the quick-wins list.
Standards mapping
OWASP ASVS, WCAG 2.2, RFCs, Core Web Vitals and Google Search Essentials references on the findings that have them.
Lifecycle
Mark findings resolved, ignored or accepted risk. Reports show fixed-versus-open movement between scans.
Preview Lab
See the site the way your client's customers do
15 device presets and 6 browser frames, with a portrait/landscape toggle, a grid overlay and zoom.
Device presets
Browser modes
One frame at a time, at the preset you pick. Comparing two scans against each other is a separate screen - Compare - which diffs their scores and findings rather than their pixels.
Every capture is a Chromium render. A browser mode draws that browser's furniture and subtracts what it takes from the screen, so a frame named after Safari shows how much of the page survives under its bars, not how WebKit would lay the page out. Picking a preset resizes the frame around a capture the engine has already taken; it does not re-render the site on that device. Rendering happens in one engine (Chromium), so we do not claim to have reproduced a Safari or Firefox bug for you.
Open Preview LabWhere to start
The website audit checklist, in the order that actually pays
What to check on a website and in what order: what decides whether it is secure, fast, indexable and usable - and the questions no external scan can answer.
Read the guide →