Free — no signup

Site Audit

Enter a URL and get an instant graded report: HTTP/security health and technical search readiness as two honest 0–100 scores when the evidence is sufficient — otherwise the result stays unscored. It is never a ranking claim. Every finding is explained: what it is, why it matters, and how to fix it. Share the report, or any single finding, by link.

Bare hostnames default to HTTPS. Free report in seconds — every finding explained. No signup; 10 reports per network, then a B2B-only voucher adds 100 for 5 EUR.
Keyboard: browser access key Q focuses the URL; Enter runs the audit.

Live today — what every report includes

Every finding explained

Each finding expands into what it is, why it matters, and how to fix it — with the exact header or tag to add. A prioritised action plan, not a wall of warnings.

Share any finding by link

Every report gets an unguessable deeplink, and every section and finding its own anchor. Send a client or colleague the exact finding to fix — reports stay retrievable for 90 days. Ideal for agency and client reporting.

Gate your CI on it

One curl fails the deploy when the frozen compatibility score drops below your bar, with JUnit output your pipeline already understands. That established gate stays separate from nullable health model v1 and the independent SEO gate.

# Fail the deploy when the legacy compatibility score drops below 80.
curl --fail "https://api.lifub.com/audit.json?url=https://your-site.com&gate=80"

# Independent technical-SEO gate, as JUnit for your CI dashboard.
curl "https://api.lifub.com/audit.json?url=https://your-site.com&format=junit&seoGate=80" -o audit.xml

Bring your own scheduler: paid API gate at 100

A trusted CI runner or third-party scheduler can call the same one-page API with a paid voucher. gate=100 returns 200 at a perfect frozen compatibility score and 422 below perfection. The additive health model remains nullable and is not silently substituted into this compatibility gate. The 422 response still contains the full JSON report, so the caller can route that result through its own email or webhook channel. Other error statuses should be handled as quota, transport, or service failures, not as score regressions.

# Store the voucher as SITE_AUDIT_VOUCHER in your scheduler's secret store.
# One completed call uses one voucher report; 422 still writes the JSON body.
curl --fail-with-body \
  --header "X-Site-Audit-Voucher: $SITE_AUDIT_VOUCHER" \
  --output site-audit.json \
  "https://api.lifub.com/audit.json?url=https%3A%2F%2Fyour-site.com&gate=100"

For durable automation, inspect stable findingDetails[].id values and numeric scores rather than matching human-readable finding text, which can improve over time. This API integration supplies the report and status; notification delivery belongs to the caller's scheduler or alerting service.

Watch configuration preview

The browser app can keep a watch ID, run re-audits on demand, track a score trend, and combine an absolute floor on the frozen compatibility score with its existing relative-drop rule. A floor of 100 alerts below compatibility-score perfection and is sent to the watch API as minimumScore=100. This is deliberately separate from nullable health model v1. Scheduled execution depends on the deployment's watch scheduler; an optional webhook is best-effort, not durable delivery or direct email. Hosted watch scheduling is not part of the paid voucher offer.

Migration QA: comparable JSON snapshots

Save a completed one-page audit as a labelled baseline, make the change, and save a second run. Each snapshot keeps the same machine-readable JSON report shown in the app: the two scoped scores, coverage, findings, and the fixed page-plus-auxiliary probe set. Stored snapshots coexist instead of overwriting one another.

The snapshot is a report, not a traffic archive: it does not capture response bodies, request headers, HTTP protocol negotiation, latency, or every redirect hop. That bounded contract keeps comparisons stable and avoids storing cookies or other private response metadata.

Recorded per probe	What it is	Why it matters in a diff
Status and class	HTTP status plus `present`, `missing`, `error`, `soft-404`, or another bounded classification	Catches a probe that became missing, errored, or healthy
Final destination	The final URL when followed redirects change the requested URL	Surfaces a changed HTTP-to-HTTPS, host, or path destination
Curated response headers	Security, cache, CORS, edge, redirect, and SEO-relevant fields such as `HSTS`, `CSP`, `Cache-Control`, and `Content-Type`	Catches meaningful header presence or value changes without retaining cookies
Captured size and hash	Observed bytes and their SHA-256; `truncated` says when these cover only the captured prefix	Detects content drift while keeping every body read bounded
Completeness and transport diagnostics	Report coverage, per-probe truncation, and stable timeout, TLS, DNS, or transport error kinds	Separates a measured regression from an incomplete evaluation

How a migration audit runs

1 Snapshot BEFORE

Run the one-page audit and save its JSON report as a labelled baseline.

2 Make the change

Replatform, CMS or domain move, redesign, redirect-map rollout, infra cutover — whatever the migration is. Site Audit doesn’t care how you change it.

3 Snapshot AFTER

Run the same audit again and save a second labelled snapshot. The two bounded reports now sit side by side, ready to compare.

4 Diff + scoped scores

Per-URL deltas retain the frozen compatibility score beside a separately versioned technical search-readiness score, with human-readable and machine-readable output.

What the diff surfaces

Status transitions

200→404 broken, 200→3xx newly redirected, →5xx error introduced, 404→200 fixed.

Dropped security headers

An HSTS, CSP, or X-Frame-Options header that was present BEFORE and is missing AFTER — a silent, easy-to-miss migration regression.

Body-size & content drift

Sharp size deltas flag content loss or broken renders; the SHA-256 hash catches changes even when status and size look identical.

Final-destination changes

A changed final destination shows up for redirects the audit followed. The report does not claim to retain or compare every intermediate hop.

