Free Website Scan · No Signup Required
Let Us Scan Your Website
Paste your URL and get a full diagnostic in seconds. We check 60+ technical signals across SEO, AI search, security, email, performance and WordPress, then show you what to fix first.
- AI search readiness: AI crawler access, firewall test, snippet controls & llms.txt
- Schema.org validation against Google’s rich result rules
- Title, meta description, content, robots.txt, sitemap & SERP preview
- Security headers, CSP, HSTS, exposed files, malware, Safe Browsing & VirusTotal
- Email authentication (SPF, DMARC, DKIM), certificate renewal, TLS & post-quantum support
- Core Web Vitals from real visitors, Lighthouse scores & top fixes
- Industry checks for shops, clinics, brokers & more, including Malaysian PDPA and e-commerce rules
- Deep WordPress audit, CDN, WHOIS, domain expiry & China Firewall
FAQ
Website Scan FAQ
Common questions about our free website scanning tool.
Over 60 checks in six areas, each with its own score. SEO: title, description, headings, canonical, robots.txt, sitemap, hreflang and Schema.org markup validated against Google’s rich result rules. AI readiness: which AI search and training crawlers robots.txt allows, a live firewall test with AI crawler user agents, snippet controls that decide whether Google can cite you in AI Overviews, content that needs JavaScript, answer-ready page structure, llms.txt quality, Content Signals and WebMCP. Security: HTTPS, security headers, Content-Security-Policy and HSTS quality, exposed files such as .env, .git and backups, security.txt, cookies, mixed content, malware patterns, Safe Browsing, VirusTotal, certificate expiry and renewal, TLS versions and post-quantum key exchange. Email & DNS: SPF, DMARC, DKIM, CAA, MTA-STS and BIMI. Performance: response time, compression, caching, HTTP/2 and HTTP/3, image sizing, third-party scripts and PageSpeed Insights with real-visitor Core Web Vitals. Trust & access: privacy policy, terms, contact details, cookie consent, page language, form labels and link names. WordPress and Joomla sites also get a deep audit of versions, plugins, known CVEs and exposed endpoints.
AI readiness is how well ChatGPT, Claude, Perplexity, Google AI Overviews and Copilot can read and cite your site. We check that robots.txt lets their search crawlers in, test whether your firewall blocks them in practice, look for nosnippet settings that stop Google quoting you, measure how much text is visible without JavaScript (most AI crawlers do not run it), and score the page structure answer engines quote from. Blocking AI training crawlers such as GPTBot is a business choice and does not remove you from AI search. Google says no special AI file or markup is needed, so llms.txt counts for little in the score.
Since 2024 Gmail and Yahoo, and since May 2025 Outlook, reject or spam-folder mail from domains without SPF, DKIM and DMARC. Without DMARC at quarantine or reject, anyone can send email that looks like it comes from your domain, which is how invoice and payment scams work. The scan reads your public DNS records, so it works even if your website and email are hosted in different places.
It checks what customers and regulators expect from a site in your industry: seller details for online shops, risk warnings and licence numbers for brokers, opening hours and maps for local businesses, agent registration numbers for property sites, and accreditation for schools. For Malaysian sites it includes the PDPA requirement for a privacy notice in Bahasa Melayu and English and the seller disclosures in the Consumer Protection (Electronic Trade Transactions) Regulations 2024. It has its own score and does not change the overall score. It describes what the page shows and is not legal advice.
Yes. Under any report, choose Weekly monitoring and confirm by email: we rescan every week and email you only when the score or a check changes, with a one-click unsubscribe in every message. Choose Compare with a competitor to see two sites side by side, check by check. You can also copy a link to the report or save it as a PDF.
Yes, completely free with no signup required. Enter your URL, hit Scan Now, and get your results in seconds. No email, no credit card, no strings attached.
Most free scanners only check basic SEO or performance. Ours goes deeper, especially for WordPress sites. We probe actual endpoints like xmlrpc.php and wp-cron.php, check for exposed error logs and backup files, detect information leakage signals, and cross-reference your plugins and themes against the WPScan vulnerability database. We also check cookie security attributes, mixed content, and outdated JavaScript libraries that could expose your users to attacks.
The scan provides a reliable snapshot of your website’s fundamentals, checked against current Google, OWASP and email provider guidance. It looks at the page you enter, so inner pages (products, posts) can differ. Some checks have limits we state in the report: DKIM can only be found for common selector names, and the AI crawler firewall test runs from our server rather than the crawlers’ own addresses. For a deeper audit covering database queries and server-level issues, contact us for a full audit.
Aim for 80 or above. A score of 80–100 means your fundamentals are solid. Below 50 means there are critical issues hurting your SEO and user experience that should be fixed urgently.
For WordPress sites, we run a dedicated security audit on top of the standard checks. This includes: whether wp-login.php is exposed, if xmlrpc.php is accessible (a common attack vector for brute-force and DDoS amplification), whether wp-cron.php can be triggered publicly, if author enumeration is possible via ?author=1, whether sensitive files like readme.html, license.txt, debug.log, PHP error logs, and backup config files are publicly accessible, directory listing status on core WordPress folders, information leakage signals like generator meta tags and RSD/WLW manifest links, and known security vulnerabilities in your WordPress version, theme, and plugins via the WPScan database.
If the scan finds any of these, fix them immediately: exposed debug.log or error_log files (they can contain passwords and API keys), publicly accessible wp-config.php backups or .env files (contain database credentials), xmlrpc.php accessible (enables brute-force attacks at scale), and known CVEs in your plugins or theme. After that, address author enumeration, wp-cron.php exposure, and information leakage signals.
Absolutely. We specialise in WordPress optimisation, server hardening, and technical SEO. Most fixes can be completed within 48 hours. WhatsApp us with your scan results and we will give you a free quote.
It works for any publicly accessible website, whether WordPress, Shopify, Wix, custom-built, or any other platform. The URL must start with http:// or https:// and be reachable from our servers. The deep WordPress audit only runs when WordPress is detected.
No. The scan makes a small number of lightweight requests to your website, similar to normal visitors loading your page. For WordPress sites, additional HEAD requests are made to probe specific endpoints. These are read-only and cause no meaningful load.
We recommend scanning after every major update, such as plugin updates, theme changes, hosting migrations, or content overhauls. A monthly check is a good habit to catch newly disclosed CVEs, configuration drift, and any files that may have been accidentally exposed.
Recent Scans
Recently Scanned Websites
See the latest websites scanned by our tool. Try scanning yours!
84
www.mmoso.com
73
www.he.net
82
mlfood.my
87
widad.edu.my
96
www.redevice.com.my
88
getvoncms.com
78
www.pahang.gov.my
79
www.upnm.edu.my
85
thevocket.com
69
ktn.kptm.edu.my
85
sitecheck.sucuri.net
92
skripglobal.com
96
www.iprosp.com.my
79
google.com
80
lidavi.com
87
pandulaju.com.my
90
ohmedia.my
80
bangi.kptm.edu.my
98
destroy.tools
88
insidescoop.com.my