Website analyzer

What the analysis checks

The tool downloads the page's HTML once, without running JavaScript: it follows at most five redirects, waits up to 10 seconds and reads the first 2 MB. It then evaluates four areas:

• Security headers: HSTS, Content-Security-Policy, framing protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• Search metadata: title, description, H1 heading, canonical URL, Open Graph for sharing, robots directives (including the X-Robots-Tag header), viewport and page language.
• Structured data: whether the page contains JSON-LD that can be read (we do not validate the schema) and whether it identifies who runs the website. Article and BreadcrumbList are shown for information only, because they suit only some pages.
• Performance: Google PageSpeed Insights measures the page on a simulated phone (LCP, CLS, TBT, TTFB, Speed Index). When Google has enough data from real visitors, we also show their INP.

How to read the result

Each check is weighted by importance. The overall score is 30% security, 30% search metadata, 20% structured data and 20% performance. When the performance measurement is unavailable, only the first three count (40%, 35% and 25%). Warnings earn half the points, and items marked "Not found" do not affect the score.

If the website answers with an error status (for example 403 from a firewall), we tell you: the result then describes the error page, not your usual content.

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

How to add missing headers without an outage

1. 1

   Find where responses are built

   Headers can be set on the web server (nginx, Apache), in a CDN such as Cloudflare, or in the application. Set each one in a single place so they do not override each other.

2. 2

   Start with the safe headers

   X-Content-Type-Options, Referrer-Policy and Permissions-Policy rarely break a site. Start HSTS with a short duration such as max-age=86400, and extend it to a year once every subdomain works over HTTPS.

3. 3

   Monitor CSP before enforcing it

   Deploy Content-Security-Policy-Report-Only, review the reported violations and add the legitimate sources. Only then enforce the policy. Avoid 'unsafe-inline' for scripts, or CSP gives little protection against XSS.

4. 4

   Verify the result

   Run the analysis again and check the browser developer tools for blocked resources in the console.

What the analysis cannot tell you

• We check whether headers exist and are well formed, not whether they are strict enough. A CSP with 'unsafe-inline' passes even though it offers little protection against XSS.
• We evaluate one page. Other parts of the website can be configured differently.
• We do not run JavaScript, so a title, metadata or structured data that a script adds to the page will not be seen.
• We do not look for vulnerabilities in the application, outdated components or authentication flaws. A penetration test finds those.
• The metadata and structured data scores are our guide, not a prediction of search rankings. Google says visibility in AI answers needs no special markup; useful content and ordinary SEO matter.
• PageSpeed results vary by a few points between runs. Data from real visitors, when Google has it, is more reliable.
• To limit the load on other servers, we allow two analyses per day. We do not store results on the server; only your browser remembers the last score.

Common questions