What the free website audit checks
The same first-pass checks a senior web auditor runs by hand — combined into one report, with the evidence we saw and the exact fix.
Redirect checker
- http:// → https:// uses a permanent 301/308, not a temporary 302/307
- www and non-www both resolve and converge on one canonical host
- Redirect chains are one hop, not three
Security headers checker
- HTTPS reachable with a valid certificate; HSTS with includeSubDomains
- Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options
- Referrer-Policy and Permissions-Policy
- Whether your CSP silently blocks your own analytics (GA4, GTM, Cloudflare, Plausible…)
Performance
- gzip / brotli compression on HTML
- Long-term caching on fingerprinted JS and CSS
- HTML weight and oversized first-party scripts
SEO checker
- Title and meta description length, a single H1, canonical, lang, viewport
- noindex in robots meta or X-Robots-Tag
- Open Graph and Twitter cards, including square share images
- JSON-LD types, and Offer prices that don’t appear on the page
- Images missing alt text or width/height
Crawlability
- robots.txt with a Sitemap directive
- sitemap.xml, with up to 10 listed URLs checked for errors
- /favicon.ico and real 404s (no soft 404s or JSON error pages)
Trust
- Privacy policy and terms of service linked from the page
Frequently asked questions
Is this website audit tool really free?
Yes. There is no signup, no email gate and no paid tier for the audit itself. To keep it available for everyone, each visitor can run up to 10 audits every 10 minutes.
What does the free website audit check?
It checks the same things a senior web auditor looks at first: HTTP-to-HTTPS redirects and whether they are permanent (301/308) or temporary (302/307), whether www and non-www converge on one host, redirect chain length, HTTPS reachability and HSTS, security headers (Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), whether your CSP blocks your own analytics, gzip/brotli compression, caching of JS/CSS, HTML and script weight, on-page SEO (title, meta description, H1, canonical, lang, viewport, robots, Open Graph, Twitter card, JSON-LD), image alt text and dimensions, robots.txt, sitemap.xml, favicon.ico, real 404 handling, and privacy/terms links.
What does "your CSP blocks your own analytics" mean?
A Content-Security-Policy tells the browser which scripts and network requests are allowed. If the policy does not list your analytics vendor — for example www.googletagmanager.com in script-src and *.google-analytics.com in connect-src — the browser silently refuses to load the tag or send hits, and your analytics shows little or no traffic even though the tag is on the page. The audit parses your policy and flags exactly which directive blocks which vendor.
How is the score calculated?
Each finding has a severity — critical, high, medium or low — that subtracts from its category score (HTTPS & Redirects, Security Headers, Performance, SEO & Social, Crawlability, Trust). The overall 0–100 score is a weighted average of the category scores, and any critical finding caps the overall score at 59.
Do you store the URLs I audit?
Audit reports are not saved — the report is generated for your request and returned to your browser. Server logs record only the audited hostname and the resulting score. Your IP address is held in memory for up to 10 minutes solely to enforce the rate limit.
Is this a penetration test or a vulnerability scan?
No. The audit is passive: it makes ordinary requests (about 30 at most) and inspects responses, headers and HTML, the same way a browser or search engine would. It does not probe for vulnerabilities such as SQL injection or XSS. For that, use a DAST scanner such as the one in NexGen QA’s security testing module, which covers the OWASP Top 10.
How does the tool identify itself, and can it reach internal sites?
Requests are sent with the User-Agent "NexGenQA-SiteAudit/1.0 (+https://qa-automation.com/tools/website-audit)". Only public http/https websites on ports 80 and 443 can be audited; private, loopback, link-local and cloud metadata addresses are refused, including after redirects.