What we check

What we find most often

The checks

Leaked secrets

A password or key that unlocks one of your accounts, sitting in your code or its history where anyone with a copy can read it. We treat every one as already stolen.

Risky code

Patterns in your own code that give an attacker a way in, usually by letting them slip their own instructions into something your app trusts.

Vulnerable dependencies

Your project is built on other people's code, and some of it has publicly known flaws. Attackers scan for exactly these, because the weakness is already written up.

Missing security headers

Standard settings that tell browsers how to protect your visitors. Without them, browsers fall back to their most permissive behaviour.

Legal pages

Pages you are required to publish in the UK and EU, like a privacy policy and a sub-processor disclosure. The gap usually surfaces in a customer's security review or a regulator's complaint.

The checks

Screen readers and keyboards

Parts of a site that people relying on a screen reader or a keyboard cannot use. That locks out real customers, and in many places it is also a legal requirement.

The checks

Search basics

The tags that tell Google and social platforms what each page is. When they're missing or wrong, pages rank lower and look broken when shared.

How search engines find your pages

Whether search engines can find and index your pages. A page that never gets crawled can never rank, however good it is.

Page content

Pages with too little on them for search engines to treat as worth showing. Search engines increasingly drop thin pages from results altogether.

Trust signals

Whether a real, accountable business is clearly behind the site: a contact page, a privacy policy, named authors. It matters most if you sell anything or write about money, health or safety.

Internal links

Whether your pages link to each other, so visitors and search engines can move between them instead of hitting dead ends.

AI agent readiness

How easily AI assistants like ChatGPT and Claude can read your site. These are recommendations only and never affect your score.

The checks

Speed

Pages that are slower to load than they need to be. Visitors leave slow pages, and Google factors loading speed into where you rank.

The checks

Project setup

Groundwork most projects have, like keeping .env files out of git, error monitoring and a pinned Node version. None of it is urgent on its own, but each one is a safety net you will want later.

Copy-pasted code

The same logic copied into more than one place. Fix a bug in one copy and the others keep it, which is how problems you thought were fixed come back.

Unused packages

Packages your project installs but never uses. Each one is extra code shipped with your app, and one more thing that can carry a security flaw.

Unused code

Files nothing in your project uses. They're a common leftover from AI coding tools, and they make every change riskier because it is not obvious what is safe to touch.