SEO, AI search (GEO), security and performance: 85 checks in one scan, with fix prompts ready to paste into Claude, Cursor or any coding agent.
Six things that break quietly on real sites, each found from the outside, the way a visitor, a crawler or an attacker would find it.
Web Scan reads the scripts your page links and looks for what should never have left the server: Stripe and OpenAI keys, a Supabase service_role token that ignores every policy you wrote, published source maps, a database URL with its password. Every finding is redacted.
A staging noindex that survives launch keeps a site out of search entirely, and nothing on the page looks wrong.
Your page rendered the way X, Slack and Google will render it, with the og:image fetched the way a crawler does. Without your cookies, so a 403 shows up here instead of in public.
HSTS, CSP, nosniff, framing and referrer policy against the live response, plus whether the CSP you have actually forbids anything and whether your session cookie is readable by script.
First byte, compression, render-blocking scripts, and the images that shift your layout.
Every failure carries the specific change to make. Missing tags come back as a head block you can paste, prefilled from what the page already says about itself.
GPTBot, ClaudeBot and PerplexityBot fetch your HTML and stop. They do not run JavaScript, so a page that paints its content in the browser can rank on Google and still be blank to the assistants people now ask first.
Web Scan fetches your page the same way and shows exactly what it can read, and whether it can answer the three questions a buyer asks.
Failing a critical check caps the total instead of averaging away, so a site missing its og:image cannot reach an A by compressing its images well.
Measured across these five sites on 2 November 2026.
You do not have to remember to come back. Hourly re-scans, and a message in Slack or Discord only when the state changed: a five point drop, a new failing check, or the page not answering. One message on the way down, not one an hour.
Monitor a URLThe scan API is public and needs no key. The response carries the score, the grade and every check, so gate on whichever of them you care about.
Coding agents can check their own fixes after a deploy: /api/verify answers which checks now pass, and the same tools are an MCP server at preflight-api.agentmarket.lol/api/mcp. Setup is in llms.txt.
- name: Web Scan
run: |
SCORE=$(curl -sS -X POST https://preflight-api.agentmarket.lol/api/scan \
-H 'content-type: application/json' \
-d '{"url":"https://your-site.com"}' | jq .report.score)
[ "$SCORE" -ge 90 ] || { echo "scored $SCORE"; exit 1; }85 checks in 11 areas, scored as 3 parts: search and sharing (SEO, AI search, social previews, crawlability, images, accessibility), security (transport and exposed secrets), and speed. Every failing check says what to change and why.
No. Anyone can scan a page. Signing in with Google raises your daily limits and keeps your reports for 14 days, private to you.
No. Web Scan reads only what your site already serves every visitor: the page, the scripts it links, robots.txt and the sitemap. It never guesses at paths like /.env, and any secret it finds is redacted before it is shown.
Checks are weighted inside each area, a warning counts for about a third of a pass, and failing a critical check caps the total instead of averaging away. A site with no og:image cannot reach an A on fast images alone.
Yes. Every report has a fix prompt to paste into Claude, Cursor or Copilot, and agents can call /api/verify or the MCP server to confirm their own fixes after a deploy.