What we check
Seven areas, one report. Every check returns a status, evidence and a concrete recommendation.
Performance
Server response time, compression, caching, render-blocking scripts. With the browser audit also LCP, CLS, TBT, FCP and Speed Index (lab data from Lighthouse).
SEO
Title, meta description, headings, canonical, robots.txt, sitemap, indexability, duplicates, broken links, redirect chains, structured data and Open Graph. No ranking data.
Security
HTTPS, redirect, certificate and expiry, TLS versions, security headers, cookie attributes, mixed content, version disclosure, SPF, DMARC, DNSSEC, CAA. Passive checks only.
Technical
Availability, status codes, redirects, basic HTML structure, failing resources, detected technologies and – where reliably visible – outdated libraries.
Accessibility
Alt texts, form labels, language, headings, link names, keyboard order. With the browser audit also contrast and ARIA rules via axe-core. No WCAG certification.
Privacy & legal
Imprint and privacy policy findable, consent tool detectable, tracking and third-party services on first load. Hints instead of legal verdicts – not legal advice.
Best practices
Doctype, favicon, security.txt, deprecated elements, secure resources. With the browser audit also console errors and further Lighthouse checks.
More than a website audit
Additional tools around security and reconnaissance – some optional and tied to your authorization.
Active security test
Optional and non-destructive – only for domains you have verified you own: exposed files, sensitive paths, open directory listings and a reflected-XSS indicator. No attack payloads, no login attempts. Not a substitute for a manual penetration test.
OSINT / Recon
Public reconnaissance of a domain: DNS records, subdomains from certificate transparency, technology stack, publicly visible e-mail addresses and known data breaches. Public sources only, no verification required.
Breach check
Check whether your own e-mail address appears in known data breaches – only after confirmation via a link sent to exactly that address. Data source: Have I Been Pwned.