Scan Options
Functional Scan Checks
64 checks (accessibility, forms, navigation, SEO, broken links) : about 100 seconds per round of up to 2 devices, 200 seconds with login credentials
The base scan: 64 checks across accessibility, forms, navigation, SEO and broken links, run on the devices you pick. This is what tells you what actually works and what doesn't on your site. It's the one check we recommend keeping on for every scan, and it's the reason the devices picker exists at all (the other 3 options don't need it directly, or only need it as a foundation).
Security (20)
- Missing or weak security headers
- Sensitive data exposed
- Cross-site scripting (XSS) vulnerability
- No brute-force protection on login
- Insecure cookie settings
- Insecure form field (e.g. password sent unencrypted)
- Missing CSRF protection
- API token exposed
- Insecure API endpoint
- CORS misconfigured
- API responses cached publicly
- API authentication bypass
- Dangerous HTTP method allowed without auth
- API leaking internal error details
- Mixed content (HTTP resource on an HTTPS page)
- SSL certificate expiring soon
- Possible SQL injection
- Open redirect
- Unrestricted file upload
- Sensitive data stored in localStorage
SEO (15)
- Missing page title
- Missing meta description
- Missing H1 heading
- Multiple H1 headings on one page
- Missing Open Graph tags
- Missing viewport meta tag
- Missing lang attribute
- Missing robots.txt
- Missing sitemap
- Missing favicon
- Empty links
- Missing canonical tag
- Missing hreflang tags
- Poor-quality 404 page
- Soft 404 (page says "not found" but returns 200)
Forms & flows (11)
- Form submission error
- Broken user flow
- Payment button error
- Login failed
- Password reset broken
- Confirmation email not sent
- Broken search
- Duplicate form submission allowed
- Broken pagination
- Empty state error
- Form gives no feedback on submit
Performance (7)
- General performance issue
- Poor LCP (Largest Contentful Paint)
- Poor CLS (Cumulative Layout Shift)
- Slow FCP (First Contentful Paint)
- Unoptimised images
- JS bundle too large
- Missing lazy loading
Reliability (5)
- Broken link
- JavaScript error
- Navigation error
- Infinite loading state
- Page requires authentication (informational, not a bug)
Visual & layout (4)
- Layout breaks on a device
- Touch target too small
- Text hard to read
- Broken image
Accessibility (2)
- General accessibility issue
- Missing form label
Documentation last updated: 2026-09-04
