Free Technical tool

Free Website Audit

One scan of the page you enter and up to four key pages, with results in seven areas: accessibility, EAA readiness, SEO, speed, conversion, security and email authentication. Start here to see where the biggest problems are before you decide what to fix.

Free. Tests up to five key pages in about a minute.

What this tool checks

  • Accessibility

    axe-core WCAG 2.2 Level A and AA rules on every tested page, plus a keyboard probe for focus traps, skip links and missing focus outlines.

  • EAA readiness

    Automated accessibility failures mapped to EN 301 549, the European standard used for the European Accessibility Act.

  • SEO

    Titles, descriptions, H1s, canonicals, noindex, robots.txt, the XML sitemap, viewport, language, Open Graph and structured data.

  • Speed

    Loading timings, layout shift, long tasks, page weight, heavy images and the third-party share, measured on the same page loads. The phone test on slow 4G is in the Website Speed Test.

  • Conversion

    Calls to action, contact routes, forms and trust content such as testimonials and policy links. On stores, also product and cart checks such as the price, the add to cart button and the checkout button.

  • Passive security

    The certificate, the HTTP-to-HTTPS redirect, security headers, cookie flags, mixed content, outdated jQuery and Lodash versions, security.txt and the DMARC policy that protects against spoofed email.

  • Email authentication

    SPF, DKIM on common selectors, DMARC, BIMI and MTA-STS, read from public DNS.

  • Website type and technology

    The kind of site (store, SaaS or app, company site, blog, publisher, education, government, healthcare, hotel or landing page) and its platform among 18 technologies, detected from public evidence with a confidence level. Both decide which pages and checks are used.

What it can’t check

  • Go deep in any single area. Each area shows its most important findings; the matching paid report runs more tests and gives the fix for every finding.
  • Test more than five pages, pages behind a login, or a checkout.
  • Act as a penetration test. Security checks only read what a visitor’s browser and public DNS show.
  • Find every DKIM key. Selectors can’t be listed, so only the ones common email services use are checked.
  • Answer legal questions, such as whether the ADA or the EAA applies to you or whether you comply.
  • Measure outcomes such as rankings, conversion rates, sales or inbox placement.

Why it matters

Website problems rarely stay in one area. An image carousel can be the accessibility failure, the heaviest file on the page and the reason the call to action sits below the first screen. A cookie banner can trap keyboard focus and shift the layout at the same time. Seeing every area from one scan shows where a single change fixes several things.

A broad check also finds what nobody owns. Email authentication records are set up once and forgotten; without an enforced DMARC policy, others can send mail that looks like it comes from your domain. Certificate expiry, missing security headers and an old jQuery bundled by a plugin are just as quiet until something breaks.

Because the scan detects what kind of site it is testing, the checks fit: a store gets product and cart checks, a SaaS site its pricing page, a blog its articles. The detection shows its evidence and confidence, so you can tell when it has guessed wrong.

How to read the results

Problem
A definite issue the checks confirmed, such as a failing WCAG rule, a page set to noindex or no DMARC record.
Check
Something a person should look at, because software can’t decide or it may be intended, such as an item axe-core couldn’t settle or a page that other sites can embed.
Opportunity
An improvement rather than an error, such as no Content Security Policy or a call to action below the first screen.
Passed
The check ran and found nothing wrong on the tested pages.
Info
Context rather than a verdict, for example security headers that Shopify sets for every store and you can’t change.
Website type and confidence
What the scan thinks your site is, with the evidence behind it. When the evidence is thin, the site is treated as a general website and still gets every check that suits any site.
Technology
The platform or framework detected, such as Shopify, WordPress, Webflow or Next.js. It decides which platform-specific fix steps you see.

How to fix the most common problems

  • No DMARC policy

    Publish a TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, to start receiving reports. Once the reports show that every service sending for you passes SPF or DKIM, move to p=quarantine and then p=reject.

  • HTTP doesn’t redirect to HTTPS

    Turn on the force HTTPS option in your host or CDN, or add a 301 redirect from http:// to https:// for every path. Once HTTPS works everywhere, add a Strict-Transport-Security header.

  • Missing security headers

    Start with X-Content-Type-Options: nosniff, a Referrer-Policy such as strict-origin-when-cross-origin, and frame-ancestors in a Content Security Policy (or X-Frame-Options) to stop other sites framing your pages. A full Content Security Policy needs testing, so begin with Content-Security-Policy-Report-Only.

  • Outdated jQuery or Lodash

    Update to a current version, or remove the library if nothing uses it. On WordPress, old copies usually come from a theme or plugin that bundles its own, so updating or replacing that plugin is the fix.

  • SPF with too many lookups

    SPF allows at most 10 DNS lookups. Remove include: entries for services you no longer use, avoid nested includes where you can, and make sure the domain publishes only one SPF record.

  • No clear call to action

    Put one primary action, such as “Book a demo”, “Get a quote” or “Shop new arrivals”, in the first screen of the home page as a real link or button with specific text, and repeat it after the key sections.

Questions about this tool

What does the free website audit include?

The page you enter and up to four key pages tested in a real browser, plus site-wide checks of robots.txt, the sitemap, the certificate, response headers and DNS records. Results come in seven areas, each with its most important findings.

How long does it take?

About a minute for most sites, since five pages are loaded and tested. If the same address was scanned in the last hour, those results may be reused.

Is the security check safe to run on a live site?

Yes. It only reads what a visitor’s browser and public DNS show: the certificate, headers, cookies, scripts and records. It never tries passwords, probes hidden paths or sends attack traffic.

How is the website type detected?

From public evidence on your pages: structured data, generator tags, scripts and the words on links and buttons. Each label has a confidence level and shows its evidence, so a wrong guess is easy to spot.

Why were fewer than five pages tested?

Key pages are picked from the links on the page you enter. On a small site, or when a page redirects to another site, returns an error or is blocked, fewer pages can be tested.

Which paid report should I start with?

The one for the area with the problems that matter most to you. Each area of the audit links to its report, which tests more pages or runs extra tests and gives the fix for every finding.

Sources

Related tools