The free check looks at your app the way any visitor’s browser does — from the outside, without logging in — and turns what it sees into four scores and a short list of findings. It takes a few seconds and never touches your data.
In short#
- One address at a time, and only when the owner (or someone they authorise) asks for it.
- Only what is already public: the home page, the JavaScript files it loads, response headers, public DNS records and the TLS certificate.
- Nothing is used, downloaded or changed: no logins, no keys we find are ever used, no data read from your database.
- Four separate scores: Security, Performance, Accessibility and SEO. We do not blend them into one number, so you can see where the problem is.
Who can ask for a check#
Anyone can run the free check, but only on an app they own or are authorised to have analysed. Before the check starts, you tick a box confirming exactly that; without it, nothing runs. We record that confirmation, the version of the text you accepted and the time.
We keep the free check deliberately light, so that a false declaration cannot cause harm: it reads only what any browser already receives, accepts at most 3 checks an hour against the same site, whoever asks, respects the site’s robots.txt, and identifies itself openly. Checks that go deeper than the public surface are never automatic — they are part of the full audit and happen only with the owner’s explicit authorisation.
What happens during a check#
- Your request is validated. The address must be a public website on the standard web ports; private networks and internal addresses are refused.
- We read the site’s
robots.txtfirst. If it asks automated tools not to read the home page, we stop there and tell you. - We load the home page and the site’s own JavaScript files that the page declares — up to 40 files, within a total of 20 seconds and 20 MB for the whole check. Scripts from other companies are not downloaded.
- On your own domain, we look up public records: the TLS certificate and the DNS records that protect your email (SPF, DMARC) and your certificates (CAA). On an app builder’s own subdomain these belong to the platform, so we skip them.
- We ask whether four fixed files exist —
/.env,/.git/config, the source maps your scripts point to, and/sitemap.xml— reading only the answer code, never the file itself. - We calculate your scores and show you the report. The check keeps only the results, never the content of your pages.
What we never do#
- Read, copy or store data from your database.
- Use a key, password or token we find. We report that it is visible; we never try it.
- Download configuration files, source code or source maps.
- Guess file or table names, or crawl other pages.
- Log in, submit forms or change anything.
- Hide who we are: every request carries the name
Root92-MigrationScannerand a link to https://webappscanner.root92.com/about-scanner.
Your scores explained#
| Score | What it tells you | How it is calculated |
|---|---|---|
| Security (0–100) | How much an outsider could exploit, and how tied the app is to its platform. | Starts at 100. Each problem found removes a fixed number of points (see the list below). It never goes below 0. |
| Performance (0–100) | How heavy and how fast your home page is. | Five measurements, each scored 0–100 and weighted: server response time 40%, JavaScript size 30%, number of JavaScript files 10%, HTML size 10%, server-side rendering 10%. |
| Accessibility (shown as issues) | Common barriers for people using screen readers or keyboards. | Six checks on the page markup, weighted by how severe the barrier is. The report shows how many failed. |
| SEO (shown as issues) | Whether search engines can index your home page and present it well. | Thirteen checks; each problem removes points from 100. The report shows how many were found. |
- “Score ≤ N” means we could not finish reading your app within the time or size limit. Anything we did not read may hide more problems, so your real score can only be lower.
- “Not measured” means the check could not run — usually because the page is built entirely in the browser, so its HTML is empty until JavaScript runs.
- Apps on an app builder’s subdomain: domain, email and certificate settings belong to the platform, not to you, so we do not count them against you.
- No score is shown if we could not reach the site, or if its
robots.txtasked us not to read it. In both cases we will contact you if you left your email.
What we check#
The free report shows the most important findings straight away. Other findings are counted in your score and listed in the full audit.
