Help us keep the scan free?
We use cookies to see how the site is used and to measure our ads, so we can improve the checks and keep the free scan running.
Run it on staging or the day before go-live: Core Web Vitals from Google's own engine, the passive security baseline, and the UK compliance basics. One report, fixes in impact order, so sign-off is clean and the handover email writes itself.
Passive only. Nothing installed, nothing probed, nothing sent to your client by us.
Three checks. Each on its own, or all three as a bundle. Run before launch, at handover, or every quarter on a care plan.
Lighthouse via PageSpeed Insights on mobile and desktop: LCP, CLS, TBT, FCP, Speed Index and TTI against Google's thresholds.
Findings in impact order with the saving on each (oversized images, render-blocking requests, unused JavaScript, missing compression), and platform notes for WordPress, Shopify, Webflow, Wix and Squarespace.
Passive only: TLS and certificate, HTTPS redirect, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags, version leakage, robots and security.txt, SPF and DMARC.
Graded A to F with each finding explained and the fix named. Safe on production and on staging: it reads only what any browser receives.
Checked by hand: consent before tracking loads (PECR), a reachable privacy notice (UK GDPR), registered company details (Companies Act), a geographic address and email (E-Commerce Regulations), selling terms where orders are taken (Consumer Contracts Regulations), and the WCAG basics.
Written as what was found and not found. Not legal advice, and the report says so.
Run on staging once content is in. Catch the 4 MB hero, the missing HSTS and the pixel firing before consent while there is still time to fix them.
The report goes in the handover pack as the as-launched baseline. Scores, headers, compliance, dated.
Quarterly re-checks give the retainer something to show: what changed, what drifted, what was fixed.
Run it on the prospect's current site. The before picture does the talking.
Staging or live, one address per check, by email or the form below. It needs to be reachable without a login; a staging subdomain hidden from search engines is fine.
Performance and security take minutes. The compliance pass is done by hand and usually comes back within two working days.
A PDF with the findings in impact order and the fix for each, in our format or carrying your agency's branding for the handover pack.
Make the changes, send the URL back, and we re-run the automated checks so the launch goes out with the numbers to prove it.
An example for a made-up agency and a made-up client, in the agency's branding, so you can judge the writing and the layout first.
6 pages, A4, emailed to you as a PDF Example: Harbour & Pine Digital for Riverside Bakery. Neither exists.
Agencies and freelancers shipping client sites on WordPress, Shopify, Webflow, Wix or Squarespace, especially with care plans, where a dated check is part of what the client pays for. If go-live week usually ends with someone pasting a PageSpeed screenshot into Slack, this replaces that.
Tell us about the agency and how you would use it. Joe reads every one of these himself and replies within a working day.