How to check any website for EU compliance — free, 30 seconds, no install

Published 23 August 2026 · 6 min read · Try the scanner →
TL;DR: EU compliance rules (GDPR, NIS2, DORA, EAA) apply to every website serving EU users — not just WordPress sites. You can now scan any URL, on any platform, for free in 30 seconds. Enter a domain, get 6 compliance checks with suggested fixes. No account, no install, no platform lock-in.

Who needs to read this

You run a website — or you manage websites for clients — and someone (a client, an auditor, an insurer, a procurement officer) has asked: "Is this site compliant with EU regulations?"

Maybe you're on Shopify and a European customer complained about cookie consent. Maybe you manage sites on Webflow, Squarespace, or Wix and need to prove GDPR Art. 32 security measures to a client. Maybe you're a Next.js developer and the CTO wants a compliance baseline before launch.

Until now, compliance scanners either required installing a WordPress plugin (useless if you're not on WordPress), or they were enterprise tools costing hundreds per month, or they were so generic that the output was useless.

The problem with platform-specific tools

Most compliance tools assume you run WordPress. That's a problem because:

EU regulations don't care what platform you use. GDPR Art. 32 (security), NIS2 Art. 21 (cybersecurity measures), DORA Art. 6 (ICT risk management), and the European Accessibility Act (accessibility statements) all apply the same way regardless of your CMS choice.

How the free universal scanner works

The EUComply scanner doesn't need installation, a plugin, or an account. It works like a browser visiting your site — it fetches your URL, inspects the HTML and HTTP headers, and runs six checks:

Check What it looks for Why it matters
🔒 HTTPS + HSTS Is TLS active? Is Strict-Transport-Security set? GDPR Art. 32 requires appropriate security measures. HSTS prevents downgrade attacks.
🍪 Cookie consent Detects 15+ consent platforms in the HTML ePrivacy Directive requires prior consent for non-essential cookies.
📋 Forms & privacy link Are there forms? Is a privacy-policy link nearby? GDPR Art. 13 requires informing users at data collection.
📄 Legal pages Privacy Policy, Imprint, Terms, EAA statement linked? Required under GDPR, EAA, TMG (Germany), LSSI (Spain) and more.
🛡️ Security headers CSP, X-Content-Type-Options, Referrer-Policy, X-Frame-Options OWASP security baseline. NIS2 Art. 21 requires appropriate cybersecurity measures.
🔍 Platform fingerprint Detects the CMS/stack (informational) Helps adapt advice — purely to show the scanner is platform-aware.

Each check returns Pass, Warning, or Fix needed — with a suggested fix for every failing check. The scan takes under a second.

Try it: three real websites

Go to the scanner page and enter any of these:

wordpress.org (WordPress)

HTTPS + HSTS: ✅ PASS
Cookie consent: ⚠️ None detected (community site, no marketing cookies)
Forms: ✅ PASS (privacy policy linked)
Legal pages: ✅ Privacy Policy, Terms linked
Security headers: 🛡️ 1/4 present

shopify.com (Shopify)

HTTPS + HSTS: ✅ PASS (HSTS: max-age=15552000)
Cookie consent: ⚠️ None detected (Shopify.com is a marketing site)
Legal pages: ✅ Privacy Policy, Terms linked
Security headers: 🛡️ 1/4 present

example.com (hand-written HTML)

HTTPS + HSTS: ⚠️ No HSTS header
Cookie consent: ⚠️ None detected
Legal pages: ❌ No privacy policy link
Security headers: 🛡️ 0/4 present

All three — WordPress, Shopify, and hand-written HTML — get the same checks. The scanner doesn't care what platform you use.

What the platform check tells you

The scanner detects the CMS/stack automatically from HTML signatures:

This is purely informational. The checks are identical regardless of what's detected.

From scan to documented compliance

The free scanner gives you a quick baseline. For auditor-ready documentation, the Pro tier ($79/year) generates:

Why this matters now

Three regulatory changes are driving demand for compliance checks:

  1. NIS2 Directive — entered force in October 2024, must be transposed by EU member states. It expands cybersecurity requirements to more sectors and imposes stricter supply-chain security (Art. 21 applies to vendors too).
  2. DORA — Digital Operational Resilience Act for financial services. In effect January 2025. Requires ICT risk management that cascades to service providers.
  3. European Accessibility Act (EAA) — applies from June 2025 to most websites serving EU consumers. Requires an accessibility statement and WCAG 2.1 AA compliance.

    4. All three of these sit on top of GDPR, which has been generating enforcement cases steadily since 2018. Combined, they mean that any website serving EU users now needs to demonstrate compliance across multiple regulatory domains.

    What about WordPress users?

    If you do run WordPress, the same checks are also available as a free WordPress plugin that adds:

    But you don't need WordPress to use the scanner. The universal web scanner works for everyone.

    Start scanning now

    No signup. No install. No WordPress required.

    Scan any URL →

    Need documented proof of compliance?

    The free scanner tells you what's wrong. Pro gives you auditor-ready reports, DPA documents, NIS2 clause kits and EAA statements — generated from your scan results.

    See Pro — $79/year