Canopy: Grade any website's health in 4 seconds

Canopy, a website health grading tool, launched a free service that grades any website in four seconds using twelve analyzers covering security headers, CSP, cookies, privacy, AI readiness, email, DNS, SEO, performance, accessibility, links, and PWA. The tool offers unlimited scans without an account, includes a CI gate, and provides letter grades with exact fixes, along with monitoring tools like uptime checks every 15 minutes and weekly digests.

Grade any website in four seconds. Twelve analyzers: security headers, CSP, cookies, privacy & trackers, AI readiness, email, DNS, SEO, performance, accessibility, links & PWA. Each returns a letter and the exact fix. - Free, no account - Unlimited scans - CI gate included - Grades its own site Try: this site /?url=https%3A%2F%2Fcanopystack.dev · github.com /?url=https%3A%2F%2Fgithub.com · example.com /?url=https%3A%2F%2Fexample.com Live examples — real grades, updated hourly github.com full report → /site?domain=github.com wikipedia.org full report → /site?domain=wikipedia.org stripe.com full report → /site?domain=stripe.com nytimes.com full report → /site?domain=nytimes.com Scan & monitor 7 tools Whole-site scan 11 layers at once, one combined grade. Multi-page sweep Your sitemap's pages checked together: drift shows up per page. Dashboard All your domains as a live wall of grade badges on one URL. Uptime Pinged every 15 minutes, public status pages, 7 days of history. Trends Every monitored grade over time, in one view. Weekly digest What changed across your sites this week, regressions first. Compare Two URLs side by side on any layer, drift highlighted. Twelve graded layers Security headers HSTS, framing, sniffing, CORS, mixed content: 15 checks. CSP deep-dive Reads your policy the way an attacker would. Cookie security Every Set-Cookie, inspected like a browser does. Privacy & trackers Which analytics, ad pixels & recorders watch your visitors, and do you ask consent? Email security SPF, DMARC, DKIM: can strangers send mail as you? DNS posture DNSSEC, CAA, redundancy, IPv6. SEO & meta Titles, descriptions, canonicals, OG, sitemap. Performance TTFB, blocking scripts, layout shift, third-party fan-out. Accessibility Alt text, labels, zoom, heading order: WCAG smoke test. Link health Dead links, stale redirects, insecure targets, probed live. AI readiness Does your site say whether AI crawlers may read it? PWA & installability Manifest, icons, display mode: can it be installed as an app? Fix & automate 17 tools Fix pack A config for your server containing only the fixes you need. Reference configs The full A-grade setup for six stacks, copy-ready. CI gate curl with fail under=B blocks deploys that regress. Badges & snapshots Live grade badges for READMEs; 90-day frozen report links. Redirect tracer Follow a URL hop by hop: loops, downgrades, wasted hops. Exposed files Is your .git, .env, a DB dump or phpinfo reachable? Content-verified, no false alarms. security.txt Check or generate your RFC 9116 vulnerability-disclosure policy, expiry and all. robots.txt Valid, or secretly an HTML page, or one stray Disallow: / from deindexing you? Read as a document. Sitemap audit Is your sitemap.xml valid XML, within Google's 50k-URL cap, and full of absolute HTTPS URLs, or secretly an HTML 404? Social preview See how a link unfurls on X, Facebook, Slack, before you post. SERP preview See your title and description as a Google result — with the real pixel width that decides whether your title survives or gets cut with an ellipsis. Schema generator Generate paste-ready JSON-LD for review stars, FAQ, breadcrumbs, or paste your own and check it wins the rich result, against Google's rules. CSP builder Build a hardened Content-Security-Policy from what your site loads Analytics, Fonts, Stripe, YouTube , starting from default-src 'self'. The author-side mirror of the CSP layer. Email records Generate correct SPF & DMARC records from who sends your mail Google, Microsoft 365, SendGrid, SES , or lock down a domain that sends none. The author-side mirror of the email layer. robots.txt builder Generate a valid robots.txt: keep admin & cart paths private, declare your sitemap, and opt out of AI training while staying citable in ChatGPT & Perplexity answers. The author-side mirror of the robots.txt and AI layers. SRI hashes Generate Subresource Integrity hashes for the CDN scripts and styles you embed, so the browser refuses a file a hijacked CDN has swapped — plus the CORS check that stops SRI silently breaking the load. Pro waitlist Alerts on regressions, private slots, higher limits. What the header scan checks 15 checks HTTPS enforcement HTTP → HTTPS redirect · Strict-Transport-Security · Content-Security-Policy · X-Content-Type-Options · clickjacking protection X-Frame-Options / frame-ancestors · Referrer-Policy · Permissions-Policy · Cross-Origin-Opener-Policy · cookie security Secure / HttpOnly / SameSite · CORS Access-Control-Allow-Origin reflection & credentials · mixed content http:// scripts, styles, frames & images on HTTPS pages · Subresource Integrity on third-party scripts/styles · cache-control sanity · security.txt RFC 9116 · information disclosure Server / X-Powered-By . Each rolls up to a letter grade with the exact fix to apply.