How we built
the free site scanner.

01What happens when you paste a URL

The browser sends your URL to a small AWS Lambda function. That function does two things in parallel: it fetches your site itself for first-party evidence — reachability, redirect chains, title, meta description, H1 count, canonical, Open Graph tags — and it calls the Google PageSpeed Insights API for the deep audit: performance, accessibility, best practices, and SEO.

That second call is the heavy one. A single homepage run evaluates 153 individual Lighthouse audits on our own site, from image weight to tap-target size. The Lambda merges everything into one report, computes a score, and returns the part the free teaser is allowed to show.

02Why the scan runs server-side

We could have called PageSpeed straight from your browser. We don't, for three reasons:

• The API key stays ours. It lives on the Lambda, never in shipped JavaScript. Nobody can lift it and burn our quota.
• The fetch is pinned. Before fetching anything, the function resolves the hostname and connects to the address it resolved — URLs with embedded credentials, unusual ports, or private network addresses are rejected outright. The scanner can't be turned into a proxy into someone's internal network.
• Rate limits are per visitor. Each IP gets a small allowance, tracked in DynamoDB. One abusive script can't degrade the tool for everyone else.

03The honesty rules

A diagnostic tool is only worth trusting if it admits what it couldn't check. Three rules are baked in:

• Unverified is not failed. If PageSpeed is unreachable or times out, those audits render as "we couldn't verify this" — never as invented problems to scare you with.
• Locked findings are really locked. The free teaser shows about half the report. The higher-priority findings are held back server-side; they are not hidden in the page, they are simply never sent to your browser until the email unlock.
• The report has a shelf life. The full result is stored compressed with an expiration, long enough for the unlock and follow-up flow — not kept forever.

04What we deliberately didn't build

No accounts. No dashboard. No "monitor all your sites" SaaS. The scanner has one job: show you, with evidence, what is actually wrong — and prove we know how to read a site before you ever talk to us. The business is fixing what it finds, not renting you another login.

The same lens is available for your site right now, free: run the site report. And if you'd rather read how it behaves on its own doctor, we scanned ourselves first.