What's actually wrong with your website?
Most scanners only check what your server says it does. We probe your live site — security headers, TLS, cookies, accessibility, SEO, broken links, page weight — and tell you what is actually wrong. One 0-100 score. Plain-English fixes. The real-browser pass (JavaScript errors, broken hydration, CSP violations) is rolling out: when it can't run, the report says so instead of pretending.
Free preview — top 3 issues plus your Health Score. No signup, no install.
We don't just check what your server claims. Live probes run against your site on every scan; the real-Chromium checks below are marked while that pass is still rolling out.
Live JavaScript errorsbrowser pass · rolling out
Why it matters: Your visitors see a half-loaded page. Search and forms silently break. Static probes can't see this — only a real browser can.
What we check: Uncaught page errors, unhandled promise rejections, console.error spam during initial load.
Hydration mismatchesbrowser pass · rolling out
Why it matters: React/Next.js/Vue/Nuxt sites can render server HTML that doesn't match the client tree. Users see flicker or a blank UI for seconds before interactivity arrives.
What we check: Console output captured by a real Chromium for hydration / SSR-mismatch / minified React error markers.
Broken or blocked network resourcesbrowser pass · rolling out
Why it matters: A 404 on a critical script kills features silently. A blocked CDN call breaks search or checkout. Real users feel it; uptime monitors don't.
What we check: Every script, image, font, stylesheet, and fetch() call that fires during page load — fail status or DNS / refused / timeout reasons.
Content Security Policy violationsbrowser pass · rolling out
Why it matters: A live browser blocked your own scripts or third-party assets. Either your CSP is too strict for your own code, or an analytics provider is breaking.
What we check: Every CSP report-uri-style violation reported during the page session.
Mixed content (HTTPS+HTTP)
Why it matters: Modern browsers refuse to load HTTP assets from an HTTPS page. Images vanish, scripts fail, the lock icon disappears.
What we check: Every HTTP asset URL embedded in your HTTPS page.
Security headers missing
Why it matters: Modern browsers stop XSS, clickjacking, and cookie theft — but only if your site asks them to. Most don't.
What we check: CSP, X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
HTTPS / TLS misconfiguration
Why it matters: Wrong cert, expired cert, weak protocol — browsers show a warning page and visitors bounce immediately.
What we check: Cert chain validity, modern TLS support, mixed-content surface, HSTS preload eligibility.
Cookie hardening missing
Why it matters: Session cookies without Secure / HttpOnly / SameSite are a session-takeover vector for any XSS or CSRF that lands.
What we check: Every Set-Cookie header captured during the scan — flagged for missing protections.
Cluster-first, noise-last
A typical site scan returns 800-1000 raw findings — mostly the same root cause repeated across pages. We collapse them into ~20 root-cause clusters ranked highest-signal first, score the site 0-100, and tell you the three things that move the needle most. The other 977 findings are the same fix repeated — you shouldn't pay (in attention or money) for noise.
Ready when you are.
Scan my siteSame engine as the developer GateTest CLI — this scan runs its 20-module live-site suite (header, TLS, cookie, accessibility, SEO and link probes; the headless-browser runtime pass is rolling out) out of the 122-module engine. WordPress owner? WordPress-specific scan here.