What we look for
Everything we look for.
more than a hundred specific problems, across nine departments, each scored on its own and all of them on every plan including the free check. Paying changes how much of your site we reach, how often we come back, and whether you are told how to fix what we found. It does not change what we look for.
A check that could not run is never shown as a pass. If we could not look at something, the report says so in those words, because an all clear you did not earn is the most expensive thing a scanner can hand you.
Can a stranger get in?
This is the one that can end a business overnight.
- A table in your database that anybody can read without signing in
- A secret key sitting in the code your site hands to every visitor
- The file of settings, or a copy of your database, left where anyone can download it
- File storage that strangers can read, and storage they can upload into
- Payment confirmations your app accepts without checking they are real
- Somewhere a visitor’s typing reaches further into your app than it should
- Outside code you build on that has a known hole in it, already fixed elsewhere
- An address that anybody can use to send email that looks like it came from you
- A sign-in that accepts a password already known to thieves, or an email nobody checked
- A site served without the lock, or a secure page quietly loading something unsecured
- Another website being able to read what your app returns
- The settings that stop somebody else’s site from framing yours or reading your pages
Once you prove the site is yours
- Whether one signed in customer can reach another customer’s records
- Whether an admin screen opens for an ordinary user
- Whether your app trusts whoever is asking to say who they are
Can somebody run up my bill?
People have woken up to bills in the thousands, and found out from the invoice.
- A part of your app that costs you money every time it runs, and runs for anybody who asks
- Nothing stopping the same person doing that ten thousand times in a night
- A limit that exists but can be stepped around by asking slightly differently
- Text messages, email and AI answers being sent on your account with no ceiling
Once you prove the site is yours
- What your scheduled jobs are quietly costing you while you sleep
Is my site still up?
You usually find out from a customer, which is the most expensive way to find out.
- Your site not answering at all, or answering with an error
- Your site answering sometimes, which is worse because nobody reports it
- The lock on your address expired, untrusted, or about to run out
- Your web address itself about to expire, which takes the site off the internet
- A site that falls asleep and makes the first visitor of the day wait
Once you prove the site is yours
- Whether the pages behind sign-in still work, which is where the money is
- A scheduled job that has been failing for weeks, or running far more often than it should
If something breaks, is my data gone?
One bad change wipes it for good, and you find out when you need it back.
Once you prove the site is yours
- Whether you have backups at all, which most apps built quickly do not
- Whether the last backup is recent enough to be worth having
- A table that lets the same thing be saved twice, which quietly corrupts your numbers
- A lookup that gets slower every week until the day it stops
- A table broadcasting every change live to anybody listening
Am I losing people because it is slow?
Every extra second costs you visitors, and Google pushes a slow site down.
- How long a real person on a real phone waits before your page is usable
- Pictures shipped far larger than they are shown, paid for by your visitor
- A page that jumps around while it loads, so people tap the wrong thing
- A site that does not fit the phone it is being read on
Can everyone use it?
Some people simply cannot use your site, and it is increasingly the law.
- Text too faint against its background to read
- Boxes in a form with nothing telling anybody what to type in them
- Pictures with no description, so a blind visitor is told nothing
- Buttons and links with no words in them, which read as "button" and nothing else
- A page that never says what language it is in
Is it built properly?
The quiet problems your customers meet before you do.
- Errors happening in the background that a visitor never reports
- Parts built on something browsers have already announced they are dropping
- Pictures squashed or stretched out of shape
- Asking for somebody’s location or notifications before they have any reason to say yes
- A sign-up box that will not let anybody paste their password in
Can anyone find me?
You lose free customers to competitors who do appear.
- A leftover setting telling search engines to skip your site entirely
- No map of your pages, so most of them are never looked at
- Pages with no title, or the same title as every other page
- No description, so Google writes its own and it is usually worse
- Links on your site that go nowhere, which make a site look abandoned
- A page with no headline, so nothing says what it is about
- Nothing to show when somebody shares your link in a message or a post
- Titles and descriptions too long to be shown in full
Do AI assistants know I exist?
More people ask an assistant than search. If it cannot read you, it recommends somebody else.
- Your site telling AI assistants to stay out, usually without anybody choosing that
- A page whose words only appear after the browser does work an assistant will not do
- Nothing on your site that says, in one place, what you do and who you are for
What the number is worth, and what it is not
A bigger count is the easiest thing in this industry to manufacture. Split one check into four and the number goes up while the app gets no safer, so treat ours, and everybody else's, as a floor rather than a score. What we will say about it is this: every one of those problems has a finding written by a person in advance, in plain English, with what it costs you and what to do about it. None of them is a rule that fires and leaves you to work out what it meant.
The question worth asking of any scanner, including this one, is not how many things it looks for. It is whether you recognised your own worry somewhere above, and whether what comes back is written so you can act on it without hiring anybody.