Mike (@mikerb95)CodeByMike
Get in touch
Back to /lab
/lab/site-checkSite scanner

Scan any
domain.

Paste a URL or domain and get, live, security headers, TLS certificate, DNS, basic SEO, performance, and a heuristic accessibility review. Everything is read from the site's public HTTP responses - this is not an intrusive scan.

Only use it on sites you own or have permission to scan. Limit: 5 scans per minute per IP.

How the scanner works

Step by step
  1. You paste a URL or domain and click Scan.
  2. The browser sends a POST to /api/lab/site-check, protected by a limit of 5 requests per minute per IP.
  3. The server normalizes the URL and resolves its DNS to verify it does not point to a private or internal IP (127.0.0.1, 10.x, 169.254.x, etc.) - if it does, it is rejected before connecting.
  4. The 12 tests are launched in parallel, each with its own timeout, and results are streamed to the browser as they finish (NDJSON streaming) - which is why the cards appear one by one instead of all at once.
  5. Nothing is stored: the scan is ephemeral, it lives only in that response. There is no history and no database behind it.
The 12 tests
  • HTTP availability - status, time to first byte (TTFB), redirects.
  • TLS certificate - opens a raw TLS socket (node:tls) and reads issuer, validity, and protocol.
  • HTTPS redirect - checks whether the HTTP version redirects to HTTPS.
  • Security headers - HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
  • DNS records - A, AAAA, CNAME, MX, NS, TXT via node:dns.
  • Domain expiry - an RDAP lookup, no API key needed.
  • robots.txt and sitemap.xml - presence and basic format validity.
  • SEO metadata - title, meta description, canonical, Open Graph, lang attribute.
  • Basic performance - TTFB, HTML weight, count of linked scripts/styles/images.
  • Accessibility (heuristic) - images without alt, fields without a label, heading hierarchy, generic link text. It is a simple static check and does not replace a real axe-core audit.
  • Lighthouse (PageSpeed Insights) - runs real Lighthouse on Google servers via their public API; performance, accessibility, best practices, and SEO with real metrics (LCP, CLS, TBT).
Technical details
  • No headless browser. Everything runs on fetch + node:tls + node:dns - no Chromium/Playwright, which is why it answers in seconds and fits in Vercel's free plan.
  • Passive read-only. No test modifies the target site or attempts to exploit anything - these are the same HTTP responses any visitor or search engine would see.
  • Anti-SSRF. DNS resolution is validated against private/loopback/link-local ranges before any connection, so the server cannot be used as a proxy into internal networks.
  • Real Lighthouse is optional. It depends on a Google PageSpeed Insights key configured on the server; if it is missing, that card simply says it is not configured.