Fixed probe-set coverage

An auxiliary path that disappears or appears is explicit. This is coverage of the bounded one-page probe set, not a claim to inventory every page on the site.

Two honest scores

HTTP/security health stays independent from the versioned Technical SEO score, so a healthy server cannot hide an indexing problem and neither number claims rankings.

Essential & well-known files — presence and status

The one-page audit probes a fixed set of 16 conventional auxiliary paths beside the submitted page. Each row records bounded response evidence: status, content-type, captured size and hash, final destination, selected headers, and completeness. It is deliberately not a universal well-known-file validator.

Crawlers & SEO

robots.txt, sitemap.xml, sitemap_index.xml, and humans.txt, alongside the submitted page’s source-HTML search-readiness checks.

TLS & certificates

Leaf-certificate facts for HTTPS targets, plus response evidence for /.well-known/acme-challenge/. This does not simulate certificate issuance or renewal.

PWA & installability

manifest.json, manifest.webmanifest, and favicon.ico. Their probe rows report response evidence, not a complete browser installability test.

Mobile deep-linking

/.well-known/apple-app-site-association and /.well-known/assetlinks.json, with status, destination, and content-type evidence rather than platform-level validation.

Security & privacy

/.well-known/security.txt (RFC 9116 — present and not past its Expires date?), /.well-known/change-password, and /.well-known/gpc.json. The deeper body check in this group is the security.txt expiry field.

Ads & monetisation

ads.txt, the mobile-app app-ads.txt, and sellers.json — bounded response evidence, not validation of the full IAB authorised-sellers chain.

Status, not inferred applicability. A returned 2xx is present, a 404 is missing, a returned 3xx is redirected, and other 4xx/5xx responses are errors. HTML returned for a probed .txt, .json, .xml, or .webmanifest path is classified as a possible soft-404; expired security.txt is stale. Optional paths remain evidence for the operator to interpret, not proof that every site should publish them.

Across a migration this can surface a robots.txt that changed, a manifest that started 404ing, or an association-file probe whose status or final destination changed. Product-specific validity still belongs to the relevant platform validator.

Separate integrations and future audits

The one-page report, explained findings, share deeplinks, JSON snapshots and diffs, and sampled crawl are live preview features. Site Search remains a separate live product; when its optional integration is configured, its results are an ordering hint for sampled-crawl discovery rather than a replacement for sitemap and homepage links. The following ideas are roadmap directions, not claims about the current report:

API contract audit

Slurp a Swagger / OpenAPI spec and fuzz the endpoints with edge-value headers and payloads, asserting contract shape, status codes, and error codes hold.

Future AI answer readiness audit

How does your site look to AI assistants and answer engines? Inventory llms.txt and AI-crawler policy in robots.txt, and report what an agent can — and cannot — read from your pages.

Honest status

Preview, not GA

The one-page audit, snapshots, diffs, and sampled crawl are live preview features. The watch form and manual runs are a separate preview; scheduled execution depends on deployment, and webhook delivery is best-effort.

Site Search stays separate

Site Search remains a live offer. Site Audit’s sampled crawl discovers from sitemaps and homepage links and can use configured Site Search results only as an additional ordering hint.

Source HTML, not field performance

The Technical SEO result describes bounded source-HTML and crawl checks. It does not render mobile variants, measure Core Web Vitals, or predict search rankings.

Shaped by real buyers

We’d rather build the diff that a real migration owner needs than guess at a feature matrix. If you have a migration coming up, tell us what would make you trust it shipped clean.

Report privacy and infrastructure

Every completed browser report is stored for 90 days under an unguessable bearer UUID. Saving it as a labelled snapshot does not create a second server copy: the label stays in that browser, while the underlying report keeps its original 90-day expiry. A direct API or MCP report is not retained unless report sharing or server-side snapshot storage is requested. Stored reports retain bounded evidence - target URLs, status and redirect destinations, curated response headers, captured-size and hash evidence, scores, and findings - but not response bodies, request headers, or cookies. Anyone with a report UUID can read it until it expires, so treat the link as a bearer secret.

Production service, root, container, and data contents on Mars are encrypted at rest with LUKS2. The root passphrase is supplied interactively at boot and is not stored on Mars. The boot, EFI, BIOS, and provider-configuration partitions remain unencrypted but contain no root unlock key. HTTPS and API traffic uses TLS 1.2 or later. See the Privacy Policy and Data Processing Agreement.

Run 10 free audits, then wait one hour, or add 100

Each network gets 10 completed one-page Site Audit reports free. When the tenth report completes, a full one-hour cooldown begins. For business and self-employed buyers, a 5 EUR voucher adds 100 completed reports without that free-quota interruption. No account, workspace ID, or site ID is required.

Run Site Audit

Stripe Checkout fixes the price and quantity and collects the voucher-delivery email. Lifub creates the purchase reference automatically. This is a one-time B2B purchase with no subscription or automatic renewal. Payment is manually verified before the bearer voucher is issued, and retrying fulfillment for the same settled transaction returns the same voucher. Each completed one-page report - including a newly captured snapshot - uses one paid audit. Crawl, watch operations, snapshot reads, and diffs do not use voucher credits; hosted watch scheduling is not sold as part of this voucher. When its balance reaches zero, the app returns to the regular free quota.

More from Lifub: after the fixes land, see who actually visits with Analytics — human, bot, or AI-agent recognition, and keep the endpoints you fixed honest with assertion-based Monitoring.