Free scan · no account
Free website scan: site health, security checks and search.
Paste your web address. In a few seconds you get one result with three parts: if your site is healthy, what the security checks find, and what search engines see. No account needed.
What we check
One scan, one result, three parts.
Site health
- Whether your home page opens, how fast it answers and what it sends back.
- Whether the page opens over https, when your domain runs out, and whether your domain has the email records that help your sign-up and password emails reach inboxes instead of spam. (Technical names: SPF, DKIM and DMARC records.)
Security checks
- Secret keys (the passwords your app uses to talk to other services) that can be seen in your page or its code files, such as Supabase, Stripe, OpenAI and Anthropic keys. We only show part of each key.
- Whether private files such as /.env or /.git can be opened by anyone.
- Missing browser settings: short instructions your site sends to browsers, such as always using https or limiting where scripts load from (6 checks). The technical name is security headers.
Search
- What search engines see: page title and description, headings, the picture shown when people share your link, your list of pages for search engines, broken links, image descriptions, and whether text shows before the page’s code runs.
On paid plans, Security watch also looks for about 25 well-known files that should not be public, new outside scripts and unexpected redirects, and we look up Google’s Web Risk list once a day. These are not part of the free scan.
Want to know when people can’t sign up, log in or pay? Start free with 1 site or read what Heedza does.
On Pro and Business, some alerts also have a Fix it for me button: press it and Heedza opens the fix on GitHub for you to approve. How Fix it for me works
Example of a free scan. A progress bar fills while eight items are checked one after another: the home page, secret keys, security headers, four private file addresses and Search.
Questions
Does the check change anything on my live site?
No. It asks for the same things a browser does: your home page, up to 6 of your own code files and 4 private file addresses. It never fills in forms, guesses passwords or sends attack traffic.
Who can see the results?
Each check gets its own link that you can share. We ask Google and other search engines not to list these pages.
Does the free scan look at my sign-up, log-in and payment pages?
No. The free scan looks at your home page only. To keep checking that your sign-up, log-in and payment pages work, make a Heedza account. The Free plan covers 1 site.