Twelve analyzers: security headers, CSP, cookies, privacy & trackers, AI readiness, email, DNS, SEO, performance, accessibility, links & PWA. Each returns a letter and the exact fix.
- Free, no account
- Unlimited scans
- CI gate included
- Grades its own site
Try: [this site](/?url=https%3A%2F%2Fcanopystack.dev) ·
[github.com](/?url=https%3A%2F%2Fgithub.com) ·
[example.com](/?url=https%3A%2F%2Fexample.com)
Live examples — real grades, updated hourly #
[github.com full report →](/site?domain=github.com)
[wikipedia.org full report →](/site?domain=wikipedia.org)
[stripe.com full report →](/site?domain=stripe.com)
[nytimes.com full report →](/site?domain=nytimes.com)
Scan & monitor 7 tools #
Whole-site scan
11 layers at once, one combined grade.
Multi-page sweep
Your sitemap's pages checked together: drift shows up per page.
Dashboard
All your domains as a live wall of grade badges on one URL.
Uptime
Pinged every 15 minutes, public status pages, 7 days of history.
Trends
Every monitored grade over time, in one view.
Weekly digest
What changed across your sites this week, regressions first.
Compare
Two URLs side by side on any layer, drift highlighted.
Twelve graded layers #
Security headers
HSTS, framing, sniffing, CORS, mixed content: 15 checks.
CSP deep-dive
Reads your policy the way an attacker would.
Cookie security
Every Set-Cookie, inspected like a browser does.
Privacy & trackers
Which analytics, ad pixels & recorders watch your visitors, and do you ask consent?
Email security
SPF, DMARC, DKIM: can strangers send mail as you?
DNS posture
DNSSEC, CAA, redundancy, IPv6.
SEO & meta
Titles, descriptions, canonicals, OG, sitemap.
Performance
TTFB, blocking scripts, layout shift, third-party fan-out.
Accessibility
Alt text, labels, zoom, heading order: WCAG smoke test.
Link health
Dead links, stale redirects, insecure targets, probed live.
AI readiness
Does your site say whether AI crawlers may read it?
PWA & installability
Manifest, icons, display mode: can it be installed as an app?
Fix & automate 17 tools #
Fix pack
A config for your server containing only the fixes you need.
Reference configs
The full A-grade setup for six stacks, copy-ready.
CI gate
curl with fail_under=B blocks deploys that regress.
Badges & snapshots
Live grade badges for READMEs; 90-day frozen report links.
Redirect tracer
Follow a URL hop by hop: loops, downgrades, wasted hops.
Exposed files
Is your .git, .env, a DB dump or phpinfo() reachable? Content-verified, no false alarms.
security.txt
Check or generate your RFC 9116 vulnerability-disclosure policy, expiry and all.
robots.txt
Valid, or secretly an HTML page, or one stray Disallow: / from deindexing you? Read as a document.
Sitemap audit
Is your sitemap.xml valid XML, within Google's 50k-URL cap, and full of absolute HTTPS URLs, or secretly an HTML 404?
Social preview
See how a link unfurls on X, Facebook, Slack, before you post.
SERP preview
See your title and description as a Google result — with the real pixel width that decides whether your title survives or gets cut with an ellipsis.
Schema generator
Generate paste-ready JSON-LD for review stars, FAQ, breadcrumbs, or paste your own and check it wins the rich result, against Google's rules.
CSP builder
Build a hardened Content-Security-Policy from what your site loads (Analytics, Fonts, Stripe, YouTube), starting from default-src 'self'. The author-side mirror of the CSP layer.
Email records
Generate correct SPF & DMARC records from who sends your mail (Google, Microsoft 365, SendGrid, SES), or lock down a domain that sends none. The author-side mirror of the email layer.
robots.txt builder
Generate a valid robots.txt: keep admin & cart paths private, declare your sitemap, and opt out of AI training while staying citable in ChatGPT & Perplexity answers. The author-side mirror of the robots.txt and AI layers.
SRI hashes
Generate Subresource Integrity hashes for the CDN scripts and styles you embed, so the browser refuses a file a hijacked CDN has swapped — plus the CORS check that stops SRI silently breaking the load.
Pro (waitlist)
Alerts on regressions, private slots, higher limits.
What the header scan checks 15 checks #
HTTPS enforcement (HTTP → HTTPS redirect) · Strict-Transport-Security · Content-Security-Policy · X-Content-Type-Options · clickjacking protection (X-Frame-Options / frame-ancestors) · Referrer-Policy · Permissions-Policy · Cross-Origin-Opener-Policy · cookie security (Secure / HttpOnly / SameSite) · CORS (Access-Control-Allow-Origin reflection & credentials) · mixed content (http:// scripts, styles, frames & images on HTTPS pages) · Subresource Integrity on third-party scripts/styles · cache-control sanity · security.txt (RFC 9116) · information disclosure (Server / X-Powered-By). Each rolls up to a letter grade with the exact fix to apply.