Security
HTTPS, headers, leaked keys, and publicly readable databases.
Free score · $9 for the fixes
Find what is quietly hurting your website.
Paste a URL. In about a minute you get a 0–100 score for security, speed, SEO, local and AI search, and conversion. Every problem is listed. The steps to fix it stay locked until you pay $9 once.
- Read-only. No login, no plugin, no changes to the site.
- Written for owners on WordPress, Wix, and Squarespace, and for apps built in Lovable, Cursor, or Bolt.
- We never store database rows. We only check whether a stranger could read them.
60 seconds
A homepage, its scripts, headers, and a short list of links. Not a week-long audit.
Five scores
Security, speed, SEO, local and AI search, conversion. Weighted for the kind of site we detect.
Fixes you can use
Admin clicks for the website builder you have, or a prompt if an AI editor is doing the work.
What the score is made of
Speed
Mobile and desktop performance, LCP, CLS, and INP.
SEO
Titles, indexability, links, and on-page basics.
Local & AI search
Maps, schema, and whether answer engines can read the site.
Conversion
Calls, forms, proof, and the paths that turn a visit into a lead.
A report, before you scan
61Needs work
Sample report · not a live scan
Northline Roofing
A made-up contractor site at 61/100 · Needs work. Security is fine. The lost points are the phone, a leftover noindex, local markup, and a heavy photo. The fixes below are locked on purpose.
- high
No tap-to-call link
The phone number is an image in the header. A homeowner on a cell network cannot dial it.
- high
Homepage set to noindex
A staging plugin left noindex on after launch. Google is being told to skip the site.
- medium
No LocalBusiness schema
The footer has an address, but nothing in the page tells Google it is the same business as the map listing.
- medium
Hero image is 4.8 MB
The first screen waits on a single uncompressed photo of a roof.
Fixes locked. On a real report, $9 unlocks the WordPress, Wix, and Squarespace steps for each item, plus a prompt you can paste into Lovable, Cursor, or Bolt. This sample does not include them.
How it works
1. Confirm and paste
URL, email, and a checkbox that you own the site or may test it. We refuse private networks and non-web ports.
2. Read the free list
Each problem has a severity and a sentence about why it matters. Nothing on your server is edited.
3. Unlock the repairs
Stripe Checkout for $9. The same link then shows the steps and the prompt. Follow-up emails stop once you pay.
Pricing
The only thing for sale today is the $9 report. The other two prices are plans, not products.
Every scan
Free scan
$0
- 0–100 score in five categories
- Every issue title and severity
- Shareable score link
- No login
One time, per scan
Full report
$9
- Plain-English steps for WordPress, Wix, and Squarespace
- A copy-paste prompt for Lovable, Cursor, or Bolt
- Unlocks on the same report link
- Not a subscription
Checkout appears on a finished scan. If Stripe is not connected, the report says so and stays locked.
Coming soon
Done for you
$49
- We apply the fixes on a site you own
- One pass, not a retainer
- Monitoring is a separate $19/month, also coming soon
Not for sale. No checkout, no charge.
Monitoring at $19 a month would re-scan on a schedule and email you if the score drops. It is not running, and it will not bill you.
Built for a platform or a trade
The checks are the same. The page explains the failures that show up on that kind of site.
Questions
What is free, and what is the $9?+
The score and every issue title, severity, and plain explanation are free. $9 unlocks the repair for that scan: WordPress, Wix, and Squarespace steps, plus a prompt for Lovable, Cursor, or Bolt.
How long does a scan take?+
Usually under a minute. Google PageSpeed is the slow part. If it does not answer, Speed is marked not measured and left out of the total. The report says so.
Do you change my site or log in?+
No. The scan only fetches public pages, headers, a few scripts, DNS records, and well-known files. You have to confirm you own the site or are allowed to test it.
Do you download my database?+
No. If a Supabase anon key or Firebase URL is already public in the page, we check whether a stranger could read it. We keep a table name and a row count, or a simple open/closed result. We do not save rows.
Is $9 a subscription?+
No. It is one payment for one report. A new scan is a new report. The $49 done-for-you fix and the $19 monthly monitoring are listed as coming soon and cannot be bought.
Which platforms do the fixes cover?+
Steps are written for WordPress, Wix, and Squarespace. The same issue also has a prompt aimed at Lovable, Cursor, and Bolt. If a platform cannot set a header, the step says that instead of inventing a menu.
Can I share the score?+
Yes. The report URL is unlisted and not indexed. Anyone with the link sees the score and the issues. After you pay, they also see the fixes, so treat an unlocked link like a document.
Is this a penetration test?+
No. It is a passive checklist: HTTPS, headers, common leaked-key patterns, public files, speed, SEO, local and AI-search signals, and conversion basics. It will miss things a human tester would find.
Run it on the site you actually publish.
Not the staging URL, and not a screenshot. The score is only useful on the address customers open.