About Site Checkup
A free, careful check-up for small business websites
Site Checkup runs 36 checks across security, domain & email, speed, search, ai answers, trust & legal, and writes the results for the business owner, not only for developers. It’s made by Codatale.
What the free check-up does
It visits your homepage and a few public files (robots.txt, sitemap.xml, security.txt, llms.txt, favicon), reads your DNS records, and asks public services about your domain: the domain registry (RDAP), Google PageSpeed Insights, Google Web Risk, WordPress.org and the retire.js vulnerability list.
Requests are spread out, a few at a time, and identify themselves with the user agent “SiteCheckup/1.0”. To see whether AI search tools can read your site, we also send one homepage request each with their published user agents.
It never logs in, submits forms, guesses passwords, or asks for private paths.
The deeper scan
Only after the owner adds a DNS record that proves control of the domain, the deeper scan asks for a fixed list of private paths (such as .env, .git and backup files), checks a few admin pages, lists subdomains from public certificate logs, and tests whether database and remote-access ports answer.
When it finds a private file it reads at most the first few lines to confirm it, hides every value, and stores nothing from it. It never tries to log in anywhere.
Fair use
Only check websites you own, manage, or have permission to check. Don’t use Site Checkup to look for weaknesses in other people’s sites.
We limit how many check-ups can be run from one place, and we may block anyone who misuses the service.
What we keep
We don’t keep your report. It stays in our server’s memory for one hour so you can open it, then it’s gone; we never write it to disk. Your browser keeps its own copy of your last 20 reports, for up to 90 days, so the report link keeps working on this device. Clearing your browser data deletes it.
We don’t ask for your email address and we don’t keep a list of the sites that were checked.
We don’t use tracking cookies or advertising trackers.
If your site was checked and you didn’t ask for it
The free check-up only sees what any visitor sees. If you have questions or want your domain excluded, email contact@codatale.com.