Know exactly how well your website is engineered.

EngineeringScore scans your site across security, performance, SEO, accessibility, and reliability, then scores it with a transparent, deterministic method and hands you a prioritized roadmap to fix what matters.

Built by the team behind

Delivered by We Do Dev Work, in Bangkok.

How it works

Three steps. No signup required to get started.

Scan your site

Drop in your URL. We automatically check technology, security, performance, and more.
Answer a few quick questions

A handful of questions about your team and stack help us tailor the results to you.
Get your score + roadmap

Receive your Engineering Score and a prioritized roadmap of what to fix first.

Scan my site

What we check

Your Engineering Score rolls up 7 categories that quietly shape whether your site is fast, safe, findable, and trustworthy.

Exposed secrets

API keys, tokens and private keys accidentally shipped in your site's JavaScript, where anyone viewing the page source can read them.

Security

Headers, cookies, and known vulnerabilities that put your users and data at risk.

Performance

Load times and Core Web Vitals that determine whether visitors stick around.

SEO

The fundamentals search engines need to find, index, and rank your pages.

Accessibility

Whether everyone, including people using assistive tech, can use your site.

Runtime Errors

Broken links, console errors, and failures that quietly cost you conversions.

Best Practices

Modern engineering standards that keep your site maintainable and reliable.

See every check

See a real report before you scan

EngineeringScore is built by We Do Dev Work, a Bangkok software agency that has shipped web, mobile, and AI products for over 14 years, for clients including True Digital, SCB, Ford, and Bluebik. The same engineers who fix these issues for a living built the checks behind your score.

View sample report

A real EngineeringScore report: score, category grades, and findings.

Meet the team

From the Learn library

Guides on why each check matters and how to fix it.

accessibility

Add a language attribute

Screen readers use the lang attribute on <html> to choose which pronunciation rules and voice to use. Without it, or with an incorrect value, a screen reader may read English content with a different language's pronunciation rules, making the page difficult or impossible to understand for blind and low-vision visitors.

best-practices

Declare a character encoding

Declaring <meta charset="utf-8"> tells the browser exactly how to interpret the bytes of the page before it starts parsing content. Without an early, correct charset declaration, browsers have to guess, and a wrong guess turns accented characters, quotation marks, or symbols into visibly garbled text (mojibake).

errors

Fix console errors

Console errors are the browser telling you something failed while the page was running: a broken API call, a missing dependency, a third-party script that did not load correctly. They are easy to ignore because the page usually still renders something, but they very often correspond to a feature that is silently not working for real users.

exposure

Rotate the exposed AWS access key

An AWS access key pair (an access key ID plus its paired secret) grants whatever IAM permissions are attached to it, from read-only access to a single bucket up to full account administration. A key pair that ends up in client-side JavaScript is exposed to anyone who loads the page, with whatever blast radius its permissions allow.

performance

Keep an eye on performance

Performance regressions rarely arrive as one dramatic change: they accumulate one added image, one new tracking pixel, one un-lazy-loaded video at a time, until a site that was fast a quarter ago quietly isn't anymore, with no single commit anyone would think to blame.

security

Keep up security hardening

A clean security scan is a snapshot, not a guarantee: headers, cookie flags, and TLS configuration are all things a later deploy, a new third-party script, or an infrastructure change can quietly weaken without anyone noticing, since none of them fail loudly the way a broken build does.

Browse all

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site