visibilityPinkCrab Site EyesA real Chromium browser. It loads your pages the way a visitor’s browser does, so we can time them, see everything they load, test them for accessibility and watch what your cookie notice does.
record_voice_overPinkCrab Screen ReaderRuns Apple VoiceOver on a Mac and records it reading your page, so you can hear what a blind visitor hears.
psychologyPinkCrab Karkinos (AI)An AI model on our own hardware. It reads the first 400 words of your page to show what an AI understands your page to be about.
code_blocksPlugin version toolCompares the plugin and theme files your page loads with every official release, to work out which versions your site runs.
searchSearXNGA search service we host. It searches for your business name, your address and your search terms, to see where your site appears.
speedGoogle LighthouseRun on our own server, for its search engine and accessibility audits of your page.
accessibility_newaxe-coreThe accessibility engine that checks the rules a machine can decide, such as images with no description.
cookieTracker and cookie listsOur copies of EasyList, EasyPrivacy, Fanboy Social and the Open Cookie Database, to name the trackers and cookies your site sets.
task_altCookie notice rulesOur copies of the Consent-O-Matic and DuckDuckGo autoconsent rules, to find and press the buttons on your cookie notice.
warningThreat listsOur copies of Feodo Tracker, Spamhaus DROP, the Tor exit list and Emerging Threats, to check your servers against addresses known to be used by criminals. Nothing about your site is sent to them.
verifiedwordpress.orgThe current WordPress, plugin and theme versions, and the official fingerprints of WordPress’s own files, to spot out of date software and changed files.
shieldA vulnerability scannerA security scanner that uses AI to probe your site for weaknesses.
neurologyPerplexityAn AI answer engine, asked questions a customer might ask, to see whether its answers cite your site.
monitor_heartMozilla HTTP ObservatoryGrades the security headers your site sends.
descriptionrdap.orgYour domain’s registration, such as its expiry date and whether it is locked against transfer.
lockhstspreload.orgWhether browsers are told to always use HTTPS for your domain.
errorabuse.chIts SSL blocklist, URLhaus and ThreatFox, to see whether your certificate, links or servers are linked to malware.
remove_circle_outlineSpamCop, Barracuda and SURBLThe blocklists email providers use, to see whether your emails risk being refused.
databaseAbuseIPDBReports from other site owners about attacks coming from your servers.
troubleshootShodan InternetDBWhich ports on your servers are open to the internet.
analyticsGreyNoiseWhether your server has been seen scanning the internet, which can mean it has been taken over.
verified_userQuad9 and Cloudflare’s malware filterWhether these widely used services stop visitors reaching your site.
linkcrt.shThe public certificate logs, to find your subdomains and any left pointing at a service that no longer exists.
labelCloudflare and Google public DNSTo check your domain is signed with DNSSEC.
check_circleYour cookie toolCookiebot, OneTrust, CookieYes, Usercentrics or Termly, when your site uses one, for the cookie list it publishes for your site.
