Tools

How contrast ratios are computed from foreground and background colours, which thresholds apply to which text, and the cases no automated check can measure.

How ARIA attributes are validated — unknown roles, references pointing nowhere, interactive elements hidden from assistive technology — and why no ARIA beats wrong ARIA.

How tab order, positive tabindex values, focus indicators, skip links and non-native interactive elements are checked from the served markup — and what needs a keyboard.

How API endpoint discovery finds the endpoints a site exposes, how it separates public data from protected data, and why it never enumerates paths.

How a CORS checker reads Access-Control-Allow-Origin, tests the OPTIONS preflight, and why a wildcard with credentials is rejected by every browser.

How an error disclosure check reads public API responses for stack traces, database errors, debug flags and server paths, and what to return instead.

How an API cache policy check reads Cache-Control on API responses and finds user-specific data that a shared cache is permitted to store and re-serve.

How a published OpenAPI or Swagger document is detected, what its declared security schemes say about the API, and why a spec drifts from the service.

How a rate-limit header check reads RateLimit-Limit, Remaining and Reset on real responses, and why their absence does not prove there is no limiting.

How the public signals of a site's authentication are read: login and logout entry points, federated sign-in, token usage and publicly documented MFA.

How a WordPress exposure check tests wp-login, the REST API, XML-RPC and configuration file paths — with no credentials, no enumeration and no exploitation.

How WordPress core, plugin and theme versions are read from what a site publishes, and why a version is never reported without an observed source.

How navigation is examined across a whole crawl: menu entries and their accessible names, consistency between pages, click depth, and pages nothing links to.

How a cookie scanner builds an inventory from real Set-Cookie headers, what it reports about scope, size and lifetime, and the cookies it cannot see.

How linked public repositories, public CI indications and browser-side environment variable names are collected, and what each of them really exposes.

What a DNS check reads — A, AAAA, MX, TXT, NS, CAA, DNSSEC — and the inconsistencies that cause intermittent failures.

How a propagation check queries several resolvers to find disagreement after a DNS change, and why conflicting record types break things that look unrelated.

What a DMARC checker parses tag by tag — policy, subdomain policy, percentage, alignment, reporting — and which syntax errors make receivers ignore it.

What an SPF checker validates — a single well-formed record, the ten-lookup budget, the all qualifier, the deprecated ptr mechanism — and what each result means.

How a DKIM check finds selectors without being able to enumerate them, what a published key tells you, and why a clean result is a coverage statement.

How an MX check validates that every published mail exchanger resolves, that there is more than one, and that each has reverse DNS — and why each matters.

How MTA-STS is verified in two places — a DNS record and an HTTPS policy file — why both must agree, and what TLS-RPT adds to the picture.

How srcset and sizes declarations are validated, why a srcset without sizes rarely helps, and how oversized images are identified from real measurements.

How image formats and compression are measured on the files really delivered, why negotiation means the answer depends on the client, and what to act on.

How lazy loading is audited against what is above the fold, why lazy-loading the largest image delays rendering, and what fetch priority changes.

How a broken link checker discovers links, which status codes it treats as broken, and the links no automated checker can reach.

How viewport, content width, text size, touch targets and mobile navigation are checked at a phone width — and what only a real device can establish.

How public health and readiness endpoints are found during a crawl, why a public one is normal, and what a health response should never include.

How a compression check reads Content-Encoding on the HTML and on text resources, why the two differ so often, and what a correct result looks like.

How cache headers are read on the document and on static assets, what a CDN hit or miss header reveals, and why validators are not a substitute for a lifetime.

How resource hints are audited for consistency — a preload nothing uses, a preconnect to a domain the page never contacts — and why more hints is not better.

How total transfer weight is measured, why the heaviest few resources matter more than the count, and why the coverage statement is part of the result.

How trackers and third-party embeds are detected from real script hosts, why an embed differs from a link, and why this is an observation and never a verdict.

How a web app manifest is fetched and parsed, which fields the install prompt depends on, and why an incomplete manifest fails silently.

Which response headers a checker reads, why a header being present is not the same as it being effective, and what header inspection cannot tell you.

How served scripts and stylesheets are inspected for credentials, internal URLs, server paths and source maps — and why the coverage figure decides the result.

How a security.txt file is validated — the canonical location, the required Contact and Expires fields, the policy link — and why an expired one is worse than none.

How a redirect checker reveals every hop between a URL and its destination, what the status of each hop means, and how loops are detected.

What an external TLS check can observe — certificate coverage, expiry, protocol versions, HSTS — and what it deliberately does not test.