Is your live app healthy?
Paste a link and get an honest first answer in about a minute, with the evidence behind it and an explanation in plain words. If you want a second opinion, a senior engineer can go through it with you.
- No passwords or code access
- Evidence for every finding
- Says what it could not check
What we check
Seven areas, each with its own rules and its own evidence. Every finding opens with a plain-words explanation and says how sure we are.
Security basics
HTTPS, the certificate, security headers and cookie flags, as any visitor's browser sees them.
Speed on a phone
Google PageSpeed results for mobile, plus real-visitor speed data where Google has it.
Quality basics
An automated accessibility subset, best practices and JavaScript errors when the page loads.
Search discoverability
Titles, descriptions, canonical addresses, headings, sitemap and structured data across up to 80 pages.
AI search readiness
Whether your content is in the page HTML and described in a way AI assistants can use.
Freshness
Library and runtime versions we can actually see, compared with end-of-life dates.
Email and privacy signals
Email protection records in DNS, analytics tags we can name, and whether a privacy policy link exists.
How it works
Paste a link
A live URL, and optionally a public GitHub repository. No password and no code access.
Watch checks arrive
Security, speed and quality checks run on public information and appear as each one finishes.
Read the evidence
You see a score only when enough was verified, the evidence behind each finding, and what we could not check.
Ask for a human
One click requests a free review from a senior engineer, pre-filled from the scan.
What it can and cannot see
It can see
- Whatever any visitor can see: public pages, response headers, the certificate and public DNS records.
- Up to 80 pages found through your own links and sitemap, slowly and politely.
- A public GitHub repository, if you add one: recent activity, tests, automated checks and declared versions.
It cannot see
- Anything behind a login, such as dashboards or payments.
- Private code and business logic, or how the app behaves under load or attack.
- Whether the app does what your business needs. When too little is visible we say “Partial evidence” instead of giving a weak score.
Fixed rules, no guesswork.
The score comes from fixed, versioned rules applied to what was observed. No AI model decides, scores or writes any finding: the wording comes from the same checks that found the problem. Every statement is labelled as verified by scan or self-reported.
Read how the score works- Fixed, versioned rules
- Evidence behind every finding
- Honest about what it missed
- Private report, deleted after 30 days
- No page content stored
Questions
Is it really free?
Yes. The check and the report are free. The expert review is free too, and it comes with no obligation.
Do you need access to my app?
No. We only look at what any visitor can see: the public pages, the response headers, the certificate and, if you add one, a public GitHub repository.
Will it affect my site?
No. It makes about ten requests for the main page and standard files, then follows your own links to read up to 80 pages in total, slowly and one site at a time. It never guesses paths, never logs in and honours your robots.txt. The requests identify themselves as ZovintraHealthCheck.
What do you store?
Derived results only: the findings and scores. We do not store page content, source code or passwords. Reports are private and deleted after 30 days. The method page has the full privacy notice.
Is this a security audit?
No. It is an automated first look at public signals. It cannot see behind a login, review private code or test how the app behaves under attack. A human review can cover more.
What happens if I request a review?
A senior Zovintra engineer reads your results and replies within 2 working days with what they would check next. You decide what happens after that.
This is an automated initial assessment based on public information at one point in time. It is not a code audit, penetration test or security certification.