# Canopy: Grade any website's health in 4 seconds > Source: > Published: 2026-08-11 00:15:45+00:00 # Grade any website in *four seconds.* Twelve analyzers: security headers, CSP, cookies, privacy & trackers, AI readiness, email, DNS, SEO, performance, accessibility, links & PWA. Each returns a letter and the exact fix. - Free, no account - Unlimited scans - CI gate included - Grades its own site Try: [this site](/?url=https%3A%2F%2Fcanopystack.dev) · [github.com](/?url=https%3A%2F%2Fgithub.com) · [example.com](/?url=https%3A%2F%2Fexample.com) ## Live examples — real grades, updated hourly [github.com full report →](/site?domain=github.com) [wikipedia.org full report →](/site?domain=wikipedia.org) [stripe.com full report →](/site?domain=stripe.com) [nytimes.com full report →](/site?domain=nytimes.com) ## Scan & monitor 7 tools ### Whole-site scan 11 layers at once, one combined grade. ### Multi-page sweep Your sitemap's pages checked together: drift shows up per page. ### Dashboard All your domains as a live wall of grade badges on one URL. ### Uptime Pinged every 15 minutes, public status pages, 7 days of history. ### Trends Every monitored grade over time, in one view. ### Weekly digest What changed across your sites this week, regressions first. ### Compare Two URLs side by side on any layer, drift highlighted. ## Twelve graded layers ### Security headers HSTS, framing, sniffing, CORS, mixed content: 15 checks. ### CSP deep-dive Reads your policy the way an attacker would. ### Cookie security Every Set-Cookie, inspected like a browser does. ### Privacy & trackers Which analytics, ad pixels & recorders watch your visitors, and do you ask consent? ### Email security SPF, DMARC, DKIM: can strangers send mail as you? ### DNS posture DNSSEC, CAA, redundancy, IPv6. ### SEO & meta Titles, descriptions, canonicals, OG, sitemap. ### Performance TTFB, blocking scripts, layout shift, third-party fan-out. ### Accessibility Alt text, labels, zoom, heading order: WCAG smoke test. ### Link health Dead links, stale redirects, insecure targets, probed live. ### AI readiness Does your site say whether AI crawlers may read it? ### PWA & installability Manifest, icons, display mode: can it be installed as an app? ## Fix & automate 17 tools ### Fix pack A config for your server containing only the fixes you need. ### Reference configs The full A-grade setup for six stacks, copy-ready. ### CI gate curl with fail_under=B blocks deploys that regress. ### Badges & snapshots Live grade badges for READMEs; 90-day frozen report links. ### Redirect tracer Follow a URL hop by hop: loops, downgrades, wasted hops. ### Exposed files Is your .git, .env, a DB dump or phpinfo() reachable? Content-verified, no false alarms. ### security.txt Check or generate your RFC 9116 vulnerability-disclosure policy, expiry and all. ### robots.txt Valid, or secretly an HTML page, or one stray Disallow: / from deindexing you? Read as a document. ### Sitemap audit Is your sitemap.xml valid XML, within Google's 50k-URL cap, and full of absolute HTTPS URLs, or secretly an HTML 404? ### Social preview See how a link unfurls on X, Facebook, Slack, before you post. ### SERP preview See your title and description as a Google result — with the real pixel width that decides whether your title survives or gets cut with an ellipsis. ### Schema generator Generate paste-ready JSON-LD for review stars, FAQ, breadcrumbs, or paste your own and check it wins the rich result, against Google's rules. ### CSP builder Build a hardened Content-Security-Policy from what your site loads (Analytics, Fonts, Stripe, YouTube), starting from default-src 'self'. The author-side mirror of the CSP layer. ### Email records Generate correct SPF & DMARC records from who sends your mail (Google, Microsoft 365, SendGrid, SES), or lock down a domain that sends none. The author-side mirror of the email layer. ### robots.txt builder Generate a valid robots.txt: keep admin & cart paths private, declare your sitemap, and opt out of AI training while staying citable in ChatGPT & Perplexity answers. The author-side mirror of the robots.txt and AI layers. ### SRI hashes Generate Subresource Integrity hashes for the CDN scripts and styles you embed, so the browser refuses a file a hijacked CDN has swapped — plus the CORS check that stops SRI silently breaking the load. ### Pro (waitlist) Alerts on regressions, private slots, higher limits. ## What the header scan checks 15 checks HTTPS enforcement (HTTP → HTTPS redirect) · Strict-Transport-Security · Content-Security-Policy · X-Content-Type-Options · clickjacking protection (X-Frame-Options / frame-ancestors) · Referrer-Policy · Permissions-Policy · Cross-Origin-Opener-Policy · cookie security (Secure / HttpOnly / SameSite) · CORS (Access-Control-Allow-Origin reflection & credentials) · mixed content (http:// scripts, styles, frames & images on HTTPS pages) · Subresource Integrity on third-party scripts/styles · cache-control sanity · security.txt (RFC 9116) · information disclosure (Server / X-Powered-By). Each rolls up to a letter grade with the exact fix to apply.