Scan a website for the EU compliance basics.
Nine checks on the front page of any site: transport security, consent, trackers, privacy links, legal pages and headers. Free, no account, with a rate limit of 10 requests per minute per IP address. The worker processes the page for the request and keeps only a scan counter and hostname-level aggregate statistics, not the full URL, HTML, or result.
Try it on , or .
A pass means the scanner found evidence on this page. A warning means it could not tell. Fix needed means something expected is missing. Read the checklists for the parts no scanner can see.
Running WordPress? The nine checks above are the technical basics; Pro adds the documents that go with them. 79 USD per website per year is a Pro license in the free plugin, which unlocks editable starters for a data processing agreement, NIS2/DORA vendor clauses and an accessibility statement, plus an HTML report from your latest scan and the same report as a PDF. Your site's scan history is part of it — it stays in your own WordPress, and the report can be shared with a client as a read-only link that expires, or attached as an HTML or PDF file. Hosted re-scans from our servers and the live badge are not part of it. Not on WordPress? The template store has the same documents as standalone files.
Buy Pro — 79 USD per website per year
Check this site again every morning
Register and you get an email when the overall score drops. Free while the monitoring service is in test; your address is used for this and nothing else.
What each check means
- HTTPS and HSTS
- The site must be served over TLS. HSTS tells browsers never to try plain HTTP again. A missing HSTS header is a warning, not a failure.
- Cookie consent
- Looks for a known consent platform in the HTML. If you set no non-essential cookies you do not need one, and you can ignore the warning.
- Tracker and consent markers
- Compares known analytics and ad scripts with consent-platform markers in the served HTML. It does not observe runtime request order or consent choices.
- Google Consent Mode v2
- Only relevant if you use Google Ads or Analytics with EU visitors. Without it, Google limits your measurement.
- IAB TCF
- Relevant for publishers selling programmatic ads. Everyone else can ignore it.
- Forms and privacy notice
- A form without a privacy link nearby is the easiest GDPR finding there is. Add the link and a short sentence on what you do with the data.
- Legal pages
- Privacy policy and terms for everyone; an imprint if you sell to Germany or Austria; an accessibility statement if the Accessibility Act applies to you.
- Security headers
- CSP, X-Content-Type-Options, Referrer-Policy and X-Frame-Options or frame-ancestors. Cheap to add, and the first thing a security questionnaire asks about.
- Resilience and mail markers
- Counts static markers in the served page — incident response, business continuity, failover, a status page and SPF/DKIM/DMARC/MX wording. Two or more count as a pass, and it runs on every site. Not a DORA assessment.