How we test your website

Every result comes from a real browser loading your public pages, plus read-only lookups of your domain’s public records. This page lists exactly what runs, what it touches and what it never does.

How it works

Get your reports in three steps.

  1. 1

    Scan your website

    Enter your website’s address and run a free scan. We detect the type of site and test five key pages in a real browser in about a minute.

  2. 2

    See the real issues

    Results for every area, with screenshots of the failing elements and plain-language explanations.

  3. 3

    Get your fix reports

    Choose the reports you need. Each arrives in 5–15 minutes with code, platform steps, AI prompts and a PDF.

The free scan

About a minute, on five pages that represent your website.

  • We detect the type of site (store, SaaS, company site, blog, school, clinic, hotel, landing page) and its technology from evidence on the home page: structured data, generator tags, scripts and the words on links and buttons. Each label comes with its evidence and a confidence level; if the evidence is unclear, the site is treated as a general website and still gets every universal check.
  • We pick the home page and up to four key pages from your navigation: on a store, a collection, a product, the cart and a content page; elsewhere, pages such as pricing, contact, an article, services or rooms.
  • Each page is loaded in Chromium at 1366 × 900 and tested with axe-core against WCAG 2.2 A and AA rules.
  • From the same page loads we read SEO tags, loading timings (LCP, layout shift, long tasks), calls to action and buying-path signals, response headers, cookies and scripts.
  • We press Tab through the home page to see whether keyboard focus moves and whether it gets stuck.
  • We look up your certificate, the HTTP-to-HTTPS redirect, robots.txt, the XML sitemap, security.txt and your domain’s SPF, DKIM and DMARC records.

The fix reports

Each report runs its own tests after you order it, one report at a time.

  • Deep scan: up to 20 more pages from your sitemap for the accessibility, EAA and SEO reports.
  • Keyboard journey: a separate browser session uses only the keyboard. On a store it goes from the home page to the checkout button; on other sites, from the home page to the key page, its main call to action and its form fields. Steps that don’t apply are marked not applicable, not failed.
  • Reflow: the home page and a key page at 320 px wide to find sideways scrolling.
  • Phone speed test: a 412 × 823 phone on slow 4G (150 ms latency, 1.6 Mbps) with a 4× slower CPU.
  • Field data: Google’s Chrome UX Report for your origin, when it has enough traffic.
  • Links: up to 60 internal links requested to find broken ones.

What we never do

The scan behaves like one careful visitor.

  • We never submit forms, sign up, make bookings, enter checkout, create an order or type personal or payment details. In the keyboard journey on other sites, only page requests (GET) are allowed to leave the browser.
  • We never attack your site, try passwords, probe hidden paths or run vulnerability exploits.
  • We don’t get around CAPTCHAs, bot protection or logins. If a page is blocked, we report it as not tested.
  • Our browser identifies itself as FixReportsScanner in its user agent.

Evidence we keep

So you can show what was tested and when.

  • The time each page was tested and its HTTP status.
  • A SHA-256 hash of the raw test results for each page.
  • Screenshots of each page and of failing elements, outlined.
  • How long we keep it is in the privacy policy.

Standards and sources

WCAG 2.2W3CAccessibility success criteria, levels A and AA
axe-coreDeque Systems, open sourceAutomated accessibility rules
EN 301 549ETSI, CEN and CENELECEuropean accessibility standard behind the EAA
Core Web VitalsGoogle (web.dev)LCP, INP and CLS thresholds
Chrome UX ReportGoogleReal-user speed data
RFC 7208, RFC 6376, RFC 9989IETFSPF, DKIM and DMARC
RFC 9116IETFsecurity.txt
schema.orgschema.orgOrganization, Article and Product structured data

Limits we tell you about

  • Automated accessibility tests find part of the problems on a site. Reports list what needs a human check.
  • Lab speed results vary between runs; real-user data is shown when Google has it.
  • DKIM keys live under selectors that can’t be listed, so we check the ones common services use.
  • On Shopify, response headers and some cookies are set by the platform; we show them for reference.
  • Website type and technology are detected from public evidence and can be wrong; reports show the evidence and confidence behind each label.
  • Pages behind a login, a password, a CAPTCHA or bot protection can’t be tested.

Scan your website today

Find it. Fix it. Verify it.

What kind of website is this?

Your answer picks the right checks, like the shopping journey for online stores. We still check the site's own evidence and show both.

What kind of website is this?

Free scan. No credit card required.