Your password is sitting in the page
Anyone who looks can spend your money
85 checks · 6 areas · free, no account
Find out what your website is giving away.
85 checks across security, search, speed, trust and more — and unlike every other free tool, the fix for each one written out for you.
example.comReport
41/100
Not ready
Two things here need fixing before anyone visits.
Security34
Search (SEO)71
Speed63
Trust55
Accessibility78
Your payment password is visible to anyone
It is sitting in your website’s code, where any visitor can read it.
A settings file can be downloaded by anyone
It contains the keys to your database.
Your security certificate expires in 9 days
Visitors will see a red warning page when it does.
Google is told not to show 4 of your pages
Almost certainly a mistake left over from building the site.
7 pictures have no description
People using a screen reader cannot tell what they are.
85
Things we check
6
Areas scored
~60s
Time to your report
$0
To run one
What goes wrong
Four problems that do not look like problems
Your files can be downloaded
Your customer list walks out the door
Google has been told to skip you
You never show up when people search
Your page takes too long
Half your visitors leave before it loads
It is not hypothetical
This happens to people who ship fast.
Not our customer, and not about us — just somebody describing publicly what an exposed key actually costs.
guys, i’m under attack
ever since I started to share how I built my SaaS using Cursor
random thing are happening, maxed out usage on api keys, people bypassing the subscription, creating random shit on db
A maxed-out API key, a bypassed subscription and writes to the database are three separate findings in our security category — and all three are visible from outside the site, which is where we look.
- 1.5M API keysexposed in one AI-built app, from a single missing database ruleMoltbook breach ↗
- 170+ live appsexposed by CVE-2025-48757 — data pulled with fifteen lines of PythonCVE-2025-48757 ↗
- 11%of AI-built apps studied were leaking their database keysHacker News ↗
- 28.6M secretsnewly hardcoded into public repositories in a single yearGitGuardian ↗
- 380,000 appsAI-generated, live, and leaking data right nowXDA ↗
Every figure above links to where it was published. None of these are our customers.
Built with one of these?
We know what each one leaves behind.
Each of these tends to publish the same handful of things — a key meant for your server, a settings file, a page marked so Google skips it. Pick yours to see what we look for.
How it works
Paste. Wait a minute. Done.
Paste your address
yourwebsite.com
We read every page
about a minute
You get your score
and how to fix it
Before you paste your address
Yes, it is safe.
Every request is a GET. Nothing in the scanner can change your site, and we never log in.
What you get
Every problem, already solved.
Not errors to go and research. The exact steps, in the order that matters — written five ways, so whoever does the work gets it in their own language.
What we check
Six scores. One page.
All six, free.
Security34
Found on Google61
Speed42
Trust55
Accessibility78
Clear next step88
What makes this different
Others tell you. We fix it.
Every other free checker hands you a score and a problem list. This is the one that writes out the repair for every single finding — in plain English, and as a prompt you can paste straight into Cursor, Lovable or Bolt.
Six areas in one pass, where a speed test grades one and a key scanner checks one.
None of this is a speed problem:
- A database key readable in your page source
- A settings file anyone can download
- A certificate that expires next week
- Pages telling Google not to list them
- Headers that let someone else frame your site
- Software versions announced to scanners
Who this is for
You paid someone to build it
Check their work yourself.
You built it with AI
Fast is not the same as safe.
You are about to launch
One look before you tell anyone.
You build sites for clients
Hand over a report, not a promise.
Pricing
Start free. Pay only if it earns its keep.
Every plan audits all six areas. Cancel in one click.
Pay monthlyPay yearlysave 17%
Free
Scan any site and get every fix, written out. No card.
$0
Free forever. No card needed.
Start free- 10 checks a month
- Up to 25 pages looked at each time
- 1 website
- The full list of problems, with recommendations
Starter
More scans, deeper crawls, and PDFs you can send on.
$1/month
Choose Starter- 50 checks a month
- Up to 100 pages looked at each time
- 3 websites
- The full list of problems, with recommendations
Pro
Most popularFixes written for your stack, and we keep watching.
$5/month
Choose Pro- 200 checks a month
- Up to 300 pages looked at each time
- 15 websites
- A written fix for every problem found
Why you can believe this
Six claims. Six ways to check.
No seals from certification bodies who have never audited us. Every line links to where you can verify it yourself.
The deepest free audit on the web.
One audit, no account. Finding nothing is worth knowing too.