Security — platform and backend
| Check | What we look at | Points | Shown |
|---|---|---|---|
| Built with a site builder | Signs of Bolt, v0, Replit, Base44, Framer, Webflow, Wix, Squarespace, Shopify, WordPress, Bubble, Softr, Glide, Retool or another AI app builder | 12 | Free report |
| Hosted on a platform subdomain | The app answers on the builder’s own address (counted instead of the previous line, not in addition) | 12 | Free report |
| Supabase backend | A Supabase address in the page or its scripts | 16 | Free report |
| Firebase backend | A Firebase address in the page or its scripts | 16 | Free report |
Security — exposed keys and files
| Check | What we look at | Points | Shown |
|---|---|---|---|
| Database service key in the browser | A Supabase key with full administrative rights inside your public code | 45 | Free report |
| Database key in the browser | Your public Supabase key. It is safe only if row-level security protects every table | 34 | Free report |
| Other secret keys in the code | Secret keys for services such as Stripe, AWS, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio or Google, or private certificates | 40 | Free report |
.env file reachable | Whether your environment file can be downloaded by anyone | 40 | Free report |
.git folder reachable | Whether your code history can be downloaded by anyone | 40 | Free report |
| Public source maps | Whether the original source of your scripts can be downloaded | 8 | Full audit |
Security — browser protections
| Check | What we look at | Points | Shown |
|---|---|---|---|
| Insecure cookies | Cookies set without the Secure, HttpOnly or SameSite flags | 4 | Full audit |
| Content-Security-Policy missing | The header that limits which scripts may run | 2 | Full audit |
| HSTS missing | The header that forces browsers to use HTTPS | 2 | Full audit |
| Clickjacking protection missing | Protection against your page being embedded in another site | 2 | Full audit |
| CORS open to any site | Responses readable by scripts on any other website | 2 | Full audit |
| Mixed content | An HTTPS page loading images or scripts over plain HTTP | 2 | Full audit |
| X-Content-Type-Options missing | The header that stops browsers guessing file types | 2 | Full audit |
| Referrer-Policy missing | Control over how much of your addresses is shared with other sites | 1 | Full audit |
| Permissions-Policy missing | Limits on camera, microphone, location and similar features | 1 | Full audit |
Security — certificate, domain and email (your own domain only)
| Check | What we look at | Points | Shown |
|---|---|---|---|
| Outdated TLS or expiring certificate | Encryption older than TLS 1.2, or a certificate that expires within 30 days | 12 | Full audit |
| SPF record missing | Which servers may send email for your domain | 6 | Full audit |
| DMARC record missing | Your policy against email impersonation | 6 | Full audit |
| DMARC in monitor-only mode | A DMARC policy that watches but does not block (p=none) | 3 | Full audit |
| Domain does not receive email | No mail server published for your domain | 2 | Full audit |
| No CAA record | Which certificate authorities may issue certificates for your domain | 1 | Full audit |
Performance
| Measurement | What we measure | Good → poor |
|---|---|---|
| Server response time (40%) | Time until your server starts answering | under 200 ms → over 800 ms |
| JavaScript size (30%) | Total size of your own scripts | under 300 KB → over 1.5 MB |
| JavaScript files (10%) | How many of your own script files load | 3 or fewer → 20 or more |
| HTML size (10%) | Size of the home page markup | under 15 KB → over 100 KB |
| Server-side rendering (10%) | Whether content is already in the HTML | yes = 100 · no = 60 |
Accessibility
| Check | Why it matters | Weight |
|---|---|---|
| Images have alternative text | Screen readers can describe images | High ×3 |
| Form fields have a label | Users know what to type | High ×3 |
| Buttons have a name | Icon-only buttons are announced | High ×3 |
| Links have readable text | Users know where a link goes | Medium ×2 |
| The page declares its language | Text is read with the right pronunciation | Medium ×2 |
| Heading levels do not skip | The page structure is navigable | Low ×1 |
SEO
| Check | Points |
|---|---|
| The page asks search engines not to index it | −40 |
| Title missing | −15 |
| Mobile viewport setting missing | −12 |
| Meta description missing | −10 |
| No main heading (H1) | −10 |
| No canonical link | −5 |
| More than one H1 | −5 |
| No social preview (Open Graph) | −5 |
| Title shorter than 10 or longer than 60 characters | −4 |
| Description shorter than 50 or longer than 160 characters | −4 |
robots.txt missing or empty | −3 |
| No sitemap found | −3 |
| Broken language alternates (hreflang) | −3 |
Privacy and technology (no score)
- Trackers before consent — advertising and analytics trackers (Google, Meta, Hotjar, TikTok, LinkedIn, X, Pinterest, Snapchat, Microsoft Clarity, Yandex) that load before a visitor could agree. Shown in the free report.
- Cookie consent tool — whether a known consent banner is present.
- Privacy policy link — whether the home page links to one.
- Technology overview — framework, hosting provider, analytics tools and number of external services. Context for the migration, not a problem in itself.
What an automatic check cannot see#
The free check looks only at your home page from the outside. It cannot see logged-in areas, other pages, your database rules, slow queries or how your code handles data. Where a check depends on content that only appears after JavaScript runs, we say “not measured” rather than guessing. The full audit covers what the free check cannot: it is carried out by our team, with access you grant, table by table — and we still never read your data.
Frequently asked questions#
Does the check slow my site down?
No. It is one short visit with a fixed time and size budget, comparable to a single visitor loading your home page.
You found my database key. Has my data been accessed?
Not by us. We report that the key is visible in your public code; we never use it. Whether it is a real risk depends on your row-level security settings, which the full audit checks.
Why is my score lower than I expected?
Each finding removes points, and the serious ones remove many: one exposed secret key alone costs 40 points. Findings not shown in the free report still count; the report tells you how many there are.
Can I stop the scanner from checking my site?
Yes. Add User-agent: Root92-MigrationScanner and Disallow: / to your robots.txt, or see https://webappscanner.root92.com/about-scanner.
What do you keep after the check?
Only the results, never your page content. If you do not leave your email, we keep no contact record. Details and retention periods are in the privacy policy (https://webappscanner.root92.com/privacy).