EngineeringScoreFree tools
A page for each of the check groups people search for: the exact signal we look for, what we do with it, and what one scan of one page cannot tell you.
- SecurityRead more
Free security headers checker
Check which security headers a single page sends, what each one does, and which of them are missing, in one scan, no signup.
Can't see Headers on pages other than the one you gave us: we read one page, not your whole site.
- SecurityRead more
Free security scanner
Run a full security scan of a single page: headers, HTTPS, cookies, and what your server headers give away, and see exactly what's missing, no signup.
Can't see Headers, cookies, or transport behaviour on pages other than the one you gave us: we read one page, not a crawl of your site.
- SecurityRead more
Free CSP checker
Check whether your Content-Security-Policy is enforced, report-only, or missing, and see exactly how many directives it defines, in one scan, no signup.
Can't see How strict your policy actually is: we report whether a Content-Security-Policy is enforced, report-only, or absent, not whether its directives, script-src, style-src, and the rest, would stop a real attack.
- SecurityRead more
Free SSL checker
Check whether your site is served over HTTPS, redirects from HTTP, sends a strong HSTS header, and loads without mixed content, in one scan, no signup.
Can't see Your TLS certificate's issuer, expiry date, or cipher suite: we check whether the connection is HTTPS at all, not the certificate details behind it.
- SecurityRead more
Free cookie checker
Check whether your cookies carry the Secure and HttpOnly attributes, and see which third parties are setting cookies through your site, in one scan, no signup.
Can't see Anything about your cookies at all, when we cannot resolve the scanned URL to a host. Secure, HttpOnly, and third-party then report as skipped rather than scored, because an empty first-party cookie list in that case means unknown, not clean, and a pass we never earned is worse than a gap we admit to.
- AccessibilityRead more
Free accessibility checker
Run axe-core's WCAG rules against your page, plus document language and image alt text, and see exactly which rules fired and why, in one scan, no signup.
Can't see Anything behind an interaction: keyboard traps, focus order, modal behaviour. We read one page in one state.
- PerformanceRead more
Free website speed test
Measure page weight, request count, image sizes, and load time against real thresholds, and see exactly which asset is slowing you down, in one scan, no signup.
Can't see Performance on a throttled connection: our load-time measurement is unthrottled, an ideal case, not a simulation of 3G or a slow laptop.
- ExposureRead more
Free exposed secrets checker
Find API keys, tokens and private keys shipped in your page's own JavaScript, and see exactly which files we could not read, no signup.
Can't see Any file your page did not already request. This check reads response bodies the browser had fetched anyway and issues no request of its own, so a .env, a .git/config, a stray database dump, or an admin bundle no visitor loads is never tested. Tools sold for this job routinely guess at those paths, and a clean result here is not evidence that guessing would come up empty.
- SEORead more
Free SEO audit
Check the on-page SEO fundamentals search engines actually read: title, meta description, headings, canonical tags, and indexability, in one scan, no signup.
Can't see Your actual search rankings, or how any of this affects them: we check on-page technical signals, not position in search results.
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.