About SiteAudit.dev

Made by Koen Schipper

SiteAudit.dev is made by Koen Schipper, an independent Laravel developer. It is part of the same collection as HeaderScan, RedirectPath, CheckSSL and SiteAudit: focused tools for understanding a public website’s technical behavior.

The aim is to connect an observed result with a useful next step. Findings include evidence, explanations and links to practical guides so you can decide whether a change fits your website.

About Koen Schipper and his work ↗ (opens in a new tab)

How a scan works

1. Follow the submitted URL’s HTTP redirects and capture the final response within the shared scan budget.
2. Reuse that response for header and HTML metadata checks, then check the relevant host’s TLS connection, origin files and selected DNS records.
3. Combine measured findings into a report, mark unavailable evidence separately and show suggested next actions.

Explore a fixed example using the same report layout

What is checked

• Examines the HTTP redirect path and final response headers, including selected security, cookie and caching settings.
• Checks the final HTTPS host’s certificate connection and validity, or labels the last known host when a chain is incomplete. This module does not run CheckSSL’s extended protocol probes, CAA lookups or CRL checks.
• Reads the first matching title, description, canonical, robots meta, language and viewport fields, plus eight supported Open Graph and Twitter Card fields.
• Fetches /robots.txt and /sitemap.xml from the final origin, lists discovered sitemap references and checks basic sitemap XML structure.
• Checks A, AAAA, CNAME, MX, SPF and CAA record presence for the exact host, plus DMARC at its _dmarc name. It reports counts and selected presence warnings.

Limits of the result

• Uses a shared 30-second budget and follows at most ten redirects. SEO analysis needs a complete supported UTF-8 HTML response within 1 MiB; timeout, format or size limits can leave modules unknown.
• Checks one page and supporting host information. It does not discover the whole site, execute JavaScript, use browser cookies or replay a logged-in session.
• Does not visit canonical or social-image targets, establish unique metadata across pages, or confirm search indexing, Google’s selected canonical or rankings.
• Does not fully evaluate robots rules, follow listed sitemap files or verify every sitemap URL. Origin-file requests follow at most three same-host redirects.
• DNS checks do not evaluate full SPF or DMARC policy, determine the organizational domain, test mail delivery or check DKIM selectors. Record presence alone does not prove correct configuration.

A result describes one measurement from this scanner. It is not a security certification, a complete website audit or a promise of search visibility. “Unknown” means the check could not establish a result; it is different from a confirmed failure.

Understanding scores

Module weights are headers 25%, redirects 15%, TLS 20%, SEO 20%, robots and sitemap 10%, and DNS 10%. Unscored modules are excluded and the measured weights are redistributed. A total appears only when at least 70% of the original module weight was measured.

Measured weight describes the score calculation, not how much of your website was checked. Unknown does not mean failed. Within SEO, robots instructions and optional social metadata are not weighted, so a high total can coexist with an indexing issue.

Use individual findings to choose changes appropriate to the page. Security, mail and SEO checks serve different purposes; the aggregate is not a search-ranking score or a guarantee that the site is secure.

Read the finding and its evidence before changing a setting. Verify the deployed change with a new scan and a relevant independent check; a higher score alone does not establish that a website meets its requirements.

Report data & sharing

No account is required. Scan reports are public: anyone who knows the result URL can open them. The URL is based on the hostname and tool and shows the latest available scan for that host. A later scan, including a different path on the same host, can change the displayed report.

Reports expire after seven days and are eligible for daily cleanup. Live report pages ask search engines not to index them; this is not access control. The fixed example reports are separate public pages with fictional data and do not expire.

Stored reports contain selected findings and redacted evidence, not the full HTML, robots.txt or sitemap bodies. Query values in submitted and captured HTTP URLs and sensitive or unrecognized response-header values are masked. Hostnames, URL paths, query parameter names, connected IPs, selected metadata and public certificate details may remain visible. Do not submit confidential URLs or treat redaction as a guarantee that every secret will be recognized.

The scan runs from the server against the public target. It does not receive your browser’s signed-in session. Requests can appear in the target server’s logs.

Guides & corrections

The guides use AI-assisted research and drafting, with practical examples, verification steps and links to primary documentation. Scanner-specific explanations describe the implemented checks and their limits. Example values and configuration snippets need to be adapted to your own application.

If a result or explanation seems wrong, include the tool, the relevant finding and the expected behavior when reporting it. Remove credentials and confidential information from any example you send. A report URL can change or expire, so include the relevant observation as well.

Contact Koen Schipper about a correction ↗ (opens in a new tab)

How the tools are funded

Reports and guides may include a clearly labeled Cloudways affiliate link. If you follow that link and become a paying customer, we may earn a commission that helps support these tools.

Using the scanners and guides does not require a hosting purchase. Affiliate placements do not change the checks, scores or technical advice. Compare a provider’s features with your requirements; choosing a host does not by itself resolve a finding.