Documentation

Getting started

Create an account — no card is needed and the trial includes five audits. Enter a domain on the dashboard and press Run audit. A typical audit finishes in five to fifteen seconds, most of which is waiting on the target's DNS and TLS.

You can enter a bare domain (example.com), a full URL, or a specific page. Bare domains are treated as https:// and the audit follows redirects, so entering example.com when the site lives at https://www.example.com works as expected — the report shows the final URL it settled on.

Reading a report

The number in the dial is the weighted average across all six categories. The letter grade follows from it. Both are there to make movement visible over time; the findings are what actually matter.

Each category expands to show its findings. A pass tells you the control is present and configured sensibly. A warning means it is present but weak — an HSTS header with a short max-age, a CSP undermined by unsafe-inline. A failure means it is absent or broken.

Every non-passing finding carries the evidence we observed, so you can verify it yourself, and a Fix line naming the specific change. Where a check is ambiguous we prefer to say so rather than guess: the sitemap check, for example, reports as information rather than a failure, because plenty of sites have no need of one.

Severity and scoring

Severity is fixed per check, not inferred. Critical means the site is broken for visitors right now — an expired certificate, a chain that does not validate. High means a real exposure that an attacker could use. Medium is a meaningful weakness worth scheduling. Low is a hardening improvement.

A category starts at 100 and loses 40, 20, 10 or 4 points per critical, high, medium or low finding. Warnings cost half. Categories are then combined by weight: transport 30, headers 25, DNS 15, content 15, accessibility 10, delivery 5.

That weighting is a judgement, not a standard. It reflects that a broken certificate costs you every visitor immediately, while a missing loading attribute costs you a fraction of a second.

What the audit is not

It is not a penetration test. It sends ordinary GET requests and never probes for vulnerabilities. A clean report does not mean the application is secure.

It is not a WCAG conformance audit. The accessibility category checks what is visible in markup — missing alt attributes, an unlabelled field, a viewport that blocks zoom. Contrast, focus order, screen-reader behaviour and keyboard traps need a person.

It is not a field performance profile. The delivery category measures one document fetch from one location, which is why it carries the smallest weight. Use RUM data for anything load-bearing.

Quotas and errors

Each plan includes a monthly audit quota that resets at the start of the billing period. A failed audit — a domain that does not resolve, a host that refuses the connection — is reported as an error and does not consume quota.

There is also a short-term limit of six audits per minute per account, so one customer cannot saturate the workers. Hitting it returns an explicit message and costs nothing.

Sharing reports with clients

Open any stored audit and print it. Navigation, buttons and other interface furniture are excluded from the printed output, so the PDF your browser produces is presentable as-is. On the Agency plan, our branding is removed as